chore(deps): update dependency gitpython to v3.2.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
GitPython	==3.1.57 → ==3.2.0

---

Release Notes

gitpython-developers/GitPython (GitPython)

v3.2.0: - Security

Compare Source

What's Changed

• test: cover subdirectory discovery and pathspec commands in bare-repository worktrees by @​christianvuerings in #​2228
• Read git's yes/no and on/off booleans in get_value by @​rawsun007 in #​2229
• Clarify detached HEAD access and isolate test branch state by @​Byron in #​2231
• Reject submodule move destinations through intermediate symlinks by @​Byron in #​2232
• fix: validate checkout positional reference options by @​Byron in #​2233
• Fix timeout child-process lookup on non-GNU systems by @​aprylewu in #​2236
• Preserve implicit boolean config keys by @​Byron in #​2238
• Reject comments after implicit boolean config keys by @​Byron in #​2239
• Fix case-insensitive Git config name matching by @​Byron in #​2241
• Move project metadata to pyproject.toml by @​mwtoews in #​2242
• Move [doc] extra to a PEP 735 dependency group; add uv-sync CI check by @​mwtoews in #​2243
• fix: strip inline config comments the way git does by @​rawsun007 in #​2245
• Drop Python 3.7 by @​mwtoews in #​2246
• fix: preserve positional operands in high-level Git commands by @​Byron in #​2247
• submodule: option to update without fetching by @​jeffro256 in #​2244
• bump minor version to indicate drop of python 3.7 support by @​Byron in #​2248
• fix: skip a UTF-8 BOM when reading config files by @​geek-alpha in #​2249
• fix: complete safety checks in Git command wrappers by @​Byron in #​2251
• build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 by @​dependabot[bot] in #​2252
• fix: bound actor and date parsing by @​Byron in #​2253
• fix(repo): preserve literal separate Git directory paths by @​Byron in #​2255
• fix: validate object types when loading binary SHAs by @​Byron in #​2256
• fix(commit): bound co_authors trailer parsing by @​Keerthana-64 in #​2257
• various fixes by @​Byron in #​2258
• fix(config): bound option-line parsing by @​radhika1314 in #​2259

New Contributors

• @​christianvuerings made their first contribution in #​2228
• @​rawsun007 made their first contribution in #​2229
• @​aprylewu made their first contribution in #​2236
• @​mwtoews made their first contribution in #​2242
• @​jeffro256 made their first contribution in #​2244
• @​geek-alpha made their first contribution in #​2249
• @​Keerthana-64 made their first contribution in #​2257
• @​radhika1314 made their first contribution in #​2259

Full Changelog: gitpython-developers/GitPython@3.1.62...3.2.0

v3.1.62

Compare Source

What's Changed

• prepare next release by @​Byron in #​2222
• Keep bare-repository worktrees non-bare by @​Byron in #​2224
• Reject unsafe submodule checkout paths by @​Byron in #​2225
• build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group by @​dependabot[bot] in #​2226
• fix: join backslash line continuations when reading config values by @​nkbeast in #​2227

New Contributors

• @​nkbeast made their first contribution in #​2227

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

v3.1.61

Compare Source

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

• Fix repository discovery precedence by @​Byron in #​2218
• fix: wait for git daemon to listen before connecting by @​Vogtinator in #​2219
• fix: restore Actor.name_email_regex by @​Byron in #​2221

New Contributors

• @​Vogtinator made their first contribution in #​2219

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

v3.1.60: Security

Compare Source

What's Changed

• prepare changelog prior to release by @​Byron in #​2212
• Preserve Git config escape semantics by @​Byron in #​2213
• Harden diff path and actor identity parsing by @​Byron in #​2215
• Require explicit opt-in for filesystem diffs by @​Byron in #​2217

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

v3.1.59: - Security

Compare Source

What's Changed

• prepare changelog for upcoming release by @​Byron in #​2207
• Block file-reading Git options by @​Byron in #​2208
• index: write blobs via git hash-object, not gitdb's odb.store by @​caroescm in #​2209
• Block separate git directories during clone by @​Byron in #​2210
• fix: harden config parsing boundaries by @​Byron in #​2211
• repo.index.add() now respects worktree filters #​2209

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

v3.1.58: Security and Fixes

Compare Source

What's Changed

• test: allow Python startup before timeout by @​Byron in #​2195
• Resolve Windows hook Bash through PATH by @​Byron in #​2199
• Revert "Resolve Windows hook Bash through PATH" by @​Byron in #​2200
• test: focus pytest summary on unexpected failures by @​raisulchowdhury in #​2203
• Validate submodule names before filesystem operations by @​Byron in #​2202
• Handle invalid submodule names during recursive updates by @​Byron in #​2205
• Fix Windows path handling on Python 3.13+ by @​Byron in #​2196
• fixup 2202 by @​Byron in #​2206
• Correct Windows hook Bash precedence by @​Byron in #​2201
• Harden config and Git option validation by @​Byron in #​2204
• Skip tests that need symlink privileges instead of erroring by @​Cyrus580529 in #​2197

New Contributors

• @​raisulchowdhury made their first contribution in #​2203
• @​Cyrus580529 made their first contribution in #​2197

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ca608b59-4579-44ac-85d2-db4b26fdcedd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}