Skip to content

deps: bump GitPython to 3.1.61 - #4

Closed
katsugtgz wants to merge 1 commit into
rai-opensource:mainfrom
katsugtgz:deps/gitpython-3.1.58
Closed

katsugtgz wants to merge 1 commit into
rai-opensource:mainfrom
katsugtgz:deps/gitpython-3.1.58

Conversation

@katsugtgz

Copy link
Copy Markdown

Updates GitPython to address 22 reported advisories, including GHSA-2f96-g7mh-g2hx, GHSA-3f7w-8rr8-f37f, GHSA-4gmw-gg2m-w46p, GHSA-9rj7-rf2p-w77r, and GHSA-539m-9xh6-q6rr.

Evidence:

  • requirements.txt and pyproject.toml pinned gitpython==3.1.45
  • osv-scanner reported 22 advisories for gitpython@3.1.45 before the update
  • updated version: 3.1.58

Validation:

  • osv-scanner no longer reports any advisory for gitpython@3.1.58 after the update
  • uv lock resolves cleanly; GitPython 3.1.58 imports and runs a basic repo init/commit against gitdb 4.0.12 (the pinned version)

Note: osv-scanner still reports advisories for other packages in this repo (for example torch in robomimic/requirements.txt with no pinned version). This patch only touches GitPython.

Scope: dependency/lockfile update only (requirements.txt, pyproject.toml, uv.lock).

@katsugtgz
katsugtgz force-pushed the deps/gitpython-3.1.58 branch from 50a4245 to 480b454 Compare September 9, 2026 01:51
@katsugtgz katsugtgz changed the title deps: bump GitPython to 3.1.58 (22 advisories) deps: bump GitPython to 3.1.61 Sep 9, 2026
@katsugtgz

Copy link
Copy Markdown
Author

Rebased onto main and moved the pin to 3.1.61, since 3.1.58 is now covered by newer advisories (fixed in 3.1.59). osv-scanner reports no GitPython advisories at 3.1.61. Sorry for the churn.

@katsugtgz katsugtgz closed this by deleting the head repository Sep 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant