[Aikido] Fix security issue in gitpython via minor version upgrade from 3.1.57 to 3.1.61

[aikido-autofix]

Upgrade GitPython to fix arbitrary file read/write, path traversal, config injection, and RCE vulnerabilities in git operations.

✅ 7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-hh9p-6wh2-4mfc	MEDIUM	[gitpython] Arbitrary file read vulnerability in IndexFile.remove() and Head.checkout() methods that forward unsanitized kwargs to git commands, allowing attackers to read arbitrary files by combining --pathspec-from-file and --pathspec-file-nul flags to leak file contents through error messages.
GHSA-4gmw-gg2m-w46p	LOW	[gitpython] IndexFile.from_tree, reset, and merge_tree fail to sanitize caller-controlled treeish arguments passed to git read-tree, allowing injection of --index-output to overwrite arbitrary files with git-index blobs. This enables arbitrary file destruction/corruption at process privileges.
GHSA-9rj7-rf2p-w77r	LOW	[gitpython] Repo.init() passes unsanitized kwargs to git init, allowing an attacker to inject --template parameter that plants malicious git hooks for arbitrary code execution on the next git operation.
GHSA-hmq2-w58f-27jc	LOW	[gitpython] GitPython fails to validate submodule names, allowing path traversal attacks to create Git repositories at arbitrary filesystem locations outside the intended clone directory. When a victim clones a malicious repository and initializes submodules, an attacker can write arbitrary content to any accessible path on the system.
GHSA-jm78-9fvv-mhgr	LOW	[gitpython] GitPython's config option-name validator fails to reject special characters (=, #, ;, [, ], whitespace), allowing attackers to inject arbitrary git-config directives by embedding these characters in option names. This enables remote code execution through forged directives like core.sshCommand or core.hooksPath when applications forward caller-controlled option names to the config writer.
GHSA-wvpp-8hx9-p66j	LOW	[gitpython] A guard bypass vulnerability allows arbitrary command execution by combining a single-character kwarg with split_single_char_options=False, causing the safety check to miss the smuggled option before it's transformed into a dangerous git argument. This affects all guarded methods at the default allow_unsafe_options=False setting.
AIKIDO-2026-650426	LOW	[gitpython] GitConfigParser fails to safely re-quote multi-line git-config values during serialization, allowing embedded newlines to be interpreted as directives like core.hooksPath and execute arbitrary code through git hooks when writing config files.

🔗 Related Tasks

• https://linear.app/overstory/issue/SEC-1599/small-upgrade-for-gitpython-bough

🤖 Remediation details

Bump gitpython to remediate multiple security advisories

This PR updates the direct dependency gitpython in the root pyproject.toml to address several security advisories affecting versions below 3.1.59. The change raises the declared semver floor and causes uv.lock to resolve a patched release.

gitpython

gitpython is declared as a direct dependency in the root pyproject.toml. The existing range spec >=3.1.55 was updated to >=3.1.59 to enforce a patched minimum, and uv lock --upgrade-package gitpython resolved the lockfile to 3.1.61. All seven advisories (six GHSA entries requiring ≥ 3.1.58 and one Aikido advisory requiring ≥ 3.1.59) are remediated by this single spec change, as every affected version falls below 3.1.59.

Version changes

Package	From	To	Why updated
gitpython	>=3.1.55 (resolved 3.1.57)	>=3.1.59 (resolved 3.1.61)	Direct CVE fix — raises semver floor to patched release

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.