chore: bump pyasn1 to 0.6.4 (CVE-2026-59884/59885/59886)#2793
Conversation
pyasn1 0.6.3 is affected by three DoS advisories published this week (BER/CER/DER decoder resource exhaustion), all fixed in 0.6.4. Closes the Aikido finding on this repo (AIKIDO-2026-27979 bundle). The exceptiongroup marker hunk is uv 0.10.4 normalizing the entry on re-lock; no resolution change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
| source = { registry = "https://pypi.org/simple" } | ||
| dependencies = [ | ||
| { name = "typing-extensions" }, | ||
| { name = "typing-extensions", marker = "python_full_version < '3.11'" }, |
There was a problem hiding this comment.
So package only gets updated on python 3.11 and higher?
Just to verify; which version do we use in runner?
There was a problem hiding this comment.
No behavior change here — this hunk is a uv-version side effect, not something we added. exceptiongroup is only in the lock as pytest's backport dependency for Python <3.11 (3.11+ has ExceptionGroup in the stdlib, so it's never installed there). Upstream declares typing-extensions; python_version < "3.13", and the newer uv the upgrade ran with normalizes that edge to the intersection (< 3.11) instead of leaving it unconditional like the previous lock. Resolution is identical, and it's a test-only dep anyway.
Re the runner: it doesn't install from this uv.lock at all — this file only drives soda-core dev/CI. The launcher images compile their own requirements and already pin pyasn1 0.6.4 on main; this PR just brings soda-core's own lockfile in line so the Aikido repo finding closes.
2 participants
What
uv lock --upgrade-package pyasn1: 0.6.3 → 0.6.4.Why
pyasn1 0.6.3 is affected by three DoS advisories published this week — CVE-2026-59884 (unbounded long-form tag IDs), CVE-2026-59885 (quadratic OID processing), CVE-2026-59886 (REAL value resource consumption) — all fixed in 0.6.4. Closes the Aikido finding on this repo (AIKIDO-2026-27979 bundle, flagged "needs human review" in the 2026-07-13 repo vulnerability assessment because the advisories were unpublished at the time).
Wanted on main before the
release_20260715_1core bump so it rides 4.17.1 (tracking issue sodadata/tools-release-buddy#93). Both launchers already lock 0.6.4 on their mains.The
exceptiongroupmarker hunk is uv 0.10.4 normalizing the entry on re-lock; no resolution change.🤖 Generated with Claude Code