[Aikido] Fix security issue in gitpython via minor version upgrade from 3.1.57 to 3.1.60

[aikido-autofix]

Upgrade GitPython to fix critical RCE vulnerability in GitConfigParser that allows arbitrary code execution through malicious git config injection via unquoted multi-line values.

✅ 7 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-650426	🚨 CRITICAL	[gitpython] GitConfigParser fails to safely re-quote multi-line git-config values during serialization, allowing embedded newlines to be interpreted as directives like core.hooksPath and execute arbitrary code through git hooks when writing config files.
GHSA-hh9p-6wh2-4mfc	MEDIUM	[gitpython] Arbitrary file read vulnerability in IndexFile.remove() and Head.checkout() methods that forward unsanitized kwargs to git commands, allowing attackers to read arbitrary files via --pathspec-from-file and --pathspec-file-nul options with file contents returned in error messages.
GHSA-4gmw-gg2m-w46p	LOW	[gitpython] IndexFile.from_tree, reset, and merge_tree fail to sanitize caller-controlled treeish arguments passed to git read-tree, allowing injection of --index-output to overwrite arbitrary files with git-index blobs. This enables arbitrary file destruction/corruption at process privileges.
GHSA-9rj7-rf2p-w77r	LOW	[gitpython] Repo.init() passes unsanitized kwargs to git init, allowing an attacker to inject --template parameter that plants malicious git hooks for arbitrary code execution on the next git operation.
GHSA-hmq2-w58f-27jc	LOW	[gitpython] GitPython fails to validate submodule names, allowing path traversal attacks to create Git repositories at arbitrary filesystem locations outside the intended clone directory. When a victim clones a malicious repository and initializes submodules, an attacker can write arbitrary content to any accessible path on the system.
GHSA-jm78-9fvv-mhgr	LOW	[gitpython] GitPython's config option-name validator fails to reject special characters (=, #, ;, [, ], whitespace), allowing attackers to inject arbitrary git-config directives by embedding these characters in option names. This enables remote code execution via core.sshCommand or core.hooksPath when an application forwards attacker-controlled option names to the config writer.
GHSA-wvpp-8hx9-p66j	LOW	[gitpython] A guard bypass vulnerability allows arbitrary command execution by combining a single-character kwarg with split_single_char_options=False, causing the security check to miss the smuggled option while transform_kwarg emits a joined token that git parses as --upload-pack=<cmd>. This incomplete fix of a prior vulnerability affects all guarded methods at the default allow_unsafe_options=False setting.

🔗 Related Tasks

• https://linear.app/overstory/issue/SEC-1599/small-upgrade-for-gitpython-bough

🤖 Remediation details

Fix critical and low-severity vulnerabilities in gitpython

This PR remediates multiple security vulnerabilities in the gitpython package (one critical, six low/medium severity). The fix updates the declared lower-bound constraint in the root pyproject.toml and refreshes uv.lock to resolve a patched version.

gitpython

gitpython is a direct dependency declared in the root pyproject.toml under project.dependencies with a >= range spec. The lower bound was raised from >=3.1.55 to >=3.1.59 to enforce a minimum patched version, closing one critical vulnerability (AIKIDO-2026-650426, affecting gitpython >=0.1.7 <=3.1.58) and six additional GHSA advisories (all patched at 3.1.58). Running uv lock --upgrade-package gitpython resolved the lockfile to 3.1.60, the latest available release satisfying the updated constraint and all patched-version requirements.

Version changes

Package	From	To	Why updated
gitpython	>=3.1.55 (resolved: 3.1.57)	>=3.1.59 (resolved: 3.1.60)	Direct CVE fix — raises semver floor to patched release

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #22