chore(deps): bump the uv group across 15 directories with 8 updates

[dependabot]

Bumps the uv group with 1 update in the /cookbook/tool-use-tool-search-with-embeddings directory: setuptools.
Bumps the uv group with 2 updates in the /dspy/dspy-intro directory: json-repair and litellm.
Bumps the uv group with 3 updates in the /dspy/tutorials/customer_service_agent directory: setuptools, json-repair and jupyterlab.
Bumps the uv group with 3 updates in the /dspy/tutorials/gepa_aime directory: setuptools, json-repair and jupyterlab.
Bumps the uv group with 2 updates in the /langchain/content-builder directory: idna and pyasn1.
Bumps the uv group with 1 update in the /langchain/data_analysis directory: pyasn1.
Bumps the uv group with 2 updates in the /langchain/deep-research-agent directory: idna and pyasn1.
Bumps the uv group with 1 update in the /langchain/graph-sql-agent directory: setuptools.
Bumps the uv group with 1 update in the /langchain/internet-search directory: pyasn1.
Bumps the uv group with 2 updates in the /langchain/knowledge-base directory: setuptools and pypdf.
Bumps the uv group with 2 updates in the /langchain/langsmith-tutorial directory: idna and pyasn1.
Bumps the uv group with 1 update in the /langchain/sql-agent directory: setuptools.
Bumps the uv group with 1 update in the /langchain/test-mcp directory: pyasn1.
Bumps the uv group with 1 update in the /llamaindex/starter directory: setuptools.
Bumps the uv group with 3 updates in the /neo4j/genai-fundamentals directory: idna, pypdf and pip.

Updates setuptools from 81.0.0 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates json-repair from 0.49.0 to 0.60.1

Release notes

Sourced from json-repair's releases.

Release 0.60.1

Added

• A potential infinite loop in schema resolution could cause an application using the library to crash if the schema was self referential

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.60.0

Added

• Support for repairing string values that contain low smart quote spans like „... when the closing quote is emitted as ASCII " instead of Unicode ”. Issue #198

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.10

Fixed

• Fixed a parser-path repair bug where balanced brace groups inside string values, such as LaTeX fragments like \frac{x^2}{m}, could be mistaken for object structure when a later inline JSON-like snippet appeared in the same string.
• Improved preservation of malformed-but-string-intended explanations containing inline literals such as {"blank_1": "5"} without splitting the surrounding object.

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.9

Fixed

-Fix #196, a regression introduced to fix #170 caused issue with top-level object duplication.

... (truncated)

Commits

• 63992e9 Fix circular schema ref handling
• 7cd8391 Fix #198 support low smart quote spans in strings
• 46be950 update ANGENTS guidance
• 0015c74 Fix README example for #197
• d7f2a3b Fix #195 keep balanced braces in strings
• 4206302 Fix top-level comma-separated object repair
• 9c9db65 Fix #195 preserve LaTeX escapes after prose commas
• dbec25a Bump version to 0.59.7
• 397fbe0 Fix #195 preserve escaped brace groups
• b8cd2e2 Fix #194 line comments with brackets
• Additional commits viewable in compare view

Updates litellm from 1.75.8 to 1.84.0

Release notes

Sourced from litellm's releases.

v1.84.0

⚠️ Heads up — this release contains breaking changes. Read the full release notes here: v1.84.0 release notes

---

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.84.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.84.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.84.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• merge main by @​Sameerlite in BerriAI/litellm#25521
• merge litellm_internal_staging by @​Sameerlite in BerriAI/litellm#25949
• merge main by @​Sameerlite in BerriAI/litellm#26304
• merge main by @​Sameerlite in BerriAI/litellm#26379
• merge main by @​Sameerlite in BerriAI/litellm#26437
• fix(redis): cache GCP IAM token to prevent async event loop blocking by @​harish-berri in BerriAI/litellm#26441
• litellm oss branch by @​krrish-berri-2 in BerriAI/litellm#26386
• fix noma v2 deepcopy crashing in build scan payload - new PR by @​omriShukrun08 in BerriAI/litellm#26605
• fix(ui): use stored-credentials endpoint for tools fetch on MCP edit page by @​ryan-crabbe-berri in BerriAI/litellm#26002
• feat(proxy): add --timeout_worker_healthcheck flag for uvicorn worker triage by @​ryan-crabbe-berri in BerriAI/litellm#26622

... (truncated)

Commits

• See full diff in compare view

Updates setuptools from 82.0.1 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates json-repair from 0.59.10 to 0.60.1

Release notes

Sourced from json-repair's releases.

