From 904aa71c58e0b0fecd2bcd94195b137841ce74f7 Mon Sep 17 00:00:00 2001 From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Date: Thu, 23 Jul 2026 22:53:07 +0300 Subject: [PATCH 1/5] Declare support for Python 3.13-3.14 --- setup.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/setup.py b/setup.py index a7b1eab00..00981ef27 100755 --- a/setup.py +++ b/setup.py @@ -108,5 +108,7 @@ def _stamp_version(filename: str) -> None: "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", ], ) From 7d5370dab874f99c3327e2324e2c4fa65da5507e Mon Sep 17 00:00:00 2001 From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Date: Thu, 23 Jul 2026 22:56:34 +0300 Subject: [PATCH 2/5] Add support for Python 3.15 --- .github/workflows/pythonpackage.yml | 14 ++++++++++++-- setup.py | 1 + 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml index fe3e26236..eeb75ba6b 100644 --- a/.github/workflows/pythonpackage.yml +++ b/.github/workflows/pythonpackage.yml @@ -17,7 +17,7 @@ jobs: strategy: matrix: os-type: [ubuntu, macos, windows] - python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.13t", "3.14", "3.14t"] + python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.13t", "3.14", "3.14t", "3.15", "3.15t"] exclude: - os-type: macos python-version: "3.7" # Not available for the ARM-based macOS runners. @@ -25,14 +25,20 @@ jobs: python-version: "3.13t" - os-type: macos python-version: "3.14t" + - os-type: macos + python-version: "3.15t" - os-type: windows - python-version: "3.13" # FIXME: Fix and enable Python 3.13 and 3.14 on Windows (#1955). + python-version: "3.13" # FIXME: Fix and enable Python 3.13-3.15 on Windows (#1955). - os-type: windows python-version: "3.13t" - os-type: windows python-version: "3.14" - os-type: windows python-version: "3.14t" + - os-type: windows + python-version: "3.15" + - os-type: windows + python-version: "3.15t" include: - os-ver: latest - os-type: ubuntu @@ -44,6 +50,10 @@ jobs: - python-version: "3.8" build-docs: false - experimental: false + - python-version: "3.15" + experimental: true + - python-version: "3.15t" + experimental: true fail-fast: false diff --git a/setup.py b/setup.py index 00981ef27..3a62a91fd 100755 --- a/setup.py +++ b/setup.py @@ -110,5 +110,6 @@ def _stamp_version(filename: str) -> None: "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", "Programming Language :: Python :: 3.14", + "Programming Language :: Python :: 3.15", ], ) From 8a921820bf0f8af423f7ca6d14b1e17aa0f9d156 Mon Sep 17 00:00:00 2001 From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Date: Thu, 23 Jul 2026 23:17:39 +0300 Subject: [PATCH 3/5] Stop testing experimental 3.13t --- .github/workflows/pythonpackage.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml index eeb75ba6b..0f10e1e35 100644 --- a/.github/workflows/pythonpackage.yml +++ b/.github/workflows/pythonpackage.yml @@ -17,20 +17,16 @@ jobs: strategy: matrix: os-type: [ubuntu, macos, windows] - python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.13t", "3.14", "3.14t", "3.15", "3.15t"] + python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "3.14t", "3.15", "3.15t"] exclude: - os-type: macos python-version: "3.7" # Not available for the ARM-based macOS runners. - - os-type: macos - python-version: "3.13t" - os-type: macos python-version: "3.14t" - os-type: macos python-version: "3.15t" - os-type: windows python-version: "3.13" # FIXME: Fix and enable Python 3.13-3.15 on Windows (#1955). - - os-type: windows - python-version: "3.13t" - os-type: windows python-version: "3.14" - os-type: windows From 38553b6fddc7f6a667cdb45a6762343a08fc72b2 Mon Sep 17 00:00:00 2001 From: Sebastian Thiel Date: Sat, 25 Jul 2026 06:27:01 +0200 Subject: [PATCH 4/5] fix: reject unsafe output options in Commit.count Commit.count forwards keyword arguments to git rev-list but did not apply the unsafe-option validation used by the sibling revision APIs. Validate forwarded options with the existing Git.check_unsafe_options helper and retain the explicit allow_unsafe_options escape hatch. This covers GHSA-p538-c434-8v24 without adding another option parser. Git baseline: git.git a23bace963 defines --output as a shared diff option consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option with rev-list. Co-authored-by: GPT 5.6 --- git/objects/commit.py | 15 ++++++++++++++- test/test_commit.py | 5 +++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/git/objects/commit.py b/git/objects/commit.py index 1d8e8f071..3e435453d 100644 --- a/git/objects/commit.py +++ b/git/objects/commit.py @@ -269,13 +269,21 @@ def summary(self) -> Union[str, bytes]: else: return self.message.split(b"\n", 1)[0] - def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) -> int: + def count( + self, + paths: Union[PathLike, Sequence[PathLike]] = "", + allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> int: """Count the number of commits reachable from this commit. :param paths: An optional path or a list of paths restricting the return value to commits actually containing the paths. + :param allow_unsafe_options: + Allow unsafe options, like ``--output``. + :param kwargs: Additional options to be passed to :manpage:`git-rev-list(1)`. They must not alter the output style of the command, or parsing will yield incorrect @@ -284,6 +292,11 @@ def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) :return: An int defining the number of reachable commits """ + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([], kwargs), unsafe_options=self.unsafe_git_rev_options + ) + # Yes, it makes a difference whether empty paths are given or not in our case as # the empty paths version will ignore merge commits for some reason. if paths: diff --git a/test/test_commit.py b/test/test_commit.py index 74b7078f5..cb0427740 100644 --- a/test/test_commit.py +++ b/test/test_commit.py @@ -301,6 +301,11 @@ def test_iter_items_rejects_unsafe_options(self): with self.assertRaises(UnsafeOptionError): list(Commit.iter_items(self.rorepo, "HEAD", output=marker)) + def test_count_rejects_unsafe_options(self): + with tempfile.NamedTemporaryFile() as marker: + with self.assertRaises(UnsafeOptionError): + self.rorepo.head.commit.count(output=marker.name) + def test_rev_list_bisect_all(self): """ 'git rev-list --bisect-all' returns additional information From e3221f1252346259513e14afeed32f0a203512a7 Mon Sep 17 00:00:00 2001 From: Byron Date: Sat, 25 Jul 2026 09:30:05 +0200 Subject: [PATCH 5/5] prepare next release --- VERSION | 2 +- doc/source/changes.rst | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 5b1840f1e..7db15315f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.1.55 +3.1.56 diff --git a/doc/source/changes.rst b/doc/source/changes.rst index a27ff48a2..2f0e2a0ca 100644 --- a/doc/source/changes.rst +++ b/doc/source/changes.rst @@ -2,6 +2,19 @@ Changelog ========= +3.1.56 +====== + +A security fix for + +* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24 + +If you can, also try and provide feedback on the upcoming v4 branch +https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome. + +See the following for all changes. +https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55 + 3.1.55 ======