Skip to content

fix(security): upgrade pyasn1 to 0.6.4 to fix known vulnerabilities#2630

Merged
kevinmessiaen merged 1 commit into
mainfrom
fix/pyasn1-cve-upgrade
Jul 23, 2026
Merged

fix(security): upgrade pyasn1 to 0.6.4 to fix known vulnerabilities#2630
kevinmessiaen merged 1 commit into
mainfrom
fix/pyasn1-cve-upgrade

Conversation

@kevinmessiaen

Copy link
Copy Markdown
Member

Description

pip-audit flagged pyasn1 0.6.3 (a transitive dependency) for three known vulnerabilities: PYSEC-2026-3455, PYSEC-2026-3456, and PYSEC-2026-3457. Upgrades pyasn1 to 0.6.4 via the uv lockfile and regenerates THIRD_PARTY_NOTICES.md to match the new version.

Related Issue

N/A

Type of Change

  • 📚 Examples / docs / tutorials / dependencies update
  • 🔧 Bug fix (non-breaking change which fixes an issue)
  • 🥂 Improvement (non-breaking change which improves an existing feature)
  • 🚀 New feature (non-breaking change which adds functionality)
  • 💥 Breaking change (fix or feature that would cause existing functionality to change)
  • 🔐 Security fix

Checklist

  • I've read the CODE_OF_CONDUCT.md document.
  • I've read the CONTRIBUTING.md guide.
  • I've written tests for all new methods and classes that I created.
  • I've written the docstring in NumPy format for all the methods and classes that I created or modified.
  • I've updated the uv.lock running uv lock (only applicable when pyproject.toml has been
    modified)

Verification

  • uv run pip-audit --skip-editable reports no known vulnerabilities.
  • make check passes (lint, format, vermin, basedpyright, pip-audit, license check).
  • make test-unit: 755 passed, 4 skipped; the 2 pre-existing failures in test_settings.py reproduce identically on the unmodified base branch and are caused by local environment configuration, unrelated to this change.

pip-audit flagged pyasn1 0.6.3 for PYSEC-2026-3455, PYSEC-2026-3456, and
PYSEC-2026-3457. Upgrades the transitive dependency via the uv lockfile
and regenerates THIRD_PARTY_NOTICES.md to match.
@kevinmessiaen
kevinmessiaen merged commit 8aafe58 into main Jul 23, 2026
25 of 45 checks passed
@kevinmessiaen
kevinmessiaen deleted the fix/pyasn1-cve-upgrade branch July 23, 2026 07:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant