Sourced from gitpython's releases.

3.1.49 - Security

What's Changed

• reject control chars in written values in configuration by @​Byron in gitpython-developers/GitPython#2137
• Improve pure Python rev-parse coverage and behavior by @​Copilot in gitpython-developers/GitPython#2136

Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.48...3.1.49

3.1.48 - Security

Accidentally deleted the previous GH release, it did mention the advisory this fixes.

What's Changed

• prevent out-of-repo access when manipulating references. by @​Byron in gitpython-developers/GitPython#2134

Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.47...3.1.48

• 5a294a6 bump version to 3.1.50
• d7b029f Merge pull request #2142 from gitpython-developers/fix-validate-config-key-ne...
• 5453842 Validate config key section names before writing
• 1085a7c Merge pull request #2128 from meliezer/fix-worktree-git-dir
• b7f5fde Merge pull request #2141 from gitpython-developers/dependabot/submodules/git/...
• 4e8cd45 Bump git/ext/gitdb from 335c0f6 to 53c94d6
• 9e94459 Merge pull request #2140 from gitpython-developers/dependabot/pre_commit/pre-...
• 714e2e1 Xfail Windows symlink-capable index mutation test
• b17f113 Bump https://github.com/astral-sh/ruff-pre-commit
• aee2fd5 bump version to 3.1.49
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)