Update dependency GitPython to v3.1.37 [SECURITY] - autoclosed
Metadata
Current evaluation
Renovate's GitPython 3.1.30-to-3.1.37 security update was autoclosed unmerged; no reviews, comments, or CI checks ran, and no imagecraft resolving commit was found.
Resolution: closed stale
Reason: PR #2 was abandoned when Renovate autoclosed it, with zero reviews, zero comments, and no CI activity. Repository history shows no merge or resolving commit for the GitPython bump.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [GitPython](https://togithub.com/gitpython-developers/GitPython) | `==3.1.30` -> `==3.1.37` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2023-40267](https://nvd.nist.gov/vuln/detail/CVE-2023-40267)
GitPython before 3.1.32 does not block insecure non-multi options in `clone` and `clone_from`, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
#### [CVE-2023-41040](https://togithub.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c)
### Summary
In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system.
### Details
This vulnerability is present in
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175
That code joins the base directory with a user given string without checking if the final path is located outside the base directory.
I was able to exploit it from three places, but there may be more code paths that lead to it:
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L605
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L620
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/index/base.py#L1353
### PoC
Running GitPython within any repo should work, here is an example with the GitPython repo.
```python
import git
r = git.Repo(".")
# This will make GitPython read the README.md file from the root of the repo
r.commit("../README.md")
r.tree("../README.md")
r.index.diff("../README.md")
# Reading /etc/random
# WARNING: this will probably halt your system, run with caution
# r.commit("../../../../../../../../../dev/random")
```
### Impact
I wasn't able to show the contents of the files (that's why "blind" local file inclusion), depending on how GitPython is being used, this can be used by an attacker for something _inoffensive_ as checking if a file exits, or cause a DoS by making GitPython read a big/infinite file (like `/dev/random` on Linux systems).
### Possible solutions
A solution would be to check that the final path isn't located outside the `repodir` path (maybe even after resolving symlinks). Maybe there could be other checks in place to make sure that the reference names are valid.
---
> [!NOTE]
> This vulnerability was reported via email, and it was decided to publish it here and make it public, so the community is aware of it, and a fix can be provided.
---
### Release Notes
<details>
<summary>gitpython-developers/GitPython (GitPython)</summary>
### [`v3.1.37`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.37): - a proper fix CVE-2023-41040
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.36...3.1.37)
#### What's Changed
- Improve Python version and OS compatibility, fixing deprecations by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1654](https://togithub.com/gitpython-developers/GitPython/pull/1654)
- Better document env_case test/fixture and cwd by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1657](https://togithub.com/gitpython-developers/GitPython/pull/1657)
- Remove spurious executable permissions by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1658](https://togithub.com/gitpython-developers/GitPython/pull/1658)
- Fix up checks in Makefile and make them portable by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1661](https://togithub.com/gitpython-developers/GitPython/pull/1661)
- Fix URLs that were redirecting to another license by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1662](https://togithub.com/gitpython-developers/GitPython/pull/1662)
- Assorted small fixes/improvements to root dir docs by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1663](https://togithub.com/gitpython-developers/GitPython/pull/1663)
- Use venv instead of virtualenv in test_installation by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1664](https://togithub.com/gitpython-developers/GitPython/pull/1664)
- Omit py_modules in setup by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1665](https://togithub.com/gitpython-developers/GitPython/pull/1665)
- Don't track code coverage temporary files by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1666](https://togithub.com/gitpython-developers/GitPython/pull/1666)
- Configure tox by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1667](https://togithub.com/gitpython-developers/GitPython/pull/1667)
- Format tests with black and auto-exclude untracked paths by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1668](https://togithub.com/gitpython-developers/GitPython/pull/1668)
- Upgrade and broaden flake8, fixing style problems and bugs by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1673](https://togithub.com/gitpython-developers/GitPython/pull/1673)
- Fix rollback bug in SymbolicReference.set_reference by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1675](https://togithub.com/gitpython-developers/GitPython/pull/1675)
- Remove `@NoEffect` annotations by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1677](https://togithub.com/gitpython-developers/GitPython/pull/1677)
- Add more checks for the validity of refnames by [@​facutuesca](https://togithub.com/facutuesca) in [https://github.com/gitpython-developers/GitPython/pull/1672](https://togithub.com/gitpython-developers/GitPython/pull/1672)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.36...3.1.37
### [`v3.1.36`](https://togithub.com/gitpython-developers/GitPython/compare/3.1.35...3.1.36)
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.35...3.1.36)
### [`v3.1.35`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.35): - a fix for CVE-2023-41040
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.34...3.1.35)
#### What's Changed
- Bump actions/checkout from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/gitpython-developers/GitPython/pull/1643](https://togithub.com/gitpython-developers/GitPython/pull/1643)
- Fix 'Tree' object has no attribute '\_name' when submodule path is normal path by [@​CosmosAtlas](https://togithub.com/CosmosAtlas) in [https://github.com/gitpython-developers/GitPython/pull/1645](https://togithub.com/gitpython-developers/GitPython/pull/1645)
