Summary
GitPython 3.1.60 (published 2026-08-25 18:33 UTC) removed the Actor.name_email_regex class attribute as part of a security hardening fix (gitpython-developers/GitPython#2215, replacing backtracking-regex identity parsing to close GHSA-v6xg-m7rh-r365 and GHSA-g5vv-9gxw-82hx).
semantic_release/cli/config.py calls Actor.name_email_regex.match(...) directly when validating the configured commit author (commit_author), so any environment that resolves to gitpython>=3.1.60 now crashes on every invocation:
AttributeError: type object 'Actor' has no attribute 'name_email_regex'
Since PSR's own constraint is gitpython~=3.0, this affects every version — a fresh pip install python-semantic-release today resolves gitpython==3.1.60 and breaks immediately, with no code change on the caller's part. Confirmed via bisection: 3.1.59 still has the attribute, 3.1.60 does not.
Impact
This breaks release automation for anyone using PSR with an unpinned or loosely-pinned GitPython — several independent reports of the identical error surfaced within minutes of the GitPython release going out, all converging on the same workaround (pinning gitpython<3.1.60), e.g.:
Suggested fix
Stop depending on the removed Actor.name_email_regex (it was apparently never a stable/documented part of GitPython's public API, since it was removed rather than deprecated). A regex-based validation of "name <email>" could be inlined into PSR directly rather than reaching into GitPython's internals, or PSR could rely on Actor._from_string/Actor(...) construction to validate instead.
Workaround (in the meantime)
Pin gitpython<3.1.60 alongside python-semantic-release until this is fixed.
Environment
python-semantic-release==10.6.1 (latest at time of filing)gitpython==3.1.60
Summary
GitPython 3.1.60(published 2026-08-25 18:33 UTC) removed theActor.name_email_regexclass attribute as part of a security hardening fix (gitpython-developers/GitPython#2215, replacing backtracking-regex identity parsing to close GHSA-v6xg-m7rh-r365 and GHSA-g5vv-9gxw-82hx).semantic_release/cli/config.pycallsActor.name_email_regex.match(...)directly when validating the configured commit author (commit_author), so any environment that resolves togitpython>=3.1.60now crashes on every invocation:Since PSR's own constraint is
gitpython~=3.0, this affects every version — a freshpip install python-semantic-releasetoday resolvesgitpython==3.1.60and breaks immediately, with no code change on the caller's part. Confirmed via bisection:3.1.59still has the attribute,3.1.60does not.Impact
This breaks release automation for anyone using PSR with an unpinned or loosely-pinned GitPython — several independent reports of the identical error surfaced within minutes of the GitPython release going out, all converging on the same workaround (pinning
gitpython<3.1.60), e.g.:Suggested fix
Stop depending on the removed
Actor.name_email_regex(it was apparently never a stable/documented part of GitPython's public API, since it was removed rather than deprecated). A regex-based validation of"name <email>"could be inlined into PSR directly rather than reaching into GitPython's internals, or PSR could rely onActor._from_string/Actor(...)construction to validate instead.Workaround (in the meantime)
Pin
gitpython<3.1.60alongsidepython-semantic-releaseuntil this is fixed.Environment
python-semantic-release==10.6.1(latest at time of filing)gitpython==3.1.60