Skip to content

Bump pyasn1 from 0.6.2 to 0.6.3 in /python#13673

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/pyasn1-0.6.3
Closed

Bump pyasn1 from 0.6.2 to 0.6.3 in /python#13673
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/pyasn1-0.6.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 17, 2026

Copy link
Copy Markdown
Contributor

Bumps pyasn1 from 0.6.2 to 0.6.3.

Release notes

Sourced from pyasn1's releases.

Release 0.6.3

It's a minor release.

  • Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).
  • Fixed OverflowError from oversized BER length field.
  • Fixed DeprecationWarning stacklevel for deprecated attributes.
  • Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.3, released 16-03-2026

Commits
  • af65c3b Prepare release 0.6.3
  • 5a49bd1 Merge commit from fork
  • 5494ba4 Fix asDateTime incorrect fractional seconds parsing (#102)
  • 71f486e Fix DeprecationWarning stacklevel for deprecated attributes (#101)
  • d7cb42d Fix OverflowError from oversized BER length field (#100)
  • See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Mar 17, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner March 17, 2026 19:22
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Mar 17, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python/pyasn1-0.6.3 branch from 4a6f3e4 to 4d746d2 Compare March 19, 2026 11:29
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.2 to 0.6.3.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.2...v0.6.3)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python/pyasn1-0.6.3 branch from 4d746d2 to 1b20750 Compare April 8, 2026 00:50
pull Bot pushed a commit to AmirulAndalib/semantic-kernel that referenced this pull request Jul 23, 2026
### Motivation and Context

Semantic Kernel currently has 43 open Dependabot pull requests spanning
GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This
rollup applies their compatible net changes together on the latest
`main`, making it possible to validate and merge the updates as one
coherent dependency state.

Supersedes:

- microsoft#13133
- microsoft#13134
- microsoft#13136
- microsoft#13172
- microsoft#13507
- microsoft#13601
- microsoft#13606
- microsoft#13666
- microsoft#13673
- microsoft#13688
- microsoft#13700
- microsoft#13707
- microsoft#13708
- microsoft#13712
- microsoft#13721
- microsoft#13873
- microsoft#13930
- microsoft#13939
- microsoft#13949
- microsoft#13950
- microsoft#13951
- microsoft#13997
- microsoft#14000
- microsoft#14053
- microsoft#14069
- microsoft#14088
- microsoft#14091
- microsoft#14094
- microsoft#14103
- microsoft#14106
- microsoft#14107
- microsoft#14108
- microsoft#14109
- microsoft#14110
- microsoft#14128
- microsoft#14148
- microsoft#14149
- microsoft#14160
- microsoft#14161
- microsoft#14164
- microsoft#14171
- microsoft#14172
- microsoft#14173

### Description

- Updates the requested GitHub Actions and preserves the PR-file-scoped
typos workflow fix.
- Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript,
and SQLite security updates.
- Regenerates the npm, Yarn, and uv lockfiles from the combined
manifests instead of resolving generated-file conflicts by selection.
- Rolls overlapping updates forward to one compatible result: pyasn1
0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with
cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only
overrides obsolete.
- Retains updates already present on current `main` without
reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0
and Prompty.Core 2.0.0-beta.3.

The full .NET solution builds in Debug with zero warnings and errors.
Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests,
both frontend production builds, and uv lock consistency checks for the
main Python project and OAuth sample.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
@moonbox3

Copy link
Copy Markdown
Collaborator

Superseded by #14176

@moonbox3 moonbox3 closed this Jul 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/uv/python/pyasn1-0.6.3 branch July 23, 2026 09:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant