Bump gitpython from 3.1.62 to 3.2.1 by dependabot[bot] · Pull Request #576 · cycodehq/cycode-cli

dependabot · 2026-10-26T04:44:12Z

Bumps gitpython from 3.1.62 to 3.2.1.

Release notes

3.2.1

What's Changed

prepare for next release, v3.2 by @Byron in gitpython-developers/GitPython#2260

objects: decode a byte mode before reading its digits by @SashaMIT in gitpython-developers/GitPython#2261

build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group by @dependabot[bot] in gitpython-developers/GitPython#2263

fix(submodule): validate destinations before mutation by @Byron in gitpython-developers/GitPython#2264

fix(util): create lock files in one exclusive step by @radhika1314 in gitpython-developers/GitPython#2267

fix(commit): accumulate gpgsig continuation lines in linear time by @Keerthana-64 in gitpython-developers/GitPython#2268

fix(index): accept a single PathLike in checkout by @kokotatan in gitpython-developers/GitPython#2269

fix(util): redact URL credentials without corrupting the host by @yunaremaia in gitpython-developers/GitPython#2270

change line for changelogs by @CrowZhen in gitpython-developers/GitPython#2272

fix(commit): reject identity fields that alter commit headers by @Keerthana-64 in gitpython-developers/GitPython#2271

fix: stop stalled remote commands when their timeout expires by @Byron in gitpython-developers/GitPython#2277

fix(util): reject symbolic links that alias .gitmodules by @Keerthana-64 in gitpython-developers/GitPython#2278

fix: send one object name or path per git stdin record by @Keerthana-64 in gitpython-developers/GitPython#2279

fix(stats): preserve whitespace in filenames by @v1shay in gitpython-developers/GitPython#2280

fix(config): preserve exact large integer values by @xiehuanyi in gitpython-developers/GitPython#2281

fix: resolve IterableList names independently of list attributes by @FanWu-ai in gitpython-developers/GitPython#2283

fix relative blocking lock 20261011 by @Byron in gitpython-developers/GitPython#2284

New Contributors

@SashaMIT made their first contribution in gitpython-developers/GitPython#2261

@kokotatan made their first contribution in gitpython-developers/GitPython#2269

@yunaremaia made their first contribution in gitpython-developers/GitPython#2270

@CrowZhen made their first contribution in gitpython-developers/GitPython#2272

@v1shay made their first contribution in gitpython-developers/GitPython#2280

@xiehuanyi made their first contribution in gitpython-developers/GitPython#2281

@FanWu-ai made their first contribution in gitpython-developers/GitPython#2283

Full Changelog: gitpython-developers/GitPython@3.2.0...3.2.1

3.2.0 - Security

What's Changed

test: cover subdirectory discovery and pathspec commands in bare-repository worktrees by @christianvuerings in gitpython-developers/GitPython#2228

Read git's yes/no and on/off booleans in get_value by @rawsun007 in gitpython-developers/GitPython#2229

Clarify detached HEAD access and isolate test branch state by @Byron in gitpython-developers/GitPython#2231

Reject submodule move destinations through intermediate symlinks by @Byron in gitpython-developers/GitPython#2232

fix: validate checkout positional reference options by @Byron in gitpython-developers/GitPython#2233

Fix timeout child-process lookup on non-GNU systems by @aprylewu in gitpython-developers/GitPython#2236

Preserve implicit boolean config keys by @Byron in gitpython-developers/GitPython#2238

Reject comments after implicit boolean config keys by @Byron in gitpython-developers/GitPython#2239

Fix case-insensitive Git config name matching by @Byron in gitpython-developers/GitPython#2241

Move project metadata to pyproject.toml by @mwtoews in gitpython-developers/GitPython#2242

Move [doc] extra to a PEP 735 dependency group; add uv-sync CI check by @mwtoews in gitpython-developers/GitPython#2243

fix: strip inline config comments the way git does by @rawsun007 in gitpython-developers/GitPython#2245

Drop Python 3.7 by @mwtoews in gitpython-developers/GitPython#2246

fix: preserve positional operands in high-level Git commands by @Byron in gitpython-developers/GitPython#2247

submodule: option to update without fetching by @jeffro256 in gitpython-developers/GitPython#2244

bump minor version to indicate drop of python 3.7 support by @Byron in gitpython-developers/GitPython#2248

fix: skip a UTF-8 BOM when reading config files by @geek-alpha in gitpython-developers/GitPython#2249

... (truncated)

Changelog

Sourced from gitpython's changelog.

3.2.1

Security fixes for

GHSA-83vg-56qc-22m7

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1

3.2.0

Drops support for Python 3.7 (5 years after its EOL).

Security fixes for

Deprecate the pure-Python GitDB object database backend due to security and performance issues. Selecting it or a subclass through odbt now emits a DeprecationWarning. Remove odbt=GitDB to use GitCmdObjectDB, the existing default, or select odbt=GitCmdObjectDB explicitly. The gitdb package remains a dependency for shared types and utilities.

GHSA-gq48-pqfc-9p58

GHSA-23mf-xhv8-69c2

GHSA-f9j4-qggq-h239

GHSA-w8jc-g24h-crhw

GHSA-m64x-33q8-m5h7

GHSA-fx3j-rwgx-fr94

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0

Commits

c179357 prepare changelog prior to release
97eadb8 fix(submodule): validate destinations before mutation
6a7180a prepare for next release, v3.2
0b64501 refactor(db): deprecate the pure-Python GitDB backend
9349ff5 fix(repo): preserve literal separate Git directory paths
8290c98 fix: bound actor and date parsing
9ad28cc fix: complete safety checks in Git command wrappers
ce2093b bump minor version to indicate drop of python 3.7 support
dafafff Merge pull request #2247 from gitpython-developers/pos-arg-sanitization
790bb31 fix(remote): reject option-shaped pull operands
Additional commits viewable in compare view

omer-roth · 2026-11-01T06:47:27Z

@dependabot recreate

Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.62 to 3.2.1. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst) - [Commits](gitpython-developers/GitPython@3.1.62...3.2.1) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.2.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

A runner patch bump (3.14.9 -> 3.14.10) restored a cached Poetry install pointing at a missing interpreter, failing poetry install on Windows 3.14. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

omer-roth · 2026-11-01T09:04:14Z

@dependabot rebase

dependabot Bot requested review from avishaiamiel and omer-roth as code owners October 26, 2026 04:44

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 26, 2026

dependabot Bot force-pushed the dependabot/pip/gitpython-3.2.1 branch from 47585ef to c650ad4 Compare November 1, 2026 06:48

dependabot Bot and others added 2 commits November 1, 2026 08:05

Key the full-matrix Poetry cache on the exact Python version

b060ad1

A runner patch bump (3.14.9 -> 3.14.10) restored a cached Poetry install pointing at a missing interpreter, failing poetry install on Windows 3.14. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dependabot Bot force-pushed the dependabot/pip/gitpython-3.2.1 branch from c650ad4 to 76c7e19 Compare November 1, 2026 09:05

omer-roth approved these changes Nov 1, 2026

View reviewed changes

avishaiamiel approved these changes Nov 1, 2026

View reviewed changes

omer-roth enabled auto-merge (squash) November 1, 2026 09:43

omer-roth disabled auto-merge November 1, 2026 09:45

omer-roth merged commit 2a6d8dc into main Nov 1, 2026
19 checks passed

omer-roth deleted the dependabot/pip/gitpython-3.2.1 branch November 1, 2026 09:45

omer-roth mentioned this pull request Nov 1, 2026

CM-72593: Surface malicious package detections in SCA scan output #545

Merged

Navigation Menu

Repository navigation

Bump gitpython from 3.1.62 to 3.2.1 - #576

Bump gitpython from 3.1.62 to 3.2.1#576
omer-roth merged 2 commits into
mainfrom
dependabot/pip/gitpython-3.2.1

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

omer-roth commented Nov 1, 2026

Uh oh!

omer-roth commented Nov 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.2.1

What's Changed

New Contributors

3.2.0 - Security

What's Changed

3.2.1

3.2.0

Uh oh!

omer-roth commented Nov 1, 2026

Uh oh!

omer-roth commented Nov 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading