chore(deps): bump gitpython to 3.1.57 - #126
Open
dustenhubbard wants to merge 1 commit into
Open
Conversation
`gitpython==3.1.50` is affected by nine published advisories, every one of them a command-injection or argument-injection path. `3.1.57` clears all nine. The last fix in the series landed in `3.1.55`; `3.1.57` is taken rather than `3.1.55` because three of the nine were incomplete fixes for earlier ones, and the later releases are where that pattern settled. The bump moves nothing else. `gitpython` is pure Python, declares no dependencies, and its floor is `>=3.7`. The only usage is `PyReconstruct/modules/constants/repo_info.py`, which calls `git.Repo(repo_dir)` and reads `head.commit.hexsha` and `active_branch.name`. None of the nine advisories touch that surface, so this is hygiene on the pin rather than a fix for reachable behavior. Verified on Python 3.11 against the rest of the pinned set: install resolves, `git.Repo()` and both attribute reads work unchanged. Refs #112.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
gitpythonfrom3.1.50to3.1.57inrequirements.txtandpyproject.toml, clearing the nine advisories on that pin (fixes land across 3.1.51 through 3.1.55; 3.1.57 is current and three of the nine are follow-up fixes for earlier entries in the series).Nothing else moves:
gitpythonis pure Python with no declared dependencies and a>=3.7floor. The only calls in the tree aregit.Repo(),head.commit.hexsha, andactive_branch.nameinmodules/constants/repo_info.py, and every advisory is in clone, remote, archive, diff, or config handling, so this is pin hygiene rather than a reachable fix.Leaves
vtk==9.3.1alone deliberately. Its three CVEs are first fixed in9.5.1, and bumping that pin on its own breaks the 3D scene:VPlotter.__init__buildsvedo.Text2Dunconditionally and vtk 9.4+ raisesTypeError: ... requires a vtkProperty2D. It needs a matchingvedobump plus three transform call sites, so it wants its own change. Happy to write that up separately.Refs #112