chore(deps): bump gitpython from 3.1.46 to 3.1.50 by dependabot[bot] · Pull Request #198 · SocketDev/socket-python-cli

dependabot · 2026-05-09T03:24:41Z

Bumps gitpython from 3.1.46 to 3.1.50.

Release notes

3.1.50

What's Changed

Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.8 to 0.15.12 in the pre-commit group by @dependabot[bot] in gitpython-developers/GitPython#2140

Bump git/ext/gitdb from 335c0f6 to 53c94d6 by @dependabot[bot] in gitpython-developers/GitPython#2141

Fix Repo() autodiscovery in linked worktrees when GIT_DIR is set by @meliezer in gitpython-developers/GitPython#2128

Validate config key names before writing by @Byron in gitpython-developers/GitPython#2142

New Contributors

@meliezer made their first contribution in gitpython-developers/GitPython#2128

Full Changelog: gitpython-developers/GitPython@3.1.49...3.1.50

3.1.49 - Security

What's Changed

reject control chars in written values in configuration by @Byron in gitpython-developers/GitPython#2137

Improve pure Python rev-parse coverage and behavior by @Copilot in gitpython-developers/GitPython#2136

Full Changelog: gitpython-developers/GitPython@3.1.48...3.1.49

3.1.48 - Security

Accidentally deleted the previous GH release, it did mention the advisory this fixes.

What's Changed

prevent out-of-repo access when manipulating references. by @Byron in gitpython-developers/GitPython#2134

Full Changelog: gitpython-developers/GitPython@3.1.47...3.1.48

3.1.47 - with security fixes

Advisories

GHSA-rpm5-65cw-6hj4

GHSA-x2qx-6953-8485

What's Changed

Prepare next release by @Byron in gitpython-developers/GitPython#2095

Bump git/ext/gitdb from 335c0f6 to 4c63ee6 by @dependabot[bot] in gitpython-developers/GitPython#2096

DOC: README Add urls and updated a relative url by @Timour-Ilyas in gitpython-developers/GitPython#2098

Fix GitConfigParser ignoring multiple [include] path entries by @daniel7an in gitpython-developers/GitPython#2100

Switch back from Alpine to Debian for WSL by @EliahKagan in gitpython-developers/GitPython#2108

Bump git/ext/gitdb from 4c63ee6 to 5c1b303 by @dependabot[bot] in gitpython-developers/GitPython#2106

Run gc.collect() twice in test_rename on Python 3.12 by @EliahKagan in gitpython-developers/GitPython#2109

fix: guard AutoInterrupt terminate during interpreter shutdown by @lweyrich1 in gitpython-developers/GitPython#2105

Improve CI infrastructure for pre-commit by @EliahKagan in gitpython-developers/GitPython#2110

Bump the pre-commit group with 5 updates by @dependabot[bot] in gitpython-developers/GitPython#2111

Upgrade Sphinx for 3.14 support; drop doc build support on 3.8; test 3.14 by @EliahKagan in gitpython-developers/GitPython#2112

Fix Repo.active_branch resolution for reftable-backed repositories by @Copilot in gitpython-developers/GitPython#2114

docs: warn about GitDB performance with large commits by @mvanhorn in gitpython-developers/GitPython#2115

cmd: fix kwarg formatting in docstring example by @UweSchwaeke in gitpython-developers/GitPython#2117

... (truncated)

Commits

5a294a6 bump version to 3.1.50
d7b029f Merge pull request #2142 from gitpython-developers/fix-validate-config-key-ne...
5453842 Validate config key section names before writing
1085a7c Merge pull request #2128 from meliezer/fix-worktree-git-dir
b7f5fde Merge pull request #2141 from gitpython-developers/dependabot/submodules/git/...
4e8cd45 Bump git/ext/gitdb from 335c0f6 to 53c94d6
9e94459 Merge pull request #2140 from gitpython-developers/dependabot/pre_commit/pre-...
714e2e1 Xfail Windows symlink-capable index mutation test
b17f113 Bump https://github.com/astral-sh/ruff-pre-commit
aee2fd5 bump version to 3.1.49
Additional commits viewable in compare view

github-actions · 2026-05-09T03:25:36Z

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.92.dev3

Docker image: socketdev/cli:pr-198

socket-security · 2026-05-09T03:28:13Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/gitpython@3.1.46 ⏵ 3.1.50		⁺⁵⁰

View full report

socket-security-staging · 2026-05-09T03:34:44Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/gitpython@3.1.46 ⏵ 3.1.50		⁺⁵⁰

View full report

…sions Bundles the following Dependabot PRs into uv.lock (regenerated): - urllib3 2.6.3 -> 2.7.0 (closes #200) - gitpython 3.1.46 -> 3.1.50 (closes #198) - python-dotenv 1.2.1 -> 1.2.2 (closes #190) - pytest 9.0.2 -> 9.0.3 (closes #188) - uv 0.9.21 -> 0.11.6 (closes #184) - cryptography 46.0.5 -> 46.0.7 (closes #181) - pygments 2.19.2 -> 2.20.0 (closes #177) - requests 2.32.5 -> 2.33.0 (closes #175) All eight target versions were verified through Socket Firewall (sfw) on the full transitive dependency tree (15 packages including transitive deps fetched clean; no malware/typosquat/supply-chain alerts). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

dependabot · 2026-05-20T19:58:37Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

github-actions · 2026-05-21T18:57:44Z

❌ Version Check Failed

Please increment...

