Skip to content

Bump gitpython from 3.1.46 to 3.1.47 - #211

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/gitpython-3.1.47
Open

Bump gitpython from 3.1.46 to 3.1.47#211
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/gitpython-3.1.47

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps gitpython from 3.1.46 to 3.1.47.

Release notes

Sourced from gitpython's releases.

3.1.47 - with security fixes

Advisories

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.46...3.1.47

Commits
  • 4199cb8 bump version to 3.1.47
  • 0f68db0 Merge pull request #2131 from WesR/main
  • 43d92de git.cmd: harden unsafe option canonicalization and isolate push test cases
  • 9aed7cf linter fix
  • 1421958 Block unsafe underscored git kwargs / Fix for GHSA-rpm5-65cw-6hj4
  • da54523 Merge pull request #2130 from gitpython-developers/fix-multi-options
  • c9a2678 Make sure that multi-options are checked after splitting them with shlex
  • 75e6c6b Merge pull request #2126 from ngie-eign/fix-execute-with_stdout-no-issues
  • 6fc4742 test_avoids_changing...: don't leave test artifacts behind
  • d966a0d git.cmd.Git.execute(..): fix with_stdout=False
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump gitpython from 3.1.46 to 3.1.47
f21b536 
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.46 to 3.1.47.
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.46...3.1.47)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.47
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Apr 26, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner April 26, 2026 01:28
@github-actions

github-actions Bot commented Apr 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ❌ 1 vulnerable package(s)
See the Details below.

Vulnerabilities

uv.lock

NameVersionVulnerabilitySeverity
gitpython3.1.47GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCEcritical
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)high
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command executionhigh
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)high
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPythonhigh
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hookshigh
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwritehigh
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destinationhigh
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file readhigh
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)high
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command executionhigh
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hookshigh
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)high
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)high
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URLhigh
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`high
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklisthigh
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPathhigh
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPathhigh
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repositoryhigh
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)moderate
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()moderate
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()moderate
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.countmoderate
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()moderate

OpenSSF Scorecard

PackageVersionScoreDetails
pip/gitpython 3.1.47 🟢 7.5
Details
CheckScoreReason
Code-Review🟢 4Found 4/10 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • uv.lock

@shehzadashiq

shehzadashiq commented Aug 3, 2026

Copy link
Copy Markdown

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot does not support your uv version. Because of this, Dependabot cannot update this pull request.

@shehzadashiq

shehzadashiq commented Sep 18, 2026

Copy link
Copy Markdown

@dependabot rebase

@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

1 similar comment
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

@dependabot @github

dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot does not support your uv version. Because of this, Dependabot cannot update this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shehzadashiq