Pin aiohttp to the 3.7.x version

[mfitton]

Why are these changes needed?

aiohttp has released a 4.0 build that changes some APIs and led to the dashboard breaking in the nightly. This pins the version so that we maintain a consistent API.

Related issue number

Closes #12049.

Checks

• I've run scripts/format.sh to lint the changes in this PR.
• I've included any doc changes needed for https://docs.ray.io/en/master/.
• I've made sure the tests are passing. Note that there might be a few flaky tests, see the recent failures at https://flakey-tests.ray.io/
• Testing Strategy
  • Unit tests
  • Release tests
  • This PR is not tested :(

[stephanie-wang]

Should we use < or <=?

[mfitton]

@stephanie-wang I pinned it to 3.7 since the latest release (outside of the 4.0 alpha builds), is 3.7.2. 3.7 seems to work fine with Ray and will probably have the fewest vulnerabilities / issues. It also has the same api as the 3.6 version.

[mfitton]

It should be ready to merge. I don't have permissions to merge it myself, so I'd appreciate if you could Stephanie. I checked the tests to make sure they weren't related.

[stephanie-wang]

It should be ready to merge. I don't have permissions to merge it myself, so I'd appreciate if you could Stephanie. I checked the tests to make sure they weren't related.

Thanks!

[fyrestone]

Should we use < or <=?

@mfitton I think < is better. Pin the version may cause dependency conflicts. aiohttp is not a very popular package, so we haven't heard any complaints from users.