Use aiohttp.encode_basic_auth() instead of deprecated BasicAuth

[oschwald]

STF-604

As of aiohttp 3.14.0, aiohttp.BasicAuth and the auth= parameter on ClientSession are deprecated and will be removed in aiohttp 4.0, emitting DeprecationWarnings in CI. This builds the Authorization header explicitly with aiohttp.encode_basic_auth() in the async client instead.

Only the async (aiohttp) client is affected; the sync client uses requests (.auth), which is not deprecated.

Notes

• encode_basic_auth() defaults to utf-8 where BasicAuth defaulted to latin1. Irrelevant here (numeric account IDs, ASCII license keys), but worth noting.
• The aiohttp floor is already >=3.14.0 (raised by a prior dependency bump), so encode_basic_auth is guaranteed available.
• The existing webservice_test.py::test_request already asserts the Authorization header value, and passes unchanged (the header bytes are identical to the old BasicAuth output).

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the async client to build its 'Authorization' header using 'aiohttp.encode_basic_auth()' instead of the deprecated 'aiohttp.BasicAuth' / 'auth=' parameter, and updates the changelog accordingly. Feedback was provided to address a potential issue where 'self._account_id' might be a 'bytes' object, which would lead to incorrect header formatting and authentication failures; a fix was suggested to decode it to a string if necessary.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If account_id is passed as bytes to the client, self._account_id will be stored as bytes (as seen in BaseClient.__init__). Passing a bytes object to aiohttp.encode_basic_auth will result in an incorrect Authorization header because the f-string formatting inside aiohttp.encode_basic_auth will format it as b'...' (e.g., b'12345':license_key), leading to authentication failures.

We should decode self._account_id to a string if it is a bytes object before passing it to aiohttp.encode_basic_auth.

                    "Authorization": aiohttp.encode_basic_auth(
                        self._account_id.decode("utf-8")
                        if isinstance(self._account_id, bytes)
                        else self._account_id,
                        self._license_key,
                    ),