chore(deps): update python non-major dependencies

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
google-cloud-storage (source)	==3.12.0 → ==3.12.1
proto-plus	==1.28.0 → ==1.28.1
pyasn1 (changelog)	==0.6.3 → ==0.6.4

---

Release Notes

googleapis/google-cloud-python (google-cloud-storage)

v3.12.1: google-cloud-vision 3.12.1

Compare Source

Bug Fixes

• fix mypy errors (#​15494) (1f4c2862)

pyasn1/pyasn1 (pyasn1)

v0.6.4

Compare Source

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time
  complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders.
  A small crafted substrate encoding many arcs could consume
  excessive CPU. Arcs are now accumulated in linear time; decoded
  values are unchanged (thanks for reporting, tynus2)
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag
  IDs to 20 octets (140 bits), matching the OID arc limit introduced
  in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume
  excessive CPU and memory; longer tag IDs are now rejected with
  PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag
  (thanks for reporting, mikeappsec)
  IDs due to the integer-to-string conversion limit (Python 3.11+)
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and
  CPU consumption in Real.float() for values with large base-10
  exponents. Conversion no longer materializes huge intermediate
  integers; values too large to represent as a Python float raise
  OverflowError promptly, and prettyPrint() renders them as
  '' as before. Also fixed base-10 mantissa normalization
  to use exact integer arithmetic; mantissas larger than 2**53
  could previously lose precision through float division
  (thanks for reporting, gvozdila)
• Pinned PyPI publish GitHub Action to an immutable commit
  pr #​113

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.