From ffbf192c184cf1785f11f7435d34b3fadafbd99e Mon Sep 17 00:00:00 2001 From: Gavin Borges Date: Thu, 23 Jul 2026 22:27:51 -0400 Subject: [PATCH] deps: bump gitpython 3.1.50 to 3.1.52 in the production lockfile environments/requirements.lock still pinned gitpython 3.1.50 (transitive via snakemake) while environments/requirements-ci.txt was already at 3.1.52, so the production lock lagged the fix. 3.1.50 carries GHSA-2f96-g7mh-g2hx, GHSA-956x-8gvw-wg5v and GHSA-v396-v7q4-x2qj (command injection via long-option prefix abbreviation), all resolved in 3.1.51 and later. The wheel and sdist hashes match PyPI and the existing ci manifest. Found by auditing the installed lockfile with pip-audit. --- environments/requirements.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/environments/requirements.lock b/environments/requirements.lock index 4174ab0..a373c3b 100644 --- a/environments/requirements.lock +++ b/environments/requirements.lock @@ -783,9 +783,9 @@ gitdb==4.0.12 \ --hash=sha256:5ef71f855d191a3326fcfbc0d5da835f26b13fbcba60c32c21091c349ffdb571 \ --hash=sha256:67073e15955400952c6565cc3e707c554a4eea2e428946f7a4c162fab9bd9bcf # via gitpython -gitpython==3.1.50 \ - --hash=sha256:80da2d12504d52e1f998772dc5baf6e553f8d2fcfe1fcc226c9d9a2ee3372dcc \ - --hash=sha256:d352abe2908d07355014abdd21ddf798c2a961469239afec4962e9da884858f9 +gitpython==3.1.52 \ + --hash=sha256:79a36ee1f83523214a3f72d56cf1c4e490d577dc61af77e43dfe5862bd9da01a \ + --hash=sha256:de0a8ad86274c6e75ae8b37dd055ba68f19818c813108642263227b20775b48e # via snakemake greenlet==3.4.0 \ --hash=sha256:04403ac74fe295a361f650818de93be11b5038a78f49ccfb64d3b1be8fbf1267 \