[aravhawk]

Lockfile-only security bump of the transitive dependency pyasn1 0.6.4 → 0.6.5. No pyproject.toml change, no other package moved.

Advisories (all HIGH, DoS, CVSS 7.5, fixed in 0.6.5)

• GHSA-2qm8-x737-gmw5 / CVE-2026-119196: quadratic CPU in constructed BIT STRING decoding
• GHSA-9m75-vc3g-4x39 / CVE-2026-119195: quadratic DoS in constructed string and indefinite-length ANY decoding
• GHSA-fm9c-5rcf-2q5p / CVE-2026-119194: quadratic CPU in schemaless BER/CER/DER container decoding
• GHSA-mm57-4v3p-rchx / CVE-2026-119197: quadratic DoS in binary REAL decoding

Dependency paths

• libp2p → aioquic → service-identity 24.2.0 → pyasn1
• service-identity 24.2.0 → pyasn1-modules 0.4.2 → pyasn1

Scope

• Command: uv lock --upgrade-package pyasn1 (nothing else)
• git diff --stat: uv.lock | 6 +++--- (1 file)
• Only change in the exported requirements: pyasn1==0.6.4 → pyasn1==0.6.5. uv lock --check passes.

Audit

Command: uv export --frozen --format requirements-txt --no-emit-project --no-hashes | uvx pip-audit -r /dev/stdin --strict (--no-emit-project added because --strict can't version the editable -e . line; same results with and without --all-extras).

Before (main af20223): 16 findings in 3 packages

• pyasn1 0.6.4: the 4 GHSAs above
• Already present and not in scope: libp2p 0.6.0 GHSA-hmj8-5xmh-5573 (no fix version); zeroconf 0.147.4 GHSA-9pgc-3ccv-5297, GHSA-phvx-9mgw-67r5, GHSA-rfg2-pjw2-56x2, GHSA-9663-mqmp-p9mm, GHSA-qc2x-6f54-m6h9 (blocked by libp2p 0.6.0 requiring zeroconf<0.148.0)

After: 12 findings in 2 packages. The same libp2p and zeroconf findings remain. There are zero pyasn1 advisories and no new findings.

Tests

uv run --locked --extra dev pytest tests: 357 passed.

The commit is SSH-signed by aravhawk@gmail.com.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c36789f7-2de2-4b6c-8fd8-40021ee1f730

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T13:22:54.095111Z	0d784ca	PR opened
🔒 Security Review	✅ Completed 2026-10-31T13:24:01.197036Z	0d784ca	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.