[witbrock]

What changed

• update httplib2 from 0.22.0 to 0.32.0
• update pyasn1 from 0.6.3 to 0.6.4

These are the first patched releases for the four open high-severity Dependabot denial-of-service advisories on main:

• GHSA-j5g9-f88f-gfj3 / CVE-2026-59939
• GHSA-m4p7-r5rc-7g4j / CVE-2026-59884
• GHSA-8ppf-4f7h-5ppj / CVE-2026-59885
• GHSA-hm4w-wwcw-mr6r / CVE-2026-59886

Why

The project directly pins and installs the vulnerable versions. One current-main patch closes the complete alert set without changing dependency policy or adding another package.

This supersedes #305, which covers only pyasn1 and is based on a 60-commit-old main. Its red secret-scan check was an organisation Gitleaks licence/configuration failure, not a detected secret.

Validation

• 61 Google/Gmail/OAuth compatibility tests passed
• httplib2 HTTP client plus pyasn1 DER encode/decode smoke passed
• installed versions verified as httplib2==0.32.0 and pyasn1==0.6.4
• pip check: no broken requirements
• PDM lock consistency check passed
• diff check passed

The repository intentionally ignores pdm.lock; the tracked change is limited to the two direct pins in pyproject.toml.

[Copilot]

Pull request overview

This pull request updates two directly pinned Python dependencies in pyproject.toml to patched versions in order to remediate the currently open high-severity Dependabot DoS advisories on main.

Changes:

• Bump httplib2 from 0.22.0 to 0.32.0.
• Bump pyasn1 from 0.6.3 to 0.6.4.