Possible fix(deps): gitpython 3.1.54 → 3.1.59 (CVE-2026-78676) in poetry.lock

Spotted what might be an issue in `poetry.lock` around line 1.

CRITICAL vulnerability (CVE-2026-78676) in GitPython 3.1.54, declared in poetry.lock. GitPython fails to safely re-serialize multi-line git-config values during write operations: a value that was safely quoted and inert becomes corrupted on the next unrelated config write, and embedded newlines are re-interpreted as live git directives. An attacker who can influence any git config content the application reads or writes (e.g., a malicious repository's .git/config, a crafted submodule, or user-supplied config values persisted by the app) can plant a dormant multi-line value that later activates as core.hooksPath. Once active, any subsequent git operation that triggers hooks executes the attacker's binary, yielding arbitrary code execution in the application or CI/CD runner context. Risk: CRITICAL — direct RCE primitive, especially dangerous in CI pipelines and services that clone or manage untrusted repositories. Remediation: upgrade GitPython to >= 3.1.59, regenerate the lock file to keep integrity hashes valid, and verify no user-controlled input flows into git config write paths in the interim.

Something like this might fix it:

```diff
Recommended: regenerate the lock file so Poetry resolves and hashes the fixed version (do not hand-edit hashes):

$ poetry update gitpython

Resulting change in poetry.lock:

--- a/poetry.lock
+++ b/poetry.lock
@@
[[package]]
name = "gitpython"
-version = "3.1.54"
+version = "3.1.59"
description = "GitPython is a Python library used to interact with Git repositories"
optional = false
python-versions = ">=3.7"
files = [
- {file = "GitPython-3.1.54-py3-none-any.whl", hash = "sha256:"},
- {file = "GitPython-3.1.54.tar.gz", hash = "sha256:"},
+ {file = "GitPython-3.1.59-py3-none-any.whl", hash = "sha256:"},
+ {file = "GitPython-3.1.59.tar.gz", hash = "sha256:"},
]

Also enforce the fixed version in pyproject.toml to prevent regression:

--- a/pyproject.toml
+++ b/pyproject.toml
@@
-gitpython = "3.1.54"
+gitpython = ">=3.1.59,<4"

After updating, run `poetry lock && poetry install` (or `poetry update gitpython && poetry install`) and commit both poetry.lock and pyproject.toml so CI builds against the patched version.
```

For reference: rule `CVE-2026-78676`. Rated critical.

I may be wrong about this one — closing it costs you nothing if so.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Inizia dalle voci GitPython in pyproject.toml e poetry.lock, quindi esegui `poetry update gitpython` per risolvere la versione fissata e rigenerare gli hash di integrità. Esegui `poetry lock && poetry install` o i comandi equivalenti dell’issue e verifica che entrambi i file vengano sottoposti correttamente a commit con GitPython almeno alla versione 3.1.59.

Scritto dal modello di indicizzazione a partire dal testo della issue.