🔒️ [+security] Upgraded dependencies based on uv audit

[davidbrownell]

uv audit reported security vulnerabilities in the following packages; uv.lock has been
updated to upgrade them.

Package    From    To      Advisories
---------  ------  ------  -------------------------------------------------
gitpython  3.1.59  3.1.62  PYSEC-2026-3982, PYSEC-2026-3983, PYSEC-2026-3984

Advisories

• PYSEC-2026-3982 (gitpython 3.1.59, fixed in 3.1.60): GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository. details
• PYSEC-2026-3983 (gitpython 3.1.59, fixed in 3.1.60): GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses. details
• PYSEC-2026-3984 (gitpython 3.1.59, fixed in 3.1.60): GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access. details