Use aiohttp.encode_basic_auth() instead of deprecated BasicAuth#386
Conversation
aiohttp 3.14.0 deprecates aiohttp.BasicAuth and the auth= parameter on ClientSession, both slated for removal in aiohttp 4.0. Build the Authorization header explicitly with aiohttp.encode_basic_auth() in the async client instead, and raise the minimum aiohttp version to 3.14.0 (where encode_basic_auth is available). encode_basic_auth() defaults to utf-8 where BasicAuth defaulted to latin1. This is irrelevant here since account IDs are numeric and license keys are ASCII, but is worth noting. Adds a webservice test asserting the Authorization header is sent, for both the sync and async clients. STF-604 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the async client to build its Authorization header using aiohttp.encode_basic_auth() instead of the deprecated aiohttp.BasicAuth / auth= parameter. Consequently, the minimum required version of aiohttp has been bumped to 3.14.0 in pyproject.toml and uv.lock, and a corresponding unit test has been added to verify the presence and value of the Authorization header. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
2 participants
STF-604
As of aiohttp 3.14.0,
aiohttp.BasicAuthand theauth=parameter onClientSessionare deprecated and will be removed in aiohttp 4.0, emittingDeprecationWarnings in CI. This builds theAuthorizationheader explicitly withaiohttp.encode_basic_auth()in the async client instead.Only the async (aiohttp) client is affected; the sync client uses
requests(.auth), which is not deprecated.Changes
AsyncClient._session()to an explicitAuthorizationheader.>=3.14.0(whereencode_basic_authwas introduced).Authorizationheader is sent, exercised for both the sync and async clients.Notes
encode_basic_auth()defaults to utf-8 whereBasicAuthdefaulted to latin1. Irrelevant here (numeric account IDs, ASCII license keys), but worth noting.🤖 Generated with Claude Code