chore(deps): update dependency gitpython to v3.1.58

[elastic-renovate-prod]

This PR contains the following updates:

Package	Change	Age	Confidence
gitpython	==3.1.49 → ==3.1.58

---

Release Notes

gitpython-developers/GitPython (gitpython)

v3.1.58: Security and Fixes

Compare Source

What's Changed

• test: allow Python startup before timeout by @​Byron in #​2195
• Resolve Windows hook Bash through PATH by @​Byron in #​2199
• Revert "Resolve Windows hook Bash through PATH" by @​Byron in #​2200
• test: focus pytest summary on unexpected failures by @​raisulchowdhury in #​2203
• Validate submodule names before filesystem operations by @​Byron in #​2202
• Handle invalid submodule names during recursive updates by @​Byron in #​2205
• Fix Windows path handling on Python 3.13+ by @​Byron in #​2196
• fixup 2202 by @​Byron in #​2206
• Correct Windows hook Bash precedence by @​Byron in #​2201
• Harden config and Git option validation by @​Byron in #​2204
• Skip tests that need symlink privileges instead of erroring by @​Cyrus580529 in #​2197

New Contributors

• @​raisulchowdhury made their first contribution in #​2203
• @​Cyrus580529 made their first contribution in #​2197

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

v3.1.57: - Security and Fixes

Compare Source

What's Changed

• Merge gitdb and smmap into the GitPython repository by @​Byron in #​2179
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​2185
• build(deps): bump the pre-commit group with 2 updates by @​dependabot[bot] in #​2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​2124
• Render protected Traversable methods in the reference by @​pick7 in #​2192
• Use standard prefixes for parsed patch diffs by @​pick7 in #​2191
• Honor kill_after_timeout with output streams by @​pick7 in #​2189
• Redact Authorization extra headers from command errors by @​pick7 in #​2188
• Improve RemoteProgress parse return typing by @​pick7 in #​2187
• Adopt basedpyright with a legacy baseline by @​Byron in #​2194
• Block unsafe Git file and URL options by @​Byron in #​2193

New Contributors

• @​pick7 made their first contribution in #​2192

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

v3.1.56: - SECURITY

Compare Source

What's Changed

• Add support for Python 3.15 by @​hugovk in #​2183
• fix: reject unsafe output options in Commit.count by @​Byron in #​2184

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

v3.1.55: - Security

Compare Source

What's Changed

• fix: prevent environment expansion in remote URLs by @​Byron in #​2181

Full Changelog: gitpython-developers/GitPython@3.1.54...3.1.55

v3.1.54: - Security

Compare Source

What's Changed

• Harden unsafe Git option validation by @​Byron in #​2180

Full Changelog: gitpython-developers/GitPython@3.1.53...3.1.54

v3.1.53: - Security

Compare Source

What's Changed

• feat(submodule): add deinit method to Submodule (#​2014) by @​mvanhorn in #​2129
• typing: introduce sensible basedpyright defaults by @​Byron in #​2174
• fix: make submodule.update() after submodule.deinit() work by @​Byron in #​2175
• Fix commit hooks respecting core.hooksPath by @​Siesta0217 in #​2159
• fix: validate config section delimiters by @​Byron in #​2176

New Contributors

• @​Siesta0217 made their first contribution in #​2159

Full Changelog: gitpython-developers/GitPython@3.1.52...3.1.53

v3.1.52: Security

Compare Source

GHSA-rwj8-pgh3-r573: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

What's Changed

• Skip cross-drive relative config test on Windows by @​Byron in #​2171
• fix: preserve literal clone URLs by @​Byron in #​2172

