Skip to content

Python: Bump pyasn1 from 0.6.2 to 0.6.4 in /python - #14173

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/pyasn1-0.6.4
Closed

Python: Bump pyasn1 from 0.6.2 to 0.6.4 in /python#14173
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/pyasn1-0.6.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pyasn1 from 0.6.2 to 0.6.4.

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
  • Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Release 0.6.3

It's a minor release.

  • Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).
  • Fixed OverflowError from oversized BER length field.
  • Fixed DeprecationWarning stacklevel for deprecated attributes.
  • Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)
  • Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Revision 0.6.3, released 16-03-2026

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump pyasn1 from 0.6.2 to 0.6.4 in /python
acb7bc4 
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.2 to 0.6.4.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.2...v0.6.4)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings July 22, 2026 10:31
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Jul 22, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 22, 2026 10:31
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Jul 22, 2026
Copilot AI reviewed Jul 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@rogerbarreto Roger Barreto (rogerbarreto) added the python Pull requests for the Python Semantic Kernel label Jul 22, 2026
@github-actions github-actions Bot changed the title Bump pyasn1 from 0.6.2 to 0.6.4 in /python Python: Bump pyasn1 from 0.6.2 to 0.6.4 in /python Jul 22, 2026
@rogerbarreto

Roger Barreto (rogerbarreto) commented Jul 22, 2026

Copy link
Copy Markdown
Member

Copilot this Dependabot pull request has failing CI checks. Please investigate the failures and fix what may be wrong. When applicable, this can include bumping other related dependencies to compatible versions and resolving breaking changes introduced by this update. Please push the fixes to this pull request branch so the checks can pass.

Copilot AI commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Copilot this Dependabot pull request has failing CI checks. Please investigate the failures and fix what may be wrong. When applicable, this can include bumping other related dependencies to compatib...

Investigated all CI failures on this PR:

  • Python Unit Tests (3.12, macos-latest) — Failed with a transient network error: the macOS runner couldn't connect to PyPI to fetch aiohttp (stream closed because of a broken pipe). All other Python unit test jobs were cancelled as a result (fast-fail). This is not related to the pyasn1 bump.
  • DevFlow PR Review — Failed due to a git authentication infrastructure issue (fatal: could not read Username for 'https://github.com': terminal prompts disabled). Also unrelated to code changes.
  • Merge Gatekeeper — Failed as a downstream consequence of the Python Unit Tests failure.

The actual change in uv.lock (updating pyasn1 from 0.6.2 to 0.6.4 with correct hashes and PyPI URLs) is valid. There is nothing wrong with the PR code itself — the failures are transient CI infrastructure issues. Pushed to re-trigger the checks.

@moonbox3 Evan Mattson (moonbox3) mentioned this pull request Jul 23, 2026
Merged
2 of 4 tasks
pull Bot pushed a commit to AmirulAndalib/semantic-kernel that referenced this pull request Jul 23, 2026
@moonbox3 @dependabot
Consolidate Dependabot dependency updates (microsoft#14176)
d003eb2 
### Motivation and Context

Semantic Kernel currently has 43 open Dependabot pull requests spanning
GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This
rollup applies their compatible net changes together on the latest
`main`, making it possible to validate and merge the updates as one
coherent dependency state.

Supersedes:

- microsoft#13133
- microsoft#13134
- microsoft#13136
- microsoft#13172
- microsoft#13507
- microsoft#13601
- microsoft#13606
- microsoft#13666
- microsoft#13673
- microsoft#13688
- microsoft#13700
- microsoft#13707
- microsoft#13708
- microsoft#13712
- microsoft#13721
- microsoft#13873
- microsoft#13930
- microsoft#13939
- microsoft#13949
- microsoft#13950
- microsoft#13951
- microsoft#13997
- microsoft#14000
- microsoft#14053
- microsoft#14069
- microsoft#14088
- microsoft#14091
- microsoft#14094
- microsoft#14103
- microsoft#14106
- microsoft#14107
- microsoft#14108
- microsoft#14109
- microsoft#14110
- microsoft#14128
- microsoft#14148
- microsoft#14149
- microsoft#14160
- microsoft#14161
- microsoft#14164
- microsoft#14171
- microsoft#14172
- microsoft#14173

### Description

- Updates the requested GitHub Actions and preserves the PR-file-scoped
typos workflow fix.
- Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript,
and SQLite security updates.
- Regenerates the npm, Yarn, and uv lockfiles from the combined
manifests instead of resolving generated-file conflicts by selection.
- Rolls overlapping updates forward to one compatible result: pyasn1
0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with
cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only
overrides obsolete.
- Retains updates already present on current `main` without
reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0
and Prompty.Core 2.0.0-beta.3.

The full .NET solution builds in Debug with zero warnings and errors.
Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests,
both frontend production builds, and uv lock consistency checks for the
main Python project and OAuth sample.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like pyasn1 is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 23, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python/pyasn1-0.6.4 branch July 23, 2026 08:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@rogerbarreto Roger Barreto (rogerbarreto) Awaiting requested review from rogerbarreto

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code python Pull requests for the Python Semantic Kernel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rogerbarreto