From fc1cc1dd78cf8237dddbd9479a85f1f08a8489da Mon Sep 17 00:00:00 2001
From: Rip&Tear <84775494+theCyberTech@users.noreply.github.com>
Date: Sun, 9 Aug 2026 22:30:48 +0800
Subject: [PATCH] fix(deps): bump gitpython to 3.1.58 in crewai-tools[github]

gitpython 3.1.57 has GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p,
GHSA-hh9p-6wh2-4mfc, GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr
(further unguarded git option forwarding / arbitrary file read via
--pathspec-from-file). All are fixed in 3.1.58, which the root
override-dependencies already require; align the crewai-tools github
extra with it and regenerate the lockfile.
---
 lib/crewai-tools/pyproject.toml | 9 ++++++---
 uv.lock                         | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/crewai-tools/pyproject.toml b/lib/crewai-tools/pyproject.toml
index 3ad4c60a6..61e3039e5 100644
--- a/lib/crewai-tools/pyproject.toml
+++ b/lib/crewai-tools/pyproject.toml
@@ -107,9 +107,12 @@ stagehand = [
     "stagehand>=0.4.1",
 ]
 github = [
-    # <3.1.57 has GHSA-p538-c434-8v24 (arbitrary file truncation) and
-    # GHSA-3f7w-8rr8-f37f (unguarded git option forwarding).
-    "gitpython>=3.1.57,<4",
+    # <3.1.58 has GHSA-p538-c434-8v24 (arbitrary file truncation),
+    # GHSA-3f7w-8rr8-f37f (unguarded git option forwarding),
+    # GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc,
+    # GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr (further unguarded git
+    # option forwarding / arbitrary file read); force 3.1.58+.
+    "gitpython>=3.1.58,<4",
     "PyGithub==1.59.1",
 ]
 rag = [
diff --git a/uv.lock b/uv.lock
index 00cb0e056..def2c5d88 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1761,7 +1761,7 @@ requires-dist = [
     { name = "e2b-code-interpreter", marker = "extra == 'e2b'", specifier = "~=2.6.0" },
     { name = "exa-py", marker = "extra == 'exa-py'", specifier = ">=1.8.7" },
     { name = "firecrawl-py", marker = "extra == 'firecrawl-py'", specifier = ">=1.8.0" },
-    { name = "gitpython", marker = "extra == 'github'", specifier = ">=3.1.57,<4" },
+    { name = "gitpython", marker = "extra == 'github'", specifier = ">=3.1.58,<4" },
     { name = "hyperbrowser", marker = "extra == 'hyperbrowser'", specifier = ">=0.18.0" },
     { name = "langchain-apify", marker = "extra == 'apify'", specifier = ">=0.1.2,<1.0.0" },
     { name = "linkup-sdk", marker = "extra == 'linkup-sdk'", specifier = ">=0.2.2" },