fix(deps): bump pyasn1 to 0.6.4 for VULN-88810

[shuningc]

Summary

• Remediate VULN-88810: ASN.1 decoder DoS via unbounded recursion on nested indefinite-length SEQUENCE/SET (fixed in 0.6.3).
• poetry.lock: pyasn1 0.6.1 → 0.6.4 (transitive; no pyproject change).
• Example pin: pyasn1==0.6.3.

Test plan

• poetry check
• Installed pyasn1 0.6.4; poetry run pytest tests/ (1988 passed, 10 skipped)

Jira

VULN-88810

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, well-scoped vulnerability fix. One minor version drift noted below.

---

P3 — Example pin (0.6.3) lags lockfile version (0.6.4) (Claude Code)

File/Section: examples/rag/elastic-chatbot-rag-app/requirements.txt:351
Issue: The example requirements file pins pyasn1==0.6.3 (the minimum version fixing VULN-88810) while poetry.lock resolves to 0.6.4. Both include the CVE fix (introduced in 0.6.3), so this is not a security concern — purely a consistency nit.
Evidence: Diff shows pyasn1==0.6.3 in requirements.txt vs version = "0.6.4" in poetry.lock.
Recommended fix: Optional — bump example pin to pyasn1==0.6.4 to align with the lockfile and avoid drift.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Flagged version drift between example pin and lockfile