…sions Bundles the nine open Dependabot PRs against the main app into a single uv.lock regeneration: - urllib3 2.6.3 -> 2.7.0 (closes #200) - gitpython 3.1.46 -> 3.1.50 (closes #198) - python-dotenv 1.2.1 -> 1.2.2 (closes #190) - pytest 9.0.2 -> 9.0.3 (closes #188) - uv 0.9.21 -> 0.11.6 (closes #184) - cryptography 46.0.5 -> 46.0.7 (closes #181) - pygments 2.19.2 -> 2.20.0 (closes #177) - requests 2.32.5 -> 2.33.0 (closes #175) - idna 3.11 -> 3.15 (closes #205, CVE-2026-45409) idna 3.14 fixed CVE-2026-45409 -- a quadratic-time DoS vector via oversized inputs that bypassed the earlier CVE-2024-3651 mitigation. The other bumps are version-currentness hygiene. All nine target versions verified through Socket Firewall (sfw) on the full transitive dependency tree; no malware / typosquat / supply-chain alerts surfaced. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.46 to 3.1.50. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.46...3.1.50) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.50 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bundles the nine open Dependabot PRs against the main app into a single uv.lock regeneration. Where Dependabot's target trailed the latest published release, we went to the current latest and re-verified through sfw: - urllib3 2.6.3 -> 2.7.0 (closes #200) - gitpython 3.1.46 -> 3.1.50 (closes #198) - python-dotenv 1.2.1 -> 1.2.2 (closes #190) - pytest 9.0.2 -> 9.0.3 (closes #188) - uv 0.9.21 -> 0.11.17 (closes #210; Dependabot targeted 0.11.15) - cryptography 46.0.5 -> 46.0.7 (closes #181) - pygments 2.19.2 -> 2.20.0 (closes #177) - requests 2.32.5 -> 2.33.0 (closes #175) - idna 3.11 -> 3.15 (closes #205, CVE-2026-45409) idna 3.14 fixed CVE-2026-45409 -- a quadratic-time DoS via oversized inputs that bypassed the earlier CVE-2024-3651 mitigation. The rest are hygiene. All nine final versions verified clean through Socket Firewall (sfw) on the full transitive tree. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

dependabot · 2026-05-29T22:01:44Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 9, 2026

dependabot Bot requested a review from a team as a code owner May 9, 2026 03:24

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 9, 2026

dependabot Bot mentioned this pull request May 9, 2026

Bump gitpython from 3.1.46 to 3.1.49 #197

Closed

lelia mentioned this pull request May 18, 2026

Harden CLI exit behavior, CI/CD guardrails, bundled dep updates #203

Closed

10 tasks

dependabot Bot force-pushed the dependabot/uv/gitpython-3.1.50 branch from ca1a0ce to 218c394 Compare May 18, 2026 21:42

dependabot Bot force-pushed the dependabot/uv/gitpython-3.1.50 branch from 218c394 to 256e433 Compare May 21, 2026 18:57

lelia mentioned this pull request May 29, 2026

Bundle dependency updates, harden Dependabot reviews #207

Merged

5 tasks

dependabot Bot force-pushed the dependabot/uv/gitpython-3.1.50 branch from 256e433 to 8643ded Compare May 29, 2026 20:38

dependabot Bot changed the title ~~Bump gitpython from 3.1.46 to 3.1.50~~ chore(deps): bump gitpython from 3.1.46 to 3.1.50 May 29, 2026

dependabot Bot force-pushed the dependabot/uv/gitpython-3.1.50 branch from 8643ded to c1f0a82 Compare May 29, 2026 21:13

lelia closed this in 6969361 May 29, 2026

dependabot Bot deleted the dependabot/uv/gitpython-3.1.50 branch May 29, 2026 22:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump gitpython from 3.1.46 to 3.1.50#198

chore(deps): bump gitpython from 3.1.46 to 3.1.50#198
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/gitpython-3.1.50

dependabot Bot commented on behalf of github May 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 9, 2026 •

edited

Loading

Uh oh!

socket-security-staging Bot commented May 9, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 20, 2026

Uh oh!

github-actions Bot commented May 21, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.1.50

What's Changed

New Contributors

3.1.49 - Security

What's Changed

3.1.48 - Security

What's Changed

3.1.47 - with security fixes

Advisories

What's Changed

Uh oh!

github-actions Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security-staging Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github May 20, 2026

Uh oh!

github-actions Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 9, 2026 •

edited

Loading

github-actions Bot commented May 9, 2026 •

edited

Loading

socket-security Bot commented May 9, 2026 •

edited

Loading

socket-security-staging Bot commented May 9, 2026 •

edited

Loading

github-actions Bot commented May 21, 2026 •

edited

Loading