Release 0.60.1

Added

• A potential infinite loop in schema resolution could cause an application using the library to crash if the schema was self referential

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.60.0

Added

• Support for repairing string values that contain low smart quote spans like „... when the closing quote is emitted as ASCII " instead of Unicode ”. Issue #198

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.10

Fixed

• Fixed a parser-path repair bug where balanced brace groups inside string values, such as LaTeX fragments like \frac{x^2}{m}, could be mistaken for object structure when a later inline JSON-like snippet appeared in the same string.
• Improved preservation of malformed-but-string-intended explanations containing inline literals such as {"blank_1": "5"} without splitting the surrounding object.

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.9

Fixed

-Fix #196, a regression introduced to fix #170 caused issue with top-level object duplication.

... (truncated)

Commits

• 63992e9 Fix circular schema ref handling
• 7cd8391 Fix #198 support low smart quote spans in strings
• 46be950 update ANGENTS guidance
• 0015c74 Fix README example for #197
• d7f2a3b Fix #195 keep balanced braces in strings
• 4206302 Fix top-level comma-separated object repair
• 9c9db65 Fix #195 preserve LaTeX escapes after prose commas
• dbec25a Bump version to 0.59.7
• 397fbe0 Fix #195 preserve escaped brace groups
• b8cd2e2 Fix #194 line comments with brackets
• Additional commits viewable in compare view

Updates jupyterlab from 4.5.7 to 4.5.10

Release notes

Sourced from jupyterlab's releases.

v4.5.10

4.5.10

(Full Changelog)

Security patches

• GHSA-gx64-gj6p-pc4c
• GHSA-89vp-jrxv-24w8
• GHSA-h5v5-8746-g7mm
• GHSA-pppj-hq3g-57pj
• GHSA-whvh-wf3x-g77j

Bugs fixed

• Backport of security patches to 4.5.x branch #19186 (@​krassowski, @​MUFFANUJ)

Maintenance and upkeep improvements

• Reconfigure 4.5.x branch (4.6.x is new stable) #19060 (@​krassowski)
• Split external link checks and only run if diff includes a URL #19029 (@​MUFFANUJ)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​krassowski (activity) | @​MUFFANUJ (activity)

v4.5.9

4.5.9

(Full Changelog)

Bugs fixed

• Fix jupyter labextension build crash on webpack ≥ 5.107 #19021 (@​Darshan808, @​krassowski)
• Backport PR #18992: Fix hidden cells after moving collapsed headings #19016 (@​MUFFANUJ, @​krassowski)
• Forbid relative URLs in extensionmanager #19013 (@​Yann-P)
• Fix XSS in extension manager's homepage_url #19003 (@​Yann-P)
• Fix toolbar popup row clipping in Safari #18998 (@​arun-357)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.

... (truncated)

Commits

• af5f5b3 [ci skip] Publish 4.5.10
• be9303f Backport of security patches to 4.5.x branch (#19186)
• a555fe1 Reconfigure 4.5.x branch (4.6.x is new stable) (#19060)
• 8d8cb6d Backport PR #19029 on branch 4.5.x (Split external link checks and only run i...
• dd65403 [ci skip] Publish 4.5.9
• 2693672 Backport PR #18992: Fix hidden cells after moving collapsed headings (#19016)
• 360c176 Backport PR #18998 on branch 4.5.x (Fix toolbar popup row clipping in Safari)...
• e9db010 Fix jupyter labextension build crash on webpack ≥ 5.107 (#19021)
• 3b8428c Backport PR #19013 on branch 4.5.x (Forbid relative URLs in extensionmanager)...
• 3c84a84 Backport PR #19003 on branch 4.5.x (Fix XSS in extension manager's `homepage_...
• Additional commits viewable in compare view

Updates setuptools from 82.0.1 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates json-repair from 0.59.10 to 0.60.1

Release notes

Sourced from json-repair's releases.

Release 0.60.1

Added

• A potential infinite loop in schema resolution could cause an application using the library to crash if the schema was self referential

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.60.0

Added

• Support for repairing string values that contain low smart quote spans like „... when the closing quote is emitted as ASCII " instead of Unicode ”. Issue #198

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.10

Fixed

• Fixed a parser-path repair bug where balanced brace groups inside string values, such as LaTeX fragments like \frac{x^2}{m}, could be mistaken for object structure when a later inline JSON-like snippet appeared in the same string.
• Improved preservation of malformed-but-string-intended explanations containing inline literals such as {"blank_1": "5"} without splitting the surrounding object.

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.9

Fixed

-Fix #196, a regression introduced to fix #170 caused issue with top-level object duplication.

