AAP-83418: Bump pyasn1 to 0.6.4 (CVE-2026-59886)

[omaciel]

Jira Issue: https://issues.redhat.com/browse/AAP-83418

Description

Bumps pyasn1 to the latest release 0.6.4 to fix CVE-2026-59886 (Red Hat: Important, CVSS 7.5).

pyasn1 < 0.6.4 decodes a BER/CER/DER-encoded REAL value's mantissa/base/exponent to a Python float using exact big-integer exponentiation. A short encoded value can carry a very large exponent, so prettyPrint(), str(), comparison, arithmetic, int(), or float() on the decoded value consumes excessive CPU/memory — a denial of service.

pyasn1 is a direct, pinned dependency of this project. Only the dependency version changed — no source changes.

Package	Old	New	CVE
pyasn1	0.6.3	0.6.4	CVE-2026-59886

Testing

Steps to test

1. Pull down the PR
2. uv lock --check — passes
3. pip-audit -r requirements.txt — no CVE-2026-59886

Type of Change

• Security fix

Backport Policy

This change should be:

• Backported to specific releases — this is the mainline (upstream) fix; it mirrors to downstream main via repo-sync. Equivalent downstream release-branch PRs: stable-2.7 (Red Hat Konflux update aap-rag-embeddings-image #57) and stable-2.6 ([EMBEDDINGS] Control embeddings image build #58).

Scenarios tested

• uv lock --check passes; uv.lock, requirements.txt, and pyproject.toml all pin pyasn1==0.6.4
• Diff is limited to the pyasn1 entry — no other package moved

Production deployment

• This code change is ready for production on its own

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.46%. Comparing base (64b22c2) to head (8532796).

@@           Coverage Diff           @@
##             main     #370   +/-   ##
=======================================
  Coverage   79.46%   79.46%           
=======================================
  Files          11       11           
  Lines         896      896           
=======================================
  Hits          712      712           
  Misses        184      184           

Flag	Coverage Δ
python	79.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[SiddharthRajaraman]

lgtm!

[omaciel]

/retest