chore(deps): bump pyasn1 from 0.6.1 to 0.6.2
What the developer wrote
Authored by dependabot[bot]
chore(deps): bump pyasn1 from 0.6.1 to 0.6.2
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](https://github.com/pyasn1/pyasn1/compare/v0.6.1...v0.6.2)
---
updated-dependencies:
- dependency-name: pyasn1
dependency-version: 0.6.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated dependency update by Dependabot that bumps the Python library pyasn1 from version 0.6.1 to 0.6.2 in the project's lock file. There is no indication in the commit itself that this fixes a security issue, and no verified security references were provided. On its own, a patch-version bump of a pure-Python ASN.1 parsing library is normally treated as a maintenance change.
Review the upstream pyasn1 0.6.2 release notes and changelog for any security fixes. If the newer version addresses a vulnerability that affects Trezor's usage of pyasn1 (e.g., in certificate or firmware-signature parsing workflows), consider expediting the update and monitoring for related CVEs. Otherwise, treat as routine maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit only changes the pinned pyasn1 version in uv.lock, updating the sdist and wheel URLs/hashes from 0.6.1 to 0.6.2. No source code, build scripts, or cryptographic logic in the Trezor firmware repository is modified. The commit message is a standard Dependabot chore(deps) bump with no security context. Without external release notes or advisory data, the security relevance of pyasn1 0.6.2 cannot be determined from this commit alone.
Changed components
uv.lock dependency pin for pyasn1Inspect captured patch +3 / −3
diff --git a/uv.lock b/uv.lock
index 1f55a08d..a7e98e50 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1308,11 +1308,11 @@ wheels = [
[[package]]
name = "pyasn1"
-version = "0.6.1"
+version = "0.6.2"
source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ba/e9/01f1a64245b89f039897cb0130016d79f77d52669aae6ee7b159a6c4c018/pyasn1-0.6.1.tar.gz", hash = "sha256:6f580d2bdd84365380830acf45550f2511469f673cb4a5ae3857a3170128b034", size = 145322, upload-time = "2024-09-10T22:41:42.55Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fe/b6/6e630dff89739fcd427e3f72b3d905ce0acb85a45d4ec3e2678718a3487f/pyasn1-0.6.2.tar.gz", hash = "sha256:9b59a2b25ba7e4f8197db7686c09fb33e658b98339fadb826e9512629017833b", size = 146586, upload-time = "2026-01-16T18:04:18.534Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/c8/f1/d6a797abb14f6283c0ddff96bbdd46937f64122b8c925cab503dd37f8214/pyasn1-0.6.1-py3-none-any.whl", hash = "sha256:0d632f46f2ba09143da3a8afe9e33fb6f92fa2320ab7e886e2d0f7672af84629", size = 83135, upload-time = "2024-09-11T16:00:36.122Z" },
+ { url = "https://files.pythonhosted.org/packages/44/b5/a96872e5184f354da9c84ae119971a0a4c221fe9b27a4d94bd43f2596727/pyasn1-0.6.2-py3-none-any.whl", hash = "sha256:1eb26d860996a18e9b6ed05e7aae0e9fc21619fcee6af91cca9bad4fbea224bf", size = 83371, upload-time = "2026-01-16T18:04:17.174Z" },
]
[[package]]
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.