chore(deps): bump gitpython from 3.1.50 to 3.1.57 in /requirements

[dependabot]

Bumps gitpython from 3.1.50 to 3.1.57.

Release notes

Sourced from gitpython's releases.

3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @​Byron in gitpython-developers/GitPython#2179
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in gitpython-developers/GitPython#2185
• build(deps): bump the pre-commit group with 2 updates by @​dependabot[bot] in gitpython-developers/GitPython#2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @​dependabot[bot] in gitpython-developers/GitPython#2124
• Render protected Traversable methods in the reference by @​pick7 in gitpython-developers/GitPython#2192
• Use standard prefixes for parsed patch diffs by @​pick7 in gitpython-developers/GitPython#2191
• Honor kill_after_timeout with output streams by @​pick7 in gitpython-developers/GitPython#2189
• Redact Authorization extra headers from command errors by @​pick7 in gitpython-developers/GitPython#2188
• Improve RemoteProgress parse return typing by @​pick7 in gitpython-developers/GitPython#2187
• Adopt basedpyright with a legacy baseline by @​Byron in gitpython-developers/GitPython#2194
• Block unsafe Git file and URL options by @​Byron in gitpython-developers/GitPython#2193

New Contributors

• @​pick7 made their first contribution in gitpython-developers/GitPython#2192

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

• Add support for Python 3.15 by @​hugovk in gitpython-developers/GitPython#2183
• fix: reject unsafe output options in Commit.count by @​Byron in gitpython-developers/GitPython#2184

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

• fix: prevent environment expansion in remote URLs by @​Byron in gitpython-developers/GitPython#2181

Full Changelog: gitpython-developers/GitPython@3.1.54...3.1.55

3.1.54 - Security

What's Changed

• Harden unsafe Git option validation by @​Byron in gitpython-developers/GitPython#2180

Full Changelog: gitpython-developers/GitPython@3.1.53...3.1.54

3.1.53 - Security

What's Changed

• feat(submodule): add deinit method to Submodule (#2014) by @​mvanhorn in gitpython-developers/GitPython#2129
• typing: introduce sensible basedpyright defaults by @​Byron in gitpython-developers/GitPython#2174
• fix: make submodule.update() after submodule.deinit() work by @​Byron in gitpython-developers/GitPython#2175
• Fix commit hooks respecting core.hooksPath by @​Siesta0217 in gitpython-developers/GitPython#2159
• fix: validate config section delimiters by @​Byron in gitpython-developers/GitPython#2176

New Contributors

... (truncated)

Commits

• ccbd573 prepare for new release
• d1a631d Merge pull request #2193 from gitpython-developers/more-unsafe-options
• ab33e33 Merge pull request #2194 from gitpython-developers/fix-basedpyright
• 52199b3 address review comments
• 60dec71 Adopt basedpyright with a legacy baseline
• 7a4f5dc Block unsafe archive additions and bundle URI
• 3af0c25 Block unsafe checkout-index and tag file options
• fb5d584 Merge pull request #2187 from pick7/codex/remote-progress-return-type
• 951cc44 Merge pull request #2188 from pick7/codex/redact-http-extraheader
• 2e5b13f Merge pull request #2189 from pick7/codex/output-stream-timeout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

requirements/docs.txt

Name	Version	Vulnerability	Severity
gitpython	3.1.57	GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite	high
		GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks	high
		GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython	high
		GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)	high
		GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution	high

Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Package	Version	Score	Details
pip/gitpython	3.1.57	🟢 7.3	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 2 Found 4/14 approved changesets -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• requirements/docs.txt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (937da5d) to head (79a6a35).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #671   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines           65        65           
  Branches         1         1           
=========================================
  Hits            65        65           

Flag	Coverage Δ
py310-django42	100.00% <ø> (ø)
py310-django52	100.00% <ø> (ø)
py311-django42	100.00% <ø> (ø)
py311-django52	100.00% <ø> (?)
py312-django42	100.00% <ø> (ø)
py312-django52	100.00% <ø> (?)
py313-django52	100.00% <ø> (?)
py314-django52	100.00% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.