From 76f3b9ff1265678e1a26e3dd2ef5ab26a8fc96e3 Mon Sep 17 00:00:00 2001 From: ViditOstwal Date: Thu, 3 Sep 2026 21:07:28 +0530 Subject: [PATCH] fix(deps): raise gitpython floor to 3.1.60 Keep consumers off 3.1.59 so they pick up the follow-on security hardening; lock stays on 3.1.61. --- lib/crewai-tools/pyproject.toml | 5 +++-- pyproject.toml | 9 +++++---- uv.lock | 4 ++-- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/crewai-tools/pyproject.toml b/lib/crewai-tools/pyproject.toml index 1e19829f2..6d88b1f79 100644 --- a/lib/crewai-tools/pyproject.toml +++ b/lib/crewai-tools/pyproject.toml @@ -109,8 +109,9 @@ stagehand = [ github = [ # <3.1.59 has PYSEC-2026-3785/GHSA-7833-fr7j-v32q, # PYSEC-2026-3786/GHSA-284h-m62q-gf8w, PYSEC-2026-3787/GHSA-8mcc-hrx5-hvxc, - # and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287; force 3.1.59+. - "gitpython>=3.1.59,<4", + # and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287. 3.1.60 hardens config escapes, + # diff/actor parsing, and filesystem diffs; force 3.1.60+. + "gitpython>=3.1.60,<4", "PyGithub==1.59.1", ] rag = [ diff --git a/pyproject.toml b/pyproject.toml index 50410cabc..229f36713 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -207,9 +207,10 @@ exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings = # gitpython <3.1.59 has PYSEC-2026-3785/GHSA-7833-fr7j-v32q (.gitmodules [include] file disclosure), # PYSEC-2026-3786/GHSA-284h-m62q-gf8w (multi-line git-config re-serialization RCE), # PYSEC-2026-3787/GHSA-8mcc-hrx5-hvxc (clone --separate-git-dir omitted from unsafe options), -# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287 (Repo.blame --contents/-S arbitrary file read); -# force 3.1.59+. 3.1.59 is older than the global 3-day cutoff, so no -# exclude-newer-package override is needed. +# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287 (Repo.blame --contents/-S arbitrary file read). +# gitpython 3.1.60 hardens config escape semantics, diff/actor parsing, and +# filesystem diffs; force 3.1.60+. 3.1.60 is older than the global 3-day cutoff, +# so no exclude-newer-package override is needed. # pyasn1 <0.6.4 has GHSA-8ppf-4f7h-5ppj and GHSA-hm4w-wwcw-mr6r; force 0.6.4+. # urllib3 <2.7.0 has GHSA-qccp-gfcp-xxvc (ProxyManager cross-origin redirect leaks Authorization/Cookie) and GHSA-mf9v-mfxr-j63j (streaming decompression-bomb bypass); force 2.7.0+. # langsmith <0.8.18 has GHSA-3644-q5cj-c5c7 (public prompt manifest deserialization, SSRF/secret disclosure) @@ -262,7 +263,7 @@ override-dependencies = [ "pypdf>=6.16.1,<7", "uv>=0.11.15,<1", "python-multipart>=0.0.27,<1", - "gitpython>=3.1.59,<4", + "gitpython>=3.1.60,<4", "pyasn1>=0.6.4", "langsmith>=0.8.18,<1", "authlib>=1.6.12", diff --git a/uv.lock b/uv.lock index d37d8439e..33ff54a07 100644 --- a/uv.lock +++ b/uv.lock @@ -35,7 +35,7 @@ overrides = [ { name = "authlib", specifier = ">=1.6.12" }, { name = "cryptography", specifier = ">=50.0.0" }, { name = "docling-core", extras = ["chunking"], specifier = ">=2.74.1" }, - { name = "gitpython", specifier = ">=3.1.59,<4" }, + { name = "gitpython", specifier = ">=3.1.60,<4" }, { name = "h2", specifier = ">=4.4.1" }, { name = "langchain-core", specifier = ">=1.3.3,<2" }, { name = "langchain-text-splitters", specifier = ">=1.1.2,<2" }, @@ -1761,7 +1761,7 @@ requires-dist = [ { name = "e2b-code-interpreter", marker = "extra == 'e2b'", specifier = "~=2.6.0" }, { name = "exa-py", marker = "extra == 'exa-py'", specifier = ">=1.8.7" }, { name = "firecrawl-py", marker = "extra == 'firecrawl-py'", specifier = ">=1.8.0" }, - { name = "gitpython", marker = "extra == 'github'", specifier = ">=3.1.59,<4" }, + { name = "gitpython", marker = "extra == 'github'", specifier = ">=3.1.60,<4" }, { name = "hyperbrowser", marker = "extra == 'hyperbrowser'", specifier = ">=0.18.0" }, { name = "langchain-apify", marker = "extra == 'apify'", specifier = ">=0.1.2,<1.0.0" }, { name = "linkup-sdk", marker = "extra == 'linkup-sdk'", specifier = ">=0.2.2" },