3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @Byron in #2179
• build(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #2185
• build(deps): bump the pre-commit group with 2 updates by @dependabot[bot] in #2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @dependabot[bot] in #2124
• Render protected Traversable methods in the reference by @pick7 in #2192
• Use standard prefixes for parsed patch diffs by @pick7 in #2191
• Honor kill_after_timeout with output streams by @pick7 in #2189
• Redact Authorization extra headers from command errors by @pick7 in #2188
• Improve RemoteProgress parse return typing by @pick7 in #2187
• Adopt basedpyright with a legacy baseline by @Byron in #2194
• Block unsafe Git file and URL options by @Byron in #2193

New Contributors

• @pick7 made their first contribution in #2192

Full Changelog: 3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

• Add support for Python 3.15 by @hugovk in #2183
• fix: reject unsafe output options in Commit.count by @Byron in #2184

Full Changelog: 3.1.55...3.1.56

3.1.55 - Security

What's Changed

• fix: prevent environment expansion in remote URLs by @Byron in #2181

Full Changelog: 3.1.54...3.1.55

3.1.54 - Security

What's Changed

• Harden unsafe Git option validation by @Byron in #2180

Full Changelog: 3.1.53...3.1.54

3.1.53 - Security

What's Changed

• feat(submodule): add deinit method to Submodule (#2014) by @mvanhorn in #2129
• typing: introduce sensible basedpyright defaults by @Byron in #2174
• fix: make submodule.update() after submodule.deinit() work by @Byron in #2175
• Fix commit hooks respecting core.hooksPath by @Siesta0217 in #2159
• fix: validate config section delimiters by @Byron in #2176

New Contributors

• @Siesta0217 made their first contribution in #2159

Full Changelog: 3.1.52...3.1.53

3.1.52 Security

GHSA-rwj8-pgh3-r573: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

What's Changed

• Skip cross-drive relative config test on Windows by @Byron in #2171
• fix: preserve literal clone URLs by @Byron in #2172

Full Changelog: 3.1.51...3.1.52

3.1.51 - Security

What's Changed

• Add AI-disclosure and quality requirements to the contribution guidelines by @Byron in #2143
• docs(cmd): clarify Git.execute() string vs list command argument by @mvanhorn in #2144
• Rewrite Git.execute() command parameter docstring per #2146 by @EliahKagan in #2147
• Document init script behavior with multiple master remotes by @EliahKagan in #2148
• Bump git/ext/gitdb from 335c0f6 to 0a019a2 by @dependabot[bot] in #2149
• Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by @elovelan in #2151
• Defer xfail condition evaluation with xfail_if_raises context manager by @elovelan in #2153
• Run more submodule tests on Cygwin (fix flaky xfails) by @EliahKagan in #2154
• Cut xtrace noise from POSIX-ownership diagnostic steps by @EliahKagan in #2156
• Support index diffs against the empty tree by @puneetdixit200 in #2155
• refactor: seperate out Progress type by @LoeschMaximilian in #2157
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.12 to 0.15.15 in the pre-commit group by @dependabot[bot] in #2160
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2164
• Bump git/ext/gitdb from 0a019a2 to 4950ea9 by @dependabot[bot] in #2165
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.15 to 0.15.20 in the pre-commit group by @dependabot[bot] in #2166
• Add Commit.is_shallow property; document stats() limitation at shallow boundary by @harshitayadavv in #2167
• Allow relative config paths with includes by @Byron in #2169
• Reject abbreviated forms of unsafe git options by @Byron in #2168
• guard unsafe git command options by @Byron in #2163

New Contributors

• @elovelan made their first contribution in #2151
• @puneetdixit200 made their first contribution in #2155
• @LoeschMaximilian made their first contribution in #2157
• @harshitayadavv made their first contribution in #2167

Full Changelog: 3.1.50...3.1.51

3.1.50

What's Changed

• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.8 to 0.15.12 in the pre-commit group by @dependabot[bot] in #2140
• Bump git/ext/gitdb from 335c0f6 to 53c94d6 by @dependabot[bot] in #2141
• Fix Repo() autodiscovery in linked worktrees when GIT_DIR is set by @meliezer in #2128
• Validate config key names before writing by @Byron in #2142

New Contributors

• @meliezer made their first contribution in #2128

Full Changelog: 3.1.49...3.1.50

3.1.49 - Security

What's Changed

• reject control chars in written values in configuration by @Byron in #2137
• Improve pure Python rev-parse coverage and behavior by @Copilot in #2136

Full Changelog: 3.1.48...3.1.49

3.1.48 - Security

Accidentally deleted the previous GH release, it did mention the advisory this fixes.

What's Changed

• prevent out-of-repo access when manipulating references. by @Byron in #2134

Full Changelog: 3.1.47...3.1.48