[Aikido] Fix security issue in gitpython via minor version upgrade from 3.1.57 to 3.1.60

[aikido-autofix]

Upgrade GitPython to fix arbitrary file read/write, path traversal, config injection, and RCE vulnerabilities in git operations.

✅ 6 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-hh9p-6wh2-4mfc	MEDIUM	[gitpython] Arbitrary file read vulnerability in IndexFile.remove() and Head.checkout() methods that forward unsanitized kwargs to git commands, allowing attackers to read arbitrary files via --pathspec-from-file and --pathspec-file-nul options with file contents returned in error messages.
GHSA-4gmw-gg2m-w46p	LOW	[gitpython] IndexFile.from_tree, reset, and merge_tree fail to sanitize caller-controlled treeish arguments passed to git read-tree, allowing injection of --index-output to overwrite arbitrary files with git-index blobs. This enables arbitrary file destruction/corruption at process privileges.
GHSA-9rj7-rf2p-w77r	LOW	[gitpython] Repo.init() passes unsanitized kwargs to git init, allowing an attacker to inject --template parameter that plants malicious git hooks for arbitrary code execution on the next git operation.
GHSA-hmq2-w58f-27jc	LOW	[gitpython] GitPython fails to validate submodule names, allowing path traversal attacks to create Git repositories at arbitrary filesystem locations outside the intended clone directory. When a victim clones a malicious repository and initializes submodules, an attacker can write arbitrary content to any accessible path on the system.
GHSA-jm78-9fvv-mhgr	LOW	[gitpython] GitPython's config option-name validator fails to reject special characters (=, #, ;, [, ], whitespace), allowing attackers to inject arbitrary git-config directives by embedding these characters in option names. This enables remote code execution via core.sshCommand or core.hooksPath when an application forwards attacker-controlled option names to the config writer.
GHSA-wvpp-8hx9-p66j	LOW	[gitpython] A guard bypass vulnerability allows arbitrary command execution by combining a single-character kwarg with split_single_char_options=False, causing the security check to miss the smuggled option while transform_kwarg emits a joined token that git parses as --upload-pack=<cmd>. This incomplete fix of a prior vulnerability affects all guarded methods at the default allow_unsafe_options=False setting.

🔗 Related Tasks

• https://linear.app/overstory/issue/SEC-1599/small-upgrade-for-gitpython-bough

🤖 Remediation details

Upgrade gitpython to remediate multiple security advisories

This PR upgrades the vulnerable package gitpython from 3.1.57 to 3.1.60 to address six security advisories (one MEDIUM, five LOW severity). The change is a lockfile-only update: gitpython is a direct dependency declared in the root pyproject.toml with the existing constraint gitpython>=3.1.55, which already permits the patched version. Only uv.lock was regenerated; no manifest edits were required.

gitpython

gitpython was resolved at 3.1.57, which falls below the minimum patched version of 3.1.58 required to address six security advisories. Because the root pyproject.toml already declares gitpython>=3.1.55, no manifest change was needed; running uv lock --upgrade-package gitpython was sufficient to advance the lockfile-resolved version to 3.1.60, satisfying all patched-version requirements.

Version changes

Package	From	To	Why updated
gitpython	3.1.57	3.1.60	Direct CVE fix — lockfile upgraded to patched version

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #21