fix: resolve backport merge conflicts in pyproject.toml and uv.lock

Mergify committed unresolved conflict markers when cherry-picking the
pyasn1 bump. Keep the release branch dependency pins and apply only the
intended pyasn1>=0.6.4 change, then re-sync uv.lock.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FwHCHkuggaiyjB1fGhaBd
Signed-off-by: Charlie Doern <cdoern@redhat.com>

Author: cdoern

pyproject.toml

@@ -8,38 +8,8 @@ fallback_version = "0.7.2"
 [tool.uv]
 required-version = ">=0.7.0"
 constraint-dependencies = [
-<<<<<<< HEAD
-    "pyasn1>=0.6.3",  # CVE-2026-30922: DoS via unbounded recursion
+    "pyasn1>=0.6.4",  # CVE-2026-30922: DoS via unbounded recursion
     "starlette>=1.0.1",                # CVE-2026-48710
-=======
-    "aiohttp>=3.14.0",                # CVE-2026-34993: CookieJar.load() RCE
-    "authlib>=1.6.11",                 # CVE-2026-41425 + 7 more: account takeover, JWE padding oracle, sig bypass
-    "cryptography>=48.0.1",            # CVE-2026-39892: buffer overflow; CVE-2026-34073: DNS constraint bypass
-    "fonttools>=4.60.2",
-    "gitpython>=3.1.47",               # Command injection via Git options bypass
-    "h11>=0.16.0",
-    "idna>=3.15",
-    "joserfc>=1.6.8",
-    "langgraph-checkpoint>=4.1.1",
-    "langgraph-sdk>=0.3.15",
-    "langsmith>=0.8.18",
-    "lxml>=6.1.0",                     # CVE-2026-41066: XML entity expansion with default resolve_entities=True
-    "msgpack>=1.2.1",
-    "pillow>=12.3.0",                  # CVE-2026-42311: PSD RCE; CVE-2026-55379/55380/54060: font/GD DoS
-    "protobuf>=5.29.6",               # CVE-2025-4565 + CVE-2026-0994: parsing vulnerabilities
-    "pyasn1>=0.6.4",                   # CVE-2026-30922: DoS via unbounded recursion
-    "pydantic-settings>=2.14.2",
-    "python-engineio>=4.13.2",
-    "python-multipart>=0.0.31",        # CVE-2026-40347: header injection; CVE-2026-42561: DoS via oversized headers
-    "python-socketio>=5.16.2",         # CVE-2025-61765: RCE via pickle deserialization
-    "requests>=2.34.2",
-    "setuptools<81",                   # milvus-lite imports pkg_resources; setuptools 81+ removes it
-    "starlette>=1.3.1",                # CVE-2026-48710
-    "tornado>=6.5.6",
-    "urllib3>=2.7.0",                  # CVE-2026-44432: DoS via excessive decompression; CVE-2026-44431: cross-origin redirect header leak
-    "transformers>=4.57.2,<5.0.0",     # CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports
-    "werkzeug>=3.1.6",                 # CVE-2025-66221 + 2 more: safe_join() device name bypass
->>>>>>> d6e92423 (fix: bump pyasn1 for CVE-2026-59885 (#6330))
 ]
 
 [project]