fix: bump pyasn1 for CVE-2026-59885 (#6330)

bump to >=0.6.4 for CVE-2026-59885 as outlined in GHSA-8ppf-4f7h-5ppj

Signed-off-by: Charlie Doern <cdoern@redhat.com>
(cherry picked from commit d6e9242)

# Conflicts:
#	pyproject.toml
#	uv.lock

Author: cdoern

pyproject.toml

@@ -19,12 +19,25 @@ constraint-dependencies = [
     "lxml>=6.1.0",                     # CVE-2026-41066: XML entity expansion with default resolve_entities=True
     "pillow>=12.2.0",                  # CVE-2026-40192 + 4 more: heap overflow, OOB write, DoS
     "protobuf>=5.29.6",               # CVE-2025-4565 + CVE-2026-0994: parsing vulnerabilities
+<<<<<<< HEAD
     "pyasn1>=0.6.3",                   # CVE-2026-30922: DoS via unbounded recursion
     "python-multipart>=0.0.27",        # CVE-2026-40347: header injection; CVE-2026-42561: DoS via oversized headers
     "python-socketio>=5.14.0",         # CVE-2025-61765: RCE via pickle deserialization
     "starlette>=0.49.1",
     "tornado>=6.5.5",
     "urllib3>=2.6.3",
+=======
+    "pyasn1>=0.6.4",                   # CVE-2026-30922: DoS via unbounded recursion
+    "pydantic-settings>=2.14.2",
+    "python-engineio>=4.13.2",
+    "python-multipart>=0.0.31",        # CVE-2026-40347: header injection; CVE-2026-42561: DoS via oversized headers
+    "python-socketio>=5.16.2",         # CVE-2025-61765: RCE via pickle deserialization
+    "requests>=2.34.2",
+    "setuptools<81",                   # milvus-lite imports pkg_resources; setuptools 81+ removes it
+    "starlette>=1.3.1",                # CVE-2026-48710
+    "tornado>=6.5.6",
+    "urllib3>=2.7.0",                  # CVE-2026-44432: DoS via excessive decompression; CVE-2026-44431: cross-origin redirect header leak
+>>>>>>> d6e92423 (fix: bump pyasn1 for CVE-2026-59885 (#6330))
     "transformers>=4.57.2,<5.0.0",     # CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports
     "werkzeug>=3.1.6",                 # CVE-2025-66221 + 2 more: safe_join() device name bypass
 ]