[Lucas1479]

What and why

The Python dependency audit blocks #275 because main locks pyasn1 0.6.4, which is affected by CVE-2026-119194, CVE-2026-119195, CVE-2026-119196 and CVE-2026-119197 (failed audit).

Update only the pyasn1 package entry in uv.lock to upstream's patched 0.6.5 release. It remains a transitive dependency of google-genai -> google-auth -> pyasn1-modules; 0.6.5 satisfies the existing >=0.6.1,<0.7.0 constraint. Both artifact hashes match the upstream release assets. No new top-level dependency, audit exception, or CI change is introduced.

This separate prerequisite keeps #275 focused on its parser fix. Linked Issue for product-semantic or public-contract changes: none (routine dependency maintenance).

Change class

• Routine fix, documentation, test, maintenance, or presentation-only UI

Owning layer: the canonical Python dependency lock.

User-visible effect: restore the dependency audit prerequisite for normal CI and merge validation.

Compatibility or migration impact: none expected; sync the updated lockfile through the existing installation procedure.

Evidence

Fresh core/dev environment on Windows, CPython 3.12.10, uv 0.12.8:

• uv lock --upgrade-package pyasn1==0.6.5 and uv sync --locked --extra dev: passed.

• Exact CI command, uv run --locked --no-sync python -m pip_audit --local --progress-spinner off --ignore-vuln PYSEC-2026-1845: passed, no known vulnerabilities and 2 existing ignores.

• uv lock --check --offline and uv run --locked --no-sync python tools/verify_python_environment.py --profile ci: passed.

• uv run --locked --no-sync python -X utf8 -m pytest tests/test_gemini_client.py tests/test_unified_diff_canvas.py tests/test_work_export_integration.py -q: 29 passed.

• Offline synthetic compatibility checks: PKCS#8 DER decode/re-encode with the real pyasn1-modules schema, plus Google Auth RSA signing, valid-signature verification and tampered-message rejection: passed. The Google Auth check exercises its installed cryptography backend; it does not claim coverage of the optional rsa backend.

• uv run --locked --no-sync python -m ruff check . and git diff --check: passed.

• Structural TOML comparison against base 65cea5fff216fda92ce29a9d6fd91a405b10ed27: the only changed package entry is pyasn1 0.6.4 -> 0.6.5; all other lock metadata and package entries are identical.

• Relevant Python tests pass

• CPU/model-less baseline remains supported

• Dependency audit passes

All 18 hosted checks across 8 workflows passed on head aeab62eaf4f2bc158f9338f65e7bb598c60a5a99, including the original audit, source/packaged desktop smoke, and catalog publication/recovery. No retries were needed. An isolated composition of the exact #275 parser/test blobs with the repaired dependency also passed 30 targeted tests. No live provider calls were made. No Electron code, UI, settings or public contracts changed.

Final check

• One coherent problem without unrelated cleanup
• No speculative API, fallback, or compatibility path
• No secrets, local state, model weights, voice material, or restricted assets
• Third-party notices and provenance preserved

---

中文：此 PR 仅将 uv.lock 中的传递依赖 pyasn1 从 0.6.4 更新到修复上述四个漏洞的 0.6.5，解除 #275 的 CI 审计阻塞。未修改审计规则或其他依赖。全新 Windows 开发环境中的原样 CI 审计、29 个相关测试、锁文件／环境一致性、离线 ASN.1 与 Google Auth 兼容性检查及 Ruff 均通过；提交 aeab62ea 的 8 个工作流、18 项托管检查现已全部通过，无重试；原先被审计挡住的源码／打包应用 smoke 和目录发布／恢复验证也已通过。与 #275 已审查代码组合后的 30 个针对性测试同样通过。