fix(deps): bump gitpython to >=3.1.60 for PYSEC-2026-3785–3788

lib/crewai-tools/pyproject.toml

@@ -107,12 +107,11 @@ stagehand = [
     "stagehand>=0.4.1",
 ]
 github = [
-    # <3.1.58 has GHSA-p538-c434-8v24 (arbitrary file truncation),
-    # GHSA-3f7w-8rr8-f37f (unguarded git option forwarding),
-    # GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc,
-    # GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr (further unguarded git
-    # option forwarding / arbitrary file read); force 3.1.58+.
-    "gitpython>=3.1.58,<4",
+    # <3.1.59 has PYSEC-2026-3785/GHSA-7833-fr7j-v32q,
+    # PYSEC-2026-3786/GHSA-284h-m62q-gf8w, PYSEC-2026-3787/GHSA-8mcc-hrx5-hvxc,
+    # and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287. 3.1.60 hardens config escapes,
+    # diff/actor parsing, and filesystem diffs; force 3.1.60+.
+    "gitpython>=3.1.60,<4",
     "PyGithub==1.59.1",
 ]
 rag = [

pyproject.toml

@@ -172,7 +172,7 @@ info = "Commits must follow Conventional Commits 1.0.0."
 [tool.uv]
 exclude-newer = "3 days"
 # These security fixes are newer than the global supply-chain cutoff.
-exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings = "2026-06-20T00:00:00Z", langsmith = "2026-06-20T00:00:00Z", gitpython = "2026-08-05T00:00:00Z" }
+exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings = "2026-06-20T00:00:00Z", langsmith = "2026-06-20T00:00:00Z" }
 
 # composio-core pins rich<14 but textual requires rich>=14.
 # onnxruntime 1.24+ dropped Python 3.10 wheels; cap it so qdrant[fastembed] resolves on 3.10.
@@ -203,8 +203,14 @@ exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings =
 # TagReference); force 3.1.57+.
 # gitpython <3.1.58 has GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc, GHSA-wvpp-8hx9-p66j and
 # GHSA-jm78-9fvv-mhgr (further unguarded git option forwarding in Repo.init, read-tree and git-config, plus
-# arbitrary file read via --pathspec-from-file); force 3.1.58+. Its exclude-newer-package cutoff is bumped to
-# 2026-08-05 to admit that release.
+# arbitrary file read via --pathspec-from-file).
+# gitpython <3.1.59 has PYSEC-2026-3785/GHSA-7833-fr7j-v32q (.gitmodules [include] file disclosure),
+# PYSEC-2026-3786/GHSA-284h-m62q-gf8w (multi-line git-config re-serialization RCE),
+# PYSEC-2026-3787/GHSA-8mcc-hrx5-hvxc (clone --separate-git-dir omitted from unsafe options),
+# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287 (Repo.blame --contents/-S arbitrary file read).
+# gitpython 3.1.60 hardens config escape semantics, diff/actor parsing, and
+# filesystem diffs; force 3.1.60+. 3.1.60 is older than the global 3-day cutoff,
+# so no exclude-newer-package override is needed.
 # pyasn1 <0.6.4 has GHSA-8ppf-4f7h-5ppj and GHSA-hm4w-wwcw-mr6r; force 0.6.4+.
 # urllib3 <2.7.0 has GHSA-qccp-gfcp-xxvc (ProxyManager cross-origin redirect leaks Authorization/Cookie) and GHSA-mf9v-mfxr-j63j (streaming decompression-bomb bypass); force 2.7.0+.
 # langsmith <0.8.18 has GHSA-3644-q5cj-c5c7 (public prompt manifest deserialization, SSRF/secret disclosure)
@@ -257,7 +263,7 @@ override-dependencies = [
     "pypdf>=6.16.1,<7",
     "uv>=0.11.15,<1",
     "python-multipart>=0.0.27,<1",
-    "gitpython>=3.1.58,<4",
+    "gitpython>=3.1.60,<4",
     "pyasn1>=0.6.4",
     "langsmith>=0.8.18,<1",
     "authlib>=1.6.12",