Merge pull request #70265 from dwoz/dwoz/security/gitpython-cve-2026-78676-3008.x

Update gitpython version

Author: dwoz

changelog/70265.security.md

@@ -0,0 +1 @@
+Bumped GitPython in six `requirements/static/ci/py3.*/lint.lock` files from vulnerable `==3.1.50` to `==3.1.60` (matching the rest of the lock chain) and aligned the CI-static lower bound in `requirements/static/ci/{common,darwin}.txt` from `>=3.1.50` to `>=3.1.59`. Fixes CVE-2026-78676 (GHSA-284h-m62q-gf8w) — GitPython re-serialization corrupts a dormant multi-line quoted config value into an executable directive (e.g. `core.hooksPath`), enabling RCE via crafted config files. Lint environments installed from these six lock files were within the vulnerable range; the runtime lock files (`{cloud,darwin,docs,freebsd,linux,windows}.lock`) and base pin were already at `>=3.1.60` and unaffected.

requirements/static/ci/common.txt

@@ -29,7 +29,7 @@ dnspython
 etcd3-py==0.1.6
 filelock>=3.19.1 ; python_version < '3.10'
 filelock>=3.29.1 ; python_version >= '3.10'
-gitpython>=3.1.50
+gitpython>=3.1.59
 google-auth==2.35.0; python_version == '3.9'
 jmespath>=1.1.0
 jsonschema

requirements/static/ci/darwin.txt

@@ -6,4 +6,4 @@ hglib
 # Pin versions to match 3007.x
 apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
 apache-libcloud>=3.9.1; python_version >= '3.10'
-gitpython>=3.1.50
+gitpython>=3.1.59

requirements/static/ci/py3.10/lint.lock

@@ -221,7 +221,7 @@ gitdb==4.0.12
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
     #   gitpython
-gitpython==3.1.50
+gitpython==3.1.60
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock

requirements/static/ci/py3.11/lint.lock

@@ -212,7 +212,7 @@ gitdb==4.0.12
     #   -c requirements/static/ci/py3.11/linux.lock
     #   -c requirements/static/pkg/py3.11/linux.lock
     #   gitpython
-gitpython==3.1.50
+gitpython==3.1.60
     # via
     #   -c requirements/static/ci/py3.11/linux.lock
     #   -c requirements/static/pkg/py3.11/linux.lock

requirements/static/ci/py3.12/lint.lock

@@ -203,7 +203,7 @@ gitdb==4.0.12
     #   -c requirements/static/ci/py3.12/linux.lock
     #   -c requirements/static/pkg/py3.12/linux.lock
     #   gitpython
-gitpython==3.1.50
+gitpython==3.1.60
     # via
     #   -c requirements/static/ci/py3.12/linux.lock
     #   -c requirements/static/pkg/py3.12/linux.lock

requirements/static/ci/py3.13/lint.lock

@@ -203,7 +203,7 @@ gitdb==4.0.12
     #   -c requirements/static/ci/py3.13/linux.lock
     #   -c requirements/static/pkg/py3.13/linux.lock
     #   gitpython
-gitpython==3.1.50
+gitpython==3.1.60
     # via
     #   -c requirements/static/ci/py3.13/linux.lock
     #   -c requirements/static/pkg/py3.13/linux.lock

requirements/static/ci/py3.14/lint.lock

@@ -203,7 +203,7 @@ gitdb==4.0.12
     #   -c requirements/static/ci/py3.14/linux.lock
     #   -c requirements/static/pkg/py3.14/linux.lock
     #   gitpython
-gitpython==3.1.50
+gitpython==3.1.60
     # via
     #   -c requirements/static/ci/py3.14/linux.lock
     #   -c requirements/static/pkg/py3.14/linux.lock

requirements/static/ci/py3.9/lint.lock

@@ -215,7 +215,7 @@ gitdb==4.0.12
     #   -c requirements/static/ci/py3.9/linux.lock
     #   -c requirements/static/pkg/py3.9/linux.lock
     #   gitpython
-gitpython==3.1.50
+gitpython==3.1.60
     # via
     #   -c requirements/static/ci/py3.9/linux.lock
     #   -c requirements/static/pkg/py3.9/linux.lock