chore(deps): bump gitpython from 3.1.50 to 3.1.58 in /requirements

[dependabot]

Bumps gitpython from 3.1.50 to 3.1.58.

Release notes

Sourced from gitpython's releases.

3.1.58 - Security and Fixes

What's Changed

• test: allow Python startup before timeout by @​Byron in gitpython-developers/GitPython#2195
• Resolve Windows hook Bash through PATH by @​Byron in gitpython-developers/GitPython#2199
• Revert "Resolve Windows hook Bash through PATH" by @​Byron in gitpython-developers/GitPython#2200
• test: focus pytest summary on unexpected failures by @​raisulchowdhury in gitpython-developers/GitPython#2203
• Validate submodule names before filesystem operations by @​Byron in gitpython-developers/GitPython#2202
• Handle invalid submodule names during recursive updates by @​Byron in gitpython-developers/GitPython#2205
• Fix Windows path handling on Python 3.13+ by @​Byron in gitpython-developers/GitPython#2196
• fixup 2202 by @​Byron in gitpython-developers/GitPython#2206
• Correct Windows hook Bash precedence by @​Byron in gitpython-developers/GitPython#2201
• Harden config and Git option validation by @​Byron in gitpython-developers/GitPython#2204
• Skip tests that need symlink privileges instead of erroring by @​Cyrus580529 in gitpython-developers/GitPython#2197

New Contributors

• @​raisulchowdhury made their first contribution in gitpython-developers/GitPython#2203
• @​Cyrus580529 made their first contribution in gitpython-developers/GitPython#2197

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @​Byron in gitpython-developers/GitPython#2179
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in gitpython-developers/GitPython#2185
• build(deps): bump the pre-commit group with 2 updates by @​dependabot[bot] in gitpython-developers/GitPython#2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @​dependabot[bot] in gitpython-developers/GitPython#2124
• Render protected Traversable methods in the reference by @​pick7 in gitpython-developers/GitPython#2192
• Use standard prefixes for parsed patch diffs by @​pick7 in gitpython-developers/GitPython#2191
• Honor kill_after_timeout with output streams by @​pick7 in gitpython-developers/GitPython#2189
• Redact Authorization extra headers from command errors by @​pick7 in gitpython-developers/GitPython#2188
• Improve RemoteProgress parse return typing by @​pick7 in gitpython-developers/GitPython#2187
• Adopt basedpyright with a legacy baseline by @​Byron in gitpython-developers/GitPython#2194
• Block unsafe Git file and URL options by @​Byron in gitpython-developers/GitPython#2193

New Contributors

• @​pick7 made their first contribution in gitpython-developers/GitPython#2192

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

• Add support for Python 3.15 by @​hugovk in gitpython-developers/GitPython#2183
• fix: reject unsafe output options in Commit.count by @​Byron in gitpython-developers/GitPython#2184

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

• fix: prevent environment expansion in remote URLs by @​Byron in gitpython-developers/GitPython#2181

... (truncated)

Commits

• 30be45d prepare changelog for upcoming release
• fc2f02c Merge pull request #2197 from Cyrus580529/shared-symlink-guard
• b10e250 test: use the shared guard instead of local copies
• e3e5da8 test: skip tests that need symlink privileges
• 30d05e3 test: add a shared symlink capability guard
• 9a8f6fe Merge pull request #2204 from gitpython-developers/security-fixes
• f2550b6 Guard pathspec file inputs in high-level commands
• d9ddb55 Guard unsafe git init options
• 9b5dcaf Guard read-tree index output paths
• 96a888f Check joined short-option values before Git execution
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

requirements/docs.txt

Name	Version	Vulnerability	Severity
gitpython	3.1.57	GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite	high
		GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks	high
		GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython	high
		GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)	high
		GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution	high

Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Package	Version	Score	Details
pip/gitpython	3.1.57	🟢 7.2	Details Check Score Reason Code-Review ⚠️ 1 Found 2/11 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• requirements/docs.txt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (86ad7d5) to head (611e75b).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #671   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines           65        65           
  Branches         1         1           
=========================================
  Hits            65        65           

Flag	Coverage Δ
py310-django42	100.00% <ø> (ø)
py310-django52	100.00% <ø> (ø)
py311-django42	100.00% <ø> (ø)
py311-django52	100.00% <ø> (ø)
py312-django42	100.00% <ø> (ø)
py312-django52	100.00% <ø> (ø)
py313-django52	100.00% <ø> (ø)
py314-django52	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dlrsp-actions]

Policy gate blocked this PR: default-fail: matched catch-all policy