Bump GitPython to 3.1.49 to fix Dependabot alerts (#40472)
Addresses CVEs in GitPython <= 3.1.48: - Path traversal in reference APIs (patched in 3.1.48) - Newline injection in config_writer().set_value() enabling RCE via core.hooksPath (patched in 3.1.49) Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
May 8, 2026 at 16:46 UTC
f69bb9336308054575a12f8676beef38aa464fda
2 files changed
+2
-2
distributions/requirements.txt
+1
-1
@@ -1,5 +1,5 @@
1
python-magic==0.4.27
2
click==8.1.3
3
-GitPython==3.1.47
3
+GitPython==3.1.49
4
PyGithub==2.5.0
5
json-cfg==0.4.2
\ No newline at end of file
tools/devops/requirements.txt
+1
-1
@@ -1,4 +1,4 @@
1
azure-devops==7.1.0b4
2
click==8.1.3
3
-gitpython==3.1.47
3
+gitpython==3.1.49
4
backoff==2.2.1
\ No newline at end of file