Bump GitPython to 3.1.50 to address CVE-2026-42215 bypass (#40504)
Fixes Dependabot alerts #22 and #23. GitPython <= 3.1.49 has a newline injection vulnerability in config_writer() section parameter that bypasses the CVE-2026-42215 patch and enables RCE via core.hooksPath. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
May 11, 2026 at 18:30 UTC
6a462fb2a1ee86b656cb8b2d763a3b6ec7010adf
2 files changed
+2
-2
distributions/requirements.txt
+1
-1
@@ -1,5 +1,5 @@
1
python-magic==0.4.27
2
click==8.1.3
3
-GitPython==3.1.49
3
+GitPython==3.1.50
4
PyGithub==2.5.0
5
json-cfg==0.4.2
\ No newline at end of file
tools/devops/requirements.txt
+1
-1
@@ -1,4 +1,4 @@
1
azure-devops==7.1.0b4
2
click==8.1.3
3
-gitpython==3.1.49
3
+gitpython==3.1.50
4
backoff==2.2.1
\ No newline at end of file