Skip to content

deps(python): Bump pyasn1 from 0.6.4 to 0.6.5 - #12485

Merged
MarkusNeusinger merged 1 commit into
mainfrom
dependabot/uv/pyasn1-0.6.5
Nov 2, 2026
Merged

deps(python): Bump pyasn1 from 0.6.4 to 0.6.5#12485
MarkusNeusinger merged 1 commit into
mainfrom
dependabot/uv/pyasn1-0.6.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pyasn1 from 0.6.4 to 0.6.5.

Release notes

Sourced from pyasn1's releases.

Release 0.6.5

Revision 0.6.5, released 26-10-2026

  • GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time instead of repeatedly shifting a growing integer and slicing the remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf, adriank31)
  • GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments in linear time while preserving their decoded bit values, including intermediate fragment padding (thanks for reporting, manus-use)
  • GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and character-string fragments and indefinite-length ANY content in linear time. Nested constructed OCTET STRING fragments now contribute their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
  • GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use from colliding long tag IDs (thanks for reporting, droideck)
Changelog

Sourced from pyasn1's changelog.

Revision 0.6.5, released 26-10-2026

  • GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time instead of repeatedly shifting a growing integer and slicing the remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf, adriank31)
  • GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments in linear time while preserving their decoded bit values, including intermediate fragment padding (thanks for reporting, manus-use)
  • GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and character-string fragments and indefinite-length ANY content in linear time. Nested constructed OCTET STRING fragments now contribute their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
  • GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use from colliding long tag IDs (thanks for reporting, droideck)
Commits
  • 5d16736 Prepare release 0.6.5
  • a36e3a3 Fix quadratic CPU use in schemaless container decoding
  • 4ce0079 Remove quadratic constructed OCTET STRING and ANY reassembly
  • 73ba7b0 Remove quadratic constructed BIT STRING reassembly
  • ce3ec33 Remove quadratic binary REAL mantissa decoding
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python labels Oct 31, 2026
@MarkusNeusinger

MarkusNeusinger commented Nov 2, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
deps(python): Bump pyasn1 from 0.6.4 to 0.6.5
782b71b 
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.4 to 0.6.5.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.4...v0.6.5)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/pyasn1-0.6.5 branch from b448afd to 782b71b Compare November 2, 2026 00:35
@MarkusNeusinger
MarkusNeusinger merged commit c7c79da into main Nov 2, 2026
14 checks passed
@MarkusNeusinger
MarkusNeusinger deleted the dependabot/uv/pyasn1-0.6.5 branch November 2, 2026 00:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MarkusNeusinger