Repository navigation
fix(deps): lock pyasn1 0.6.5 for its four advisories - #37
Merged
Merged
Conversation
pyasn1 0.6.4, which avitai-artifex brings in, has CVE-2026-119194, CVE-2026-119195, CVE-2026-119196 and CVE-2026-119197 (GHSA-fm9c-5rcf-2q5p, GHSA-9m75-vc3g-4x39, GHSA-2qm8-x737-gmw5, GHSA-mm57-4v3p-rchx), all high and all fixed in 0.6.5; the dependency audit fails on them. The lock moves pyasn1 alone, and an audit of every extra in the lock finds no advisory after it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Four high advisories against pyasn1 0.6.4 were published at 23:03-23:07 UTC on 2026-10-30, all fixed in 0.6.5: CVE-2026-119194 to -119197 (GHSA-fm9c-5rcf-2q5p, GHSA-9m75-vc3g-4x39, GHSA-2qm8-x737-gmw5, GHSA-mm57-4v3p-rchx). pyasn1 comes in through avitai-artifex. The lock moves pyasn1 alone.
Evidence
audit_lock.pyat the pinned e889be4 on main's lock exits 1 with the four advisories, as artifex's Security run 41145139063 did on its own lock.uv lock --checkpasses; the same audit over every extra (all, benchmark, chem, cuda-dev, cuda12, dev, docs, genomics, metal, soft-ops-advanced, soft-ops-ot, test, torch-io) exits 0. Every pre-commit hook passes.Merge Danger
Door: two-way
Blast Radius: lockfile
0.6.5 is a patch release of pyasn1; nothing else in the lock moves.
The lock's format revision also moves from 3 to 5: uv 0.13.1, the stack's pinned uv, writes revision 5 when it relocks. Under the uv this repository's CI installs,
uv lock --checkon the new lock: uv 0.12.21 exits 0;