From ecdd6e7e4ef793c8179f85ffb2c01b4da8814b3a Mon Sep 17 00:00:00 2001 From: deacon Date: Tue, 17 Mar 2026 19:53:07 -0400 Subject: [PATCH 1/2] fix: upgrade pyasn1 to >=0.6.3 to address CVE-2026-30922 pyasn1 0.5.1 is affected by CVE-2026-30922. Upgrading the version pin to >=0.6.3 which contains the fix. Detected by: pip-audit --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 42ee26a5c..ac8086a6f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,7 +15,7 @@ marshmallow==3.26.2 dirhash==0.2.1 marshmallow-enum==1.5.1 ldap3==2.9.1 -pyasn1~=0.5.1 +pyasn1>=0.6.3 reportlab==4.0.4 # debrief rich==13.7.0 lxml==6.0.2 # debrief From b532ba243db87b90f59160a1722d6a40051d8e64 Mon Sep 17 00:00:00 2001 From: Joshua Klosterman Date: Wed, 1 Apr 2026 18:01:35 -0400 Subject: [PATCH 2/2] Pin requirement to version 0.6.3 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index ac8086a6f..79bda22fd 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,7 +15,7 @@ marshmallow==3.26.2 dirhash==0.2.1 marshmallow-enum==1.5.1 ldap3==2.9.1 -pyasn1>=0.6.3 +pyasn1==0.6.3 reportlab==4.0.4 # debrief rich==13.7.0 lxml==6.0.2 # debrief