Bump GitPython pin from 3.1.50 to ==3.1.54 (multiple fixed CVEs)

[neilissac]

Summary

pyproject.toml pins GitPython==3.1.50. Several vulnerabilities affecting this version have since been patched upstream; 3.1.54 (latest release) includes fixes for all of them.

Current pin

"GitPython==3.1.50",
(pyproject.toml, [project.dependencies])

Vulnerabilities fixed since 3.1.50

Advisory	Description	Affected	Fixed in
GHSA-rwj8-pgh3-r573	Repo.clone_from() expands env vars ($VAR/${VAR}) in the supplied URL via os.path.expandvars(), allowing exfiltration of host environment variables to an attacker-controlled remote	<= 3.1.51	3.1.52
GHSA-956x-8gvw-wg5v	Argument-injection via unguarded Git options in Repo.archive() / git.ls_remote(), plus arbitrary file overwrite via Repo.iter_commits() / Repo.blame()	< 3.1.51	3.1.51
GHSA-2f96-g7mh-g2hx	Command injection via abbreviated-long-option / joined-short-option bypass of the CVE-2026-42215 unsafe-option blocklist	< 3.1.51	3.1.51
GHSA-v396-v7q4-x2qj	Unsafe clone-option gate bypass via joined short options (e.g. -u<helper>) in Repo.clone_from(..., multi_options=...)	3.1.50 only	3.1.51

3.1.53 also ships a further, unrelated security fix (GHSA-3rp5-jjmw-4wv2).

Suggested fix

"GitPython==3.1.54",

...and regenerate the lockfiles so they stay in sync:
hatch run lock-dependencies
hatch run sync-dependencies

[andreapeterson]

Hi @neilissac , are you planning to submit a PR for this? If not, I’d be happy to take it. I’ll update the GitPython pin, regenerate the lockfiles, run the test suite, and submit a PR.

[sfc-gh-jwilkowski]

Hey @neilissac thanks for reporting! I'll upgrade GitPython to 3.1.57 which ships a couple more patches. A new release of snowflake-cli should be out today/tomorrow

[sfc-gh-jwilkowski]

Fixed in 40e53bb