Full Changelog: gitpython-developers/GitPython@3.1.51...3.1.52

v3.1.51: - Security

Compare Source

What's Changed

• Add AI-disclosure and quality requirements to the contribution guidelines by @​Byron in #​2143
• docs(cmd): clarify Git.execute() string vs list command argument by @​mvanhorn in #​2144
• Rewrite Git.execute() command parameter docstring per #​2146 by @​EliahKagan in #​2147
• Document init script behavior with multiple master remotes by @​EliahKagan in #​2148
• Bump git/ext/gitdb from 335c0f6 to 0a019a2 by @​dependabot[bot] in #​2149
• Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by @​elovelan in #​2151
• Defer xfail condition evaluation with xfail_if_raises context manager by @​elovelan in #​2153
• Run more submodule tests on Cygwin (fix flaky xfails) by @​EliahKagan in #​2154
• Cut xtrace noise from POSIX-ownership diagnostic steps by @​EliahKagan in #​2156
• Support index diffs against the empty tree by @​puneetdixit200 in #​2155
• refactor: seperate out Progress type by @​LoeschMaximilian in #​2157
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.12 to 0.15.15 in the pre-commit group by @​dependabot[bot] in #​2160
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2164
• Bump git/ext/gitdb from 0a019a2 to 4950ea9 by @​dependabot[bot] in #​2165
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.15 to 0.15.20 in the pre-commit group by @​dependabot[bot] in #​2166
• Add Commit.is_shallow property; document stats() limitation at shallow boundary by @​harshitayadavv in #​2167
• Allow relative config paths with includes by @​Byron in #​2169
• Reject abbreviated forms of unsafe git options by @​Byron in #​2168
• guard unsafe git command options by @​Byron in #​2163

New Contributors

• @​elovelan made their first contribution in #​2151
• @​puneetdixit200 made their first contribution in #​2155
• @​LoeschMaximilian made their first contribution in #​2157
• @​harshitayadavv made their first contribution in #​2167

Full Changelog: gitpython-developers/GitPython@3.1.50...3.1.51

v3.1.50

Compare Source

What's Changed

• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.8 to 0.15.12 in the pre-commit group by @​dependabot[bot] in #​2140
• Bump git/ext/gitdb from 335c0f6 to 53c94d6 by @​dependabot[bot] in #​2141
• Fix Repo() autodiscovery in linked worktrees when GIT_DIR is set by @​meliezer in #​2128
• Validate config key names before writing by @​Byron in #​2142

New Contributors

• @​meliezer made their first contribution in #​2128

Full Changelog: gitpython-developers/GitPython@3.1.49...3.1.50

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[github-actions]

ECS PR Triage (automated)

PR Triage Report

PR: #2641 — chore(deps): update dependency gitpython to v3.1.50
Classification: Direct PR
Change type: Tooling
Scope: Minor

Summary

Automated Renovate bot PR that bumps the gitpython Python dependency from 3.1.49 to 3.1.50 (patch release) in scripts/requirements.txt. This is a routine, low-risk dependency update with no functional changes to ECS schemas, tooling logic, or documentation. It is clearly a Direct PR per classification-rules §2 ("Tooling only").

Files changed

• Schemas: none
• Generated: none
• Tooling/scripts/tests: scripts/requirements.txt (patch version bump: gitpython==3.1.49 → gitpython==3.1.50)
• Docs (hand-authored): none
• CI / GitHub: none
• RFCs: none

Routing decision

Direct PR — This change is a single-line patch version bump of a Python dependency used by the ECS generator tooling. It falls squarely under classification-rules §2 ("Tooling only — scripts/, generator templates, tests, Makefile"). No schema files are touched, no new fields are introduced, and no breaking changes or semantic shifts are present. No RFC or maintainer discussion is needed.

Risk notes

• Breaking / deprecation: No. Patch version bump only; gitpython 3.1.50 is a minor maintenance release.
• OTel / semconv: N/A — no schema or field changes.
• Scope / reuse: N/A — no fieldset, reuse, or categorization changes.

Completeness checklist

• PR description (all sections) — Missing. The PR uses the Renovate bot auto-generated template rather than the ECS PR template's 7 sections. This is standard and expected for automated dependency bumps; not a blocker.
• CHANGELOG.next.md — Missing. Since scripts/requirements.txt is under scripts/, a changelog entry under "Tooling and Artifact Changes" is technically expected per completeness rules. However, for a routine patch dependency bump with no functional change, this is low priority and at maintainer discretion.
• make + committed generated outputs — N/A. No schema changes; no regeneration needed.
• OTel otel: on new/changed semconv-related fields — N/A. No field changes.
• Tests / make check — Should be verified by CI. The dependency bump should not break tests, but CI confirmation is recommended.
• CLA (contributor) — N/A. Author is the Renovate bot (elastic-renovate-prod), an Elastic-managed automation account.

Recommended next actions

1. Verify CI passes — Confirm that make check and any CI workflows succeed with gitpython==3.1.50. This is the primary gate for this type of PR.
2. Optionally add a CHANGELOG.next.md entry — A one-line entry under "Tooling and Artifact Changes > Dependencies" could be added (e.g., "Bump gitpython to 3.1.50. chore(deps): update dependency gitpython to v3.1.58 #2641"), but this is at maintainer discretion for a patch dependency bump.
3. Merge when CI is green — No further review complexity; safe to merge once CI confirms compatibility.

---

Posted by PR Triage workflow