Upgrade gitpython - #70264
Open
dwoz wants to merge 1 commit into
Open
Conversation
…VE-2026-78676 The base pin ``requirements/base.txt`` and every lock file under ``requirements/static/ci/py3.*/`` were already updated to ``>=3.1.59`` / ``==3.1.59`` in bf939d3 for CVE-2026-78676 (GitPython RCE via malformed config re-serialization corrupting a dormant multi-line quoted value into ``core.hooksPath``). Two CI-static lower-bound files were missed by that bump: - ``requirements/static/ci/common.txt`` - ``requirements/static/ci/darwin.txt`` Both still said ``gitpython>=3.1.50``, which permits vulnerable 3.1.50-3.1.58. The lock files are authoritative for installs, so this was not a live exposure, but any fresh resolve (regenerating a lock, or an out-of-lock install that consumes these constraint files directly) could select a vulnerable version. Align them to ``>=3.1.59`` so the lower bound matches base.
dwoz
force-pushed
the
dwoz/security/gitpython-lowerbound-cve-2026-78676-3006.x
branch
from
September 10, 2026 21:47
4b12de0 to
bdbaa43
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-78676
The base pin
requirements/base.txtand every lock file underrequirements/static/ci/py3.*/were already updated to>=3.1.59/==3.1.59in bf939d3 for CVE-2026-78676 (GitPython RCE via malformed config re-serialization corrupting a dormant multi-line quoted value intocore.hooksPath).Two CI-static lower-bound files were missed by that bump:
requirements/static/ci/common.txtrequirements/static/ci/darwin.txtBoth still said
gitpython>=3.1.50, which permits vulnerable 3.1.50-3.1.58. The lock files are authoritative for installs, so this was not a live exposure, but any fresh resolve (regenerating a lock, or an out-of-lock install that consumes these constraint files directly) could select a vulnerable version.Align them to
>=3.1.59so the lower bound matches base.