Bump GitPython to 3.1.47 to fix command injection vulnerabilities (#40349)
Fixes CVE-2024-22190 and GHSA-2mqj-m65w-jghx. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
Apr 28, 2026 at 18:00 UTC
9be489101d531f11e1aa9751ca8f50a03bbb1a0d
2 files changed
+2
-2
distributions/requirements.txt
+1
-1
@@ -1,5 +1,5 @@
1
python-magic==0.4.27
2
click==8.1.3
3
-GitPython==3.1.41
3
+GitPython==3.1.47
4
PyGithub==2.5.0
5
json-cfg==0.4.2
\ No newline at end of file
tools/devops/requirements.txt
+1
-1
@@ -1,4 +1,4 @@
1
azure-devops==7.1.0b4
2
click==8.1.3
3
-gitpython==3.1.41
3
+gitpython==3.1.47
4
backoff==2.2.1
\ No newline at end of file