chore(deps): bump gitpython from 3.1.50 to 3.1.54 in the uv group across 1 directory - #19
chore(deps): bump gitpython from 3.1.50 to 3.1.54 in the uv group across 1 directory#19dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the uv group with 1 update in the / directory: [gitpython](https://github.com/gitpython-developers/GitPython). Updates `gitpython` from 3.1.50 to 3.1.54 - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.50...3.1.54) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.54 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
fairspec-python | 6c3fc8c | Jul 24 2026, 06:26 PM |
|
Claude finished @dependabot[bot]'s task in 1m 26s —— View job PR Review: Dependency Bump gitpython 3.1.50 → 3.1.54
SummaryThis PR bumps Security AnalysisThis bump resolves multiple security vulnerabilities:
OWASP Top 10 — Using Components with Known Vulnerabilities (A06:2021): The previous version (3.1.50) was affected by the above CVEs. Even as a dev dependency used in CI, the env-var exfiltration vulnerability is relevant: if a release script calls No issues found in other OWASP categories (SQL injection, XSS, SSRF, hardcoded secrets, etc.) — this is a lock file change only. Code Quality
RecommendationApprove and merge. This is a security-motivated upgrade with no application code risk. The compatibility score badge in the PR description indicates high compatibility. No concerns with this change. |
Bumps the uv group with 1 update in the / directory: gitpython.
Updates
gitpythonfrom 3.1.50 to 3.1.54Release notes
Sourced from gitpython's releases.
... (truncated)
Commits
e59d9baprepare next releasea4dc70dMerge pull request #2180 from gitpython-developers/single-char-kwarg1d51b89fix: guard diff output optionsffcb535fix: reject unsafe clone templatese8d0fbffix: validate split short-option valuesfaf3c09prepare for security fix6a5eb6aMerge pull request #2176 from gitpython-developers/fix-config-injection1ed1b92fix: validate config section delimiters354eb2fMerge pull request #2159 from Siesta0217/fix-core-hooks-path-commit-hooks9bc287aAddress review feedback about hook resolutionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.