chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 in the pip group across 1 directory

[dependabot]

Bumps the pip group with 1 update in the / directory: pyasn1.

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
• Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)
• Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

• 72e4803 Prepare release 0.6.4
• 0c19eeb Pin PyPI publish action to immutable commit (#113)
• 45bdb19 Merge commit from fork
• 628e36e Merge commit from fork
• e60c691 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: df53922

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pyasn1@​0.6.3 ⏵ 0.6.4		+22

View full report

[ev-vaultkeeper]

Safe to merge. ✅

This is a security-only patch bump of pyasn1 (0.6.3 → 0.6.4), touching only poetry.lock. The pyproject.toml constraint pyasn1 = "^0.6.3" already permits it, and poetry check --lock passes.

How this repo uses pyasn1 (encode-only):

• evervault/crypto/curves/base.py builds a SubjectPublicKeyInfo from pyasn1.type.univ types (Sequence, OctetString, BitString, ObjectIdentifier, Integer).
• evervault/crypto/curves/{koblitz,p256}.py call pyasn1.codec.der.encoder.encode(...).
• Consumed by crypto/client.py::__generate_shared_key to derive the KDF input for SECP256R1 (always) and SECP256K1 (when a data role is set).

The SDK only encodes, uses standard short OIDs/tags, and never touches univ.Real or any decoder.

0.6.4 changelog (only version between current and target):

• CVE-2026-59885 — OID/RELATIVE-OID decoder quadratic-time fix ("decoded values are unchanged").
• CVE-2026-59884 — limits BER long-form tag IDs on decode + repr() fix.
• CVE-2026-59886 — univ.Real.__float__() memory/CPU fix.
• Pinned PyPI publish GH Action (CI hygiene).

All fixes are in the decode path / Real type; none affect the encode API used here, and there are no signature/API removals.

Verification: Ran the test suite in a venv against both 0.6.4 and 0.6.3. tests/test_key_encoder.py (which asserts the exact base64 DER of a P256 SPKI) passes on 0.6.4 with byte-identical output. Both versions produce identical results (88 passed / 10 failed); the 10 failures are pre-existing, network-blocked attestation-doc tests unrelated to this change.

No code changes needed.