From 7fb975059fec0b2aaa019f780590f48c605588b6 Mon Sep 17 00:00:00 2001
From: Muhammad Naufal Mahdi <053792227@ecampus.ut.ac.id>
Date: Mon, 10 Aug 2026 19:27:14 +0700
Subject: [PATCH] Pin GitPython>=3.1.58 to resolve GHSA-9rj7-rf2p-w77r,
 GHSA-wvpp-8hx9-p66j

GHSA-9rj7-rf2p-w77r: Unguarded git option forwarding in Repo.init
enables arbitrary command execution via --template clone hooks
(CVE pending, HIGH severity)

GHSA-wvpp-8hx9-p66j: Unsafe git option guard bypass via
split_single_char_options=False short-option token smuggling
enables command execution (HIGH severity, CVSS 8.8)

Both fixed in GitPython 3.1.58. This pins the minimum
version in tools_requirements.txt to ensure installs resolve
to a patched release.

No application logic changes.
---
 tools_requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools_requirements.txt b/tools_requirements.txt
index be36803..b6dec4f 100644
--- a/tools_requirements.txt
+++ b/tools_requirements.txt
@@ -1,4 +1,4 @@
-GitPython
+GitPython>=3.1.58
 httpx
 tabulate
 zc.lockfile