[dependabot]

Bumps pyasn1 from 0.6.4 to 0.6.5.

Release notes

Sourced from pyasn1's releases.

Release 0.6.5

Revision 0.6.5, released 26-10-2026

• GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time instead of repeatedly shifting a growing integer and slicing the remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf, adriank31)
• GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments in linear time while preserving their decoded bit values, including intermediate fragment padding (thanks for reporting, manus-use)
• GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and character-string fragments and indefinite-length ANY content in linear time. Nested constructed OCTET STRING fragments now contribute their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
• GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use from colliding long tag IDs (thanks for reporting, droideck)

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.5, released 26-10-2026

• GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time instead of repeatedly shifting a growing integer and slicing the remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf, adriank31)
• GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments in linear time while preserving their decoded bit values, including intermediate fragment padding (thanks for reporting, manus-use)
• GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and character-string fragments and indefinite-length ANY content in linear time. Nested constructed OCTET STRING fragments now contribute their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
• GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use from colliding long tag IDs (thanks for reporting, droideck)

Commits

• 5d16736 Prepare release 0.6.5
• a36e3a3 Fix quadratic CPU use in schemaless container decoding
• 4ce0079 Remove quadratic constructed OCTET STRING and ANY reassembly
• 73ba7b0 Remove quadratic constructed BIT STRING reassembly
• ce3ec33 Remove quadratic binary REAL mantissa decoding
• See full diff in compare view

---

AI assistance

Grok Bot (AI agent) reviewed this Dependabot PR on behalf of the repository owner and added the sections below to the PR description only. The dependency change itself was authored by Dependabot, and the commits are unchanged.

What changed

• uv.lock: pyasn1 0.6.4 -> 0.6.5 (sdist and wheel entries). The lock revision field line also changes from 3 to 5 as written by the uv version Dependabot used.

How verified

• Reviewed the full diff. Only uv.lock changes: the pyasn1 version, its sdist and its wheel entries, and the uv lock revision line.
• The new pyasn1 0.6.5 sdist and wheel SHA-256 hashes in the diff match the hashes PyPI publishes for 0.6.5.
• CI on the PR head: test, Gitleaks, Documentation check and Commit message convention pass. Governance checks are re-evaluated after this description update.

Why

Security update. pyasn1 0.6.5 fixes decoder denial-of-service issues (GHSA-mm57-4v3p-rchx, GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p) by decoding BER structures in linear time. See the release notes above.

Risk

Low. Lock or requirements file only. No application code, workflows, secrets, permissions, or deployment configuration is touched.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6a1fab73-7cb1-4f9b-b611-005d72ada08c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn