rayhan 75836cfc10 fix: remediate CVE's by bumping pyasn1 constraint to >=0.6.4 (#17495) ...

## Summary
  
Remediates three HIGH severity CVEs in `pyasn1` by bumping the existing
`constraint-dependencies` entry from `>=0.6.3` to `>=0.6.4` in
`pyproject.toml`.
  
  | CVE | Severity | Package | Installed | Fixed in |
  |---|---|---|---|---|
  | CVE-2026-59884 | HIGH | pyasn1 | 0.6.3 | 0.6.4 |
  | CVE-2026-59885 | HIGH | pyasn1 | 0.6.3 | 0.6.4 |
  | CVE-2026-59886 | HIGH | pyasn1 | 0.6.3 | 0.6.4 |


`pyasn1` is a transitive dependency (pulled in via `google-auth` / `rsa`
/ `pyasn1-modules`). A previous constraint (`>=0.6.3`) was added for
CVE-2026-30922 but two additional vulnerabilities were disclosed that
require 0.6.4.

2026-07-28 23:25:00 +08:00

12 KiB

Raw Blame History

View Raw