From c7c8835e72bebcfb9f17f3ed656f98f25b96e137 Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Sat, 31 Oct 2026 14:56:04 +0530 Subject: [PATCH 1/2] fix(deps): raise pyasn1 security floor to clear CI audit findings Upgrade only pyasn1 to 0.6.5 in the hash-locked development environment and retain the floor in dev.in. Other pins, extras and markers are unchanged. Prepared with OpenAI Codex. Signed-off-by: Srinivasa Dinakar Jainti --- CHANGELOG.md | 3 +++ requirements/dev.in | 3 +++ requirements/dev.txt | 10 ++++++---- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index caaf5e60..af0cb8d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +- Raise the development/CI `pyasn1` security floor to 0.6.5 and regenerate its + hashes, clearing four dependency-audit findings for 0.6.4. + - Sealing to a low-order X25519 peer key raises `SealedChannelError`, consistent with other invalid channel keys, instead of leaking a backend `ValueError`. These keys were already refused; no ciphertext format or acceptance rule changes. diff --git a/requirements/dev.in b/requirements/dev.in index ad636eff..36a848d0 100644 --- a/requirements/dev.in +++ b/requirements/dev.in @@ -25,3 +25,6 @@ a2a-sdk[http-server]==1.2.2 uvicorn==0.54.0 aiohttp>=3.14.3 setuptools>=83.0.0 + +# Security floor for google-auth's transitive ASN.1 dependency (four audit findings). +pyasn1>=0.6.5 diff --git a/requirements/dev.txt b/requirements/dev.txt index a57d254f..981e67dc 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -1710,10 +1710,12 @@ py-serializable==2.1.0 \ --hash=sha256:9d5db56154a867a9b897c0163b33a793c804c80cee984116d02d49e4578fc103 \ --hash=sha256:b56d5d686b5a03ba4f4db5e769dc32336e142fc3bd4d68a8c25579ebb0a67304 # via cyclonedx-python-lib -pyasn1==0.6.4 \ - --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ - --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b - # via pyasn1-modules +pyasn1==0.6.5 \ + --hash=sha256:4017b0fce125096b8573b39c989fdb1a4b19cf761e683398184550fea0e66587 \ + --hash=sha256:6b11616a6bcf3a40e635f082bb232fa57b5e0dd7f517bd7ddd69ec3794508a47 + # via + # -r requirements/dev.in + # pyasn1-modules pyasn1-modules==0.4.2 \ --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \ --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6 From 729db756111b5c4563b08c8b3b3f188422a166fb Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Sun, 1 Nov 2026 08:47:00 +0530 Subject: [PATCH 2/2] fix(deps): enforce pyasn1 floor in supported SDK extras Raise the pyasn1 floor for both optional SDK and development installs while keeping existing lock bytes unchanged. Built-wheel resolver controls reject 0.6.4 and accept 0.6.5 for each extra. Prepared with OpenAI Codex. Signed-off-by: Srinivasa Dinakar Jainti --- CHANGELOG.md | 5 +++-- pyproject.toml | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index af0cb8d1..e706403d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,8 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed -- Raise the development/CI `pyasn1` security floor to 0.6.5 and regenerate its - hashes, clearing four dependency-audit findings for 0.6.4. +- Raise the A2A SDK and development extras' `pyasn1` security floor to 0.6.5, + alongside the development/CI hash lock, clearing four dependency-audit + findings for 0.6.4. - Sealing to a low-order X25519 peer key raises `SealedChannelError`, consistent with other invalid channel keys, instead of leaking a backend `ValueError`. diff --git a/pyproject.toml b/pyproject.toml index 4cf4691a..f6515ffe 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -49,6 +49,7 @@ tpm = [ a2a-sdk = [ "a2a-sdk>=1.1,<2", "aiohttp>=3.14.3", + "pyasn1>=0.6.5", ] dev = [ "pytest>=8.0", @@ -66,6 +67,7 @@ dev = [ "a2a-sdk[http-server]==1.2.2", "uvicorn==0.54.0", "aiohttp>=3.14.3", + "pyasn1>=0.6.5", ] [project.scripts]