This is a security release.

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
• Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

It's a minor release.

• Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).
• Fixed OverflowError from oversized BER length field.
• Fixed DeprecationWarning stacklevel for deprecated attributes.
• Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

It's a minor release.

• Fixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490).
• Added support for Python 3.14.
• Added SECURITY.md policy.
• Migrated to pyproject.toml packaging.

All changes are noted in the CHANGELOG.

It's a minor release.

• Added support for Python 3.13.
• Cleaned Python 2-related code.
• Removed bdist_wheel universal flag from setup.cfg.

All changes are noted in the CHANGELOG.

It's a major release where we drop Python 2 support entirely.
The most significant changes are:

• Removed support for EOL Python 2.7, 3.6, 3.7
• Added support for previously missing RELATIVE-OID construct
• Updated link to Layman's Guide

All changes are noted in the CHANGELOG.

It's a minor release.

• Added support for PyPy 3.10 and Python 3.12
• Updated RTD configuration to include a dummy index.rst redirecting to contents.html, ensuring compatibility with third-party documentation and search indexes.
• Fixed the API breakage wih decoder.decode(substrateFun=...).
  A substrateFun passed to decoder.decode() can now be either v0.4 Non-Streaming or v0.5 Streaming.
  pyasn1 will detect and handle both cases transparently.
  A substrateFun passed to one of the new streaming decoders is still expected to be v0.5 Streaming only.

All changes are noted in the CHANGELOG.

It's a major release. The most important changes are:

• PyPI package ownership for pyasn1 and pyasn1-module has been transferred to Christian Heimes and Simon Pichugin in PyPI support ticket #2090.
• The upstream repositories for pyasn1 and pyasn1-modules are now in the GitHub organization https://github.com/pyasn1/.
• Modernized packaging and testing. pyasn1 now uses setup.cfg, pyproject.toml, build, and GitHub Actions.
• Make BER/CER/DER decoders streaming and suspendible
• Added support for Python 3.8, 3.9, 3.10, 3.11
• Removed support for EOL Pythons 2.4, 2.5, 2.6, 3.2, 3.3, 3.4, 3.5
• Added support for PyPy 3.7, 3.8, 3.9

All changes are noted in the CHANGELOG.