build(deps): bump gitpython from 3.1.47 to 3.1.54 in /docs#858
build(deps): bump gitpython from 3.1.47 to 3.1.54 in /docs#858dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.47 to 3.1.54. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.47...3.1.54) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.54 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Automated code review started - full review. Results will be posted here. |
|
✅ Build & test complete. Results:
|
Automated Code ReviewExecutive SummaryThis is a Dependabot security bump upgrading gitpython from 3.1.47 to 3.1.54 in the docs/ lockfile. The change is a 1-file, 6-line diff that updates version, sdist hash/URL, and wheel hash/URL. gitpython 3.1.47 has 12 known OSV security advisories; versions 3.1.48 through 3.1.54 contain security hardening patches. Code quality is clean — this is a mechanical lockfile update with no logic changes. Change Architecturegraph TD
A[docs/pyproject.toml] -->|transitive dep| B[gitpython 3.1.47]
B -->|Dependabot bump| C[gitpython 3.1.54]
C --> D[mkdocs-git-revision-date-localized-plugin]
C --> E[mkdocs-git-authors-plugin]
D --> F[docs build output]
E --> F
Breaking ChangesNone detected. gitpython 3.1.x is a patch-level release series; API surface tested with both plugins and all core operations work correctly. Issues FoundNone. All changes are mechanical:
Security Analysisgitpython 3.1.47 has 12 active OSV/GHSA advisories. The upgrade path includes security fixes:
gitpython is a transitive dep via mkdocs-git-revision-date-localized-plugin. Docs-only — no production impact. EvidenceSHA-256 Hash Verification: Plugin Compatibility: CI: build fails on pre-existing Pygments bug (same on main). ruff-changed-files: pass. spellcheck: pass. SuggestionsConsider adding VerdictVERDICT: APPROVED |
hermes-exosphere
left a comment
hermes-exosphere
left a comment
There was a problem hiding this comment.
Automated review: Approved.
- 1 file changed, 3 insertions, 3 deletions
- Hash verification: both sdist and wheel SHA-256 verified against PyPI
- Plugin compatibility: mkdocs-git-authors and mkdocs-git-revision-date-localized load correctly
- Security: patches 12 OSV advisories in gitpython 3.1.47
- CI failure (build) is pre-existing, unrelated to this PR
hermes-exosphere
left a comment
hermes-exosphere
left a comment
There was a problem hiding this comment.
Automated review: Approved. ✅
1 participant
Bumps gitpython from 3.1.47 to 3.1.54.
Release notes
Sourced from gitpython's releases.
... (truncated)
Commits
e59d9baprepare next releasea4dc70dMerge pull request #2180 from gitpython-developers/single-char-kwarg1d51b89fix: guard diff output optionsffcb535fix: reject unsafe clone templatese8d0fbffix: validate split short-option valuesfaf3c09prepare for security fix6a5eb6aMerge pull request #2176 from gitpython-developers/fix-config-injection1ed1b92fix: validate config section delimiters354eb2fMerge pull request #2159 from Siesta0217/fix-core-hooks-path-commit-hooks9bc287aAddress review feedback about hook resolutionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.