... (truncated)

Commits

• 63992e9 Fix circular schema ref handling
• 7cd8391 Fix #198 support low smart quote spans in strings
• 46be950 update ANGENTS guidance
• 0015c74 Fix README example for #197
• d7f2a3b Fix #195 keep balanced braces in strings
• 4206302 Fix top-level comma-separated object repair
• 9c9db65 Fix #195 preserve LaTeX escapes after prose commas
• dbec25a Bump version to 0.59.7
• 397fbe0 Fix #195 preserve escaped brace groups
• b8cd2e2 Fix #194 line comments with brackets
• Additional commits viewable in compare view

Updates jupyterlab from 4.5.7 to 4.5.10

Release notes

Sourced from jupyterlab's releases.

v4.5.10

4.5.10

(Full Changelog)

Security patches

• GHSA-gx64-gj6p-pc4c
• GHSA-89vp-jrxv-24w8
• GHSA-h5v5-8746-g7mm
• GHSA-pppj-hq3g-57pj
• GHSA-whvh-wf3x-g77j

Bugs fixed

• Backport of security patches to 4.5.x branch #19186 (@​krassowski, @​MUFFANUJ)

Maintenance and upkeep improvements

• Reconfigure 4.5.x branch (4.6.x is new stable) #19060 (@​krassowski)
• Split external link checks and only run if diff includes a URL #19029 (@​MUFFANUJ)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​krassowski (activity) | @​MUFFANUJ (activity)

v4.5.9

4.5.9

(Full Changelog)

Bugs fixed

• Fix jupyter labextension build crash on webpack ≥ 5.107 #19021 (@​Darshan808, @​krassowski)
• Backport PR #18992: Fix hidden cells after moving collapsed headings #19016 (@​MUFFANUJ, @​krassowski)
• Forbid relative URLs in extensionmanager #19013 (@​Yann-P)
• Fix XSS in extension manager's homepage_url #19003 (@​Yann-P)
• Fix toolbar popup row clipping in Safari #18998 (@​arun-357)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.

... (truncated)

Commits

• af5f5b3 [ci skip] Publish 4.5.10
• be9303f Backport of security patches to 4.5.x branch (#19186)
• a555fe1 Reconfigure 4.5.x branch (4.6.x is new stable) (#19060)
• 8d8cb6d Backport PR #19029 on branch 4.5.x (Split external link checks and only run i...
• dd65403 [ci skip] Publish 4.5.9
• 2693672 Backport PR #18992: Fix hidden cells after moving collapsed headings (#19016)
• 360c176 Backport PR #18998 on branch 4.5.x (Fix toolbar popup row clipping in Safari)...
• e9db010 Fix jupyter labextension build crash on webpack ≥ 5.107 (#19021)
• 3b8428c Backport PR #19013 on branch 4.5.x (Forbid relative URLs in extensionmanager)...
• 3c84a84 Backport PR #19003 on branch 4.5.x (Fix XSS in extension manager's `homepage_...
• Additional commits viewable in compare view

Updates idna from 3.11 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

• Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
• Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
• Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
• Allow flit_core 4.x in the build backend.
• Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
• Add Dependabot configuration for GitHub Actions.
• Convert README and HISTORY from reStructuredText to Markdown.
• Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

• Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

• Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

• Update to Unicode 17.0.0.
• Issue a deprecation warning for the transitional argument.
• Added lazy-loading to provide some performance improvements.
• Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

Commits

• af30a09 Release 3.15
• 30314d4 Pre-release 3.15rc0
• 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
• 2987fdb Convert README and HISTORY from reStructuredText to Markdown
• 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
• def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
• bbd8004 Merge pull request #234 from StanFromIreland/patch-1
• edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
• 5557db0 Merge branch 'master' into patch-1
• f11746c Merge pull request #235 from StanFromIreland/patch-2
• Additional commits viewable in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
• Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)
• Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

• 72e4803 Prepare release 0.6.4
• 0c19eeb Pin PyPI publish action to immutable commit (#113)
• 45bdb19 Merge commit from fork
• 628e36e Merge commit from fork
• e60c691 Merge commit from fork
• See full diff in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
• Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)
• Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

• 72e4803 Prepare release 0.6.4
• 0c19eeb Pin PyPI publish action to immutable commit (#113)
• 45bdb19 Merge commit from fork
• 628e36e Merge commit from fork
• e60c691 Merge commit from fork
• See full diff in compare view

Updates idna from 3.11 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

• Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
• Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
• Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
• Allow flit_core 4.x in the build backend.
• Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
• Add Dependabot configuration for GitHub Actions.
• Convert README and HISTORY from reStructuredText to Markdown.
• Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

• Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

• Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

• Update to Unicode 17.0.0.
• Issue a deprecation warning for the transitional argument.
• Added lazy-loading to provide some performance improvements.
• Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

Commits

• af30a09 Release 3.15
• 30314d4 Pre-release 3.15rc0
• 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown