Sourced from gitpython's releases.

3.1.49 - Security

What's Changed

• reject control chars in written values in configuration by @​Byron in gitpython-developers/GitPython#2137
• Improve pure Python rev-parse coverage and behavior by @​Copilot in gitpython-developers/GitPython#2136

Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.48...3.1.49

3.1.48 - Security

Accidentally deleted the previous GH release, it did mention the advisory this fixes.

What's Changed

• prevent out-of-repo access when manipulating references. by @​Byron in gitpython-developers/GitPython#2134

Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.47...3.1.48

• aee2fd5 bump version to 3.1.49
• 1c4ea96 Merge pull request #2136 from gitpython-developers/copilot/create-reproducing...
• 6cf7ac3 Address rev-parse review feedback
• b049a13 Merge pull request #2137 from gitpython-developers/fix-config-injection
• bdbdf4b Fix rev-parse CI issues
• d7ce6fc Improve pure Python rev-parse coverage and behavior (#2135)
• 8e24503 avoid duplicate validation in set_value
• c417af4 reject control chars in written values in configuration
• 5a15361 a new release with safer reference creation
• dbfa264 Merge pull request #2134 from gitpython-developers/validate-ref-creation
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)