fix(deps): bump gitpython to >=3.1.60 for PYSEC-2026-3785–3788

[iris-clawd]

Summary

Raise gitpython floor from >=3.1.58 to >=3.1.60 in both the workspace override and crewai-tools[github] to clear pip-audit findings on PYSEC-2026-3785 through PYSEC-2026-3788:

• PYSEC-2026-3785 / GHSA-7833-fr7j-v32q — .gitmodules [include] file disclosure
• PYSEC-2026-3786 / GHSA-284h-m62q-gf8w — multi-line git-config re-serialization RCE
• PYSEC-2026-3787 / GHSA-8mcc-hrx5-hvxc — clone --separate-git-dir omitted from unsafe options
• PYSEC-2026-3788 / GHSA-5xxx-qhh7-9287 — Repo.blame --contents/-S arbitrary file read

3.1.60 hardens config escape semantics, diff/actor parsing, and filesystem diffs. Lock resolves to 3.1.61.

Drops the gitpython exclude-newer-package cutoff since 3.1.60+ is older than the global 3-day supply-chain window.

Supersedes #7244.

Test plan

• Vulnerability Scan / pip-audit is green (no gitpython PYSEC findings)
• uv.lock resolves gitpython==3.1.61

Co-authored-by: Vidit Ostwal viditostwal@gmail.com

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: d537856e-00ed-4f93-827d-0b47939331b7

📥 Commits

Reviewing files that changed from the base of the PR and between 92eb5f9 and 8cc6e5d.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• lib/crewai-tools/pyproject.toml
• pyproject.toml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request raises the GitPython minimum version to 3.1.60, updates security comments, and removes the package-specific newer-version cutoff.

Changes

GitPython security floor

Layer / File(s)	Summary
Update GitPython constraints lib/crewai-tools/pyproject.toml, pyproject.toml	The GitHub optional dependency and override now require GitPython 3.1.60 or newer. The package-specific cutoff is removed. Comments document the advisories and hardening addressed by versions 3.1.59 and 3.1.60.

Suggested reviewers: joaomdmoura

Merge Risk: ⚪ Minimal · up to 8cc6e

This updates GitPython’s security floor and resolves the workspace to GitPython 3.1.61, with consistent dependency constraints and no remaining merge-readiness risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency change and lists a test plan, but it omits the required Related issue, Verification, and Additional context sections. It also does not provide the required link…	Add the required Related issue section with an open issue reference, rename or replace Test plan with the required Verification section, record the verification results, and add the Additional context section or state None.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the GitPython dependency update and the security advisories addressed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the dependency change and lists a test plan, but it omits the required Related issue, Verification, and Additional context sections. It also does not provide the required linked issue format or confirm that checks passed.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch iris/fix-gitpython-pip-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}