- Fix CVE-2023-41040 by [@​facutuesca](https://togithub.com/facutuesca) in [https://github.com/gitpython-developers/GitPython/pull/1644](https://togithub.com/gitpython-developers/GitPython/pull/1644)
- Only make config more permissive in tests that need it by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1648](https://togithub.com/gitpython-developers/GitPython/pull/1648)
- Added test for PR [#​1645](https://togithub.com/gitpython-developers/GitPython/issues/1645) submodule path by [@​CosmosAtlas](https://togithub.com/CosmosAtlas) in [https://github.com/gitpython-developers/GitPython/pull/1647](https://togithub.com/gitpython-developers/GitPython/pull/1647)
- Fix Windows environment variable upcasing bug by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1650](https://togithub.com/gitpython-developers/GitPython/pull/1650)
#### New Contributors
- [@​CosmosAtlas](https://togithub.com/CosmosAtlas) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1645](https://togithub.com/gitpython-developers/GitPython/pull/1645)
- [@​facutuesca](https://togithub.com/facutuesca) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1644](https://togithub.com/gitpython-developers/GitPython/pull/1644)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.34...3.1.35
### [`v3.1.34`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.34): - fix resource leaking
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.33...3.1.34)
#### What's Changed
- util: close lockfile after opening successfully by [@​skshetry](https://togithub.com/skshetry) in [https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)
#### New Contributors
- [@​skshetry](https://togithub.com/skshetry) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.33...3.1.34
### [`v3.1.33`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.33): - with security fix
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.32...3.1.33)
##### What's Changed
- WIP Quick doc by [@​LeoDaCoda](https://togithub.com/LeoDaCoda) in [https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)
- Partial clean up wrt mypy and black by [@​bodograumann](https://togithub.com/bodograumann) in [https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)
- Disable merge_includes in config writers by [@​bodograumann](https://togithub.com/bodograumann) in [https://github.com/gitpython-developers/GitPython/pull/1618](https://togithub.com/gitpython-developers/GitPython/pull/1618)
- feat: full typing for "progress" parameter in Repo class by [@​madebylydia](https://togithub.com/madebylydia) in [https://github.com/gitpython-developers/GitPython/pull/1634](https://togithub.com/gitpython-developers/GitPython/pull/1634)
- Fix CVE-2023-40590 by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)
- [#​1566](https://togithub.com/gitpython-developers/GitPython/issues/1566) Creating a lock now uses python built-in "open()" method to work arou… by [@​HageMaster3108](https://togithub.com/HageMaster3108) in [https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)
##### New Contributors
- [@​LeoDaCoda](https://togithub.com/LeoDaCoda) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)
- [@​bodograumann](https://togithub.com/bodograumann) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)
- [@​EliahKagan](https://togithub.com/EliahKagan) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)
- [@​HageMaster3108](https://togithub.com/HageMaster3108) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.32...3.1.33
### [`v3.1.32`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.32): - with another security update
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32)
#### What's Changed
- Bump cygwin/cygwin-install-action from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/gitpython-developers/GitPython/pull/1572](https://togithub.com/gitpython-developers/GitPython/pull/1572)
- Fix up the commit trailers functionality by [@​itsluketwist](https://togithub.com/itsluketwist) in [https://github.com/gitpython-developers/GitPython/pull/1576](https://togithub.com/gitpython-developers/GitPython/pull/1576)
- Name top-level exceptions as private variables by [@​Hawk777](https://togithub.com/Hawk777) in [https://github.com/gitpython-developers/GitPython/pull/1590](https://togithub.com/gitpython-developers/GitPython/pull/1590)
- fix pypi long description by [@​eUgEntOptIc44](https://togithub.com/eUgEntOptIc44) in [https://github.com/gitpython-developers/GitPython/pull/1603](https://togithub.com/gitpython-developers/GitPython/pull/1603)
- Don't rely on **del** by [@​r-darwish](https://togithub.com/r-darwish) in [https://github.com/gitpython-developers/GitPython/pull/1606](https://togithub.com/gitpython-developers/GitPython/pull/1606)
- Block insecure non-multi options in clone/clone_from by [@​Beuc](https://togithub.com/Beuc) in [https://github.com/gitpython-developers/GitPython/pull/1609](https://togithub.com/gitpython-developers/GitPython/pull/1609)
#### New Contributors
- [@​Hawk777](https://togithub.com/Hawk777) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1590](https://togithub.com/gitpython-developers/GitPython/pull/1590)
- [@​eUgEntOptIc44](https://togithub.com/eUgEntOptIc44) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1603](https://togithub.com/gitpython-developers/GitPython/pull/1603)
- [@​r-darwish](https://togithub.com/r-darwish) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1606](https://togithub.com/gitpython-developers/GitPython/pull/1606)
- [@​Beuc](https://togithub.com/Beuc) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1609](https://togithub.com/gitpython-developers/GitPython/pull/1609)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32
### [`v3.1.31`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.31)
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31)
#### What's Changed
- Fix Sphinx rendering errors by [@​stephan-cr](https://togithub.com/stephan-cr) in [https://github.com/gitpython-developers/GitPython/pull/1524](https://togithub.com/gitpython-developers/GitPython/pull/1524)
- tests: Use `command -v` instead of third-party `which` program by [@​mgorny](https://togithub.com/mgorny) in [https://github.com/gitpython-developers/GitPython/pull/1525](https://togithub.com/gitpython-developers/GitPython/pull/1525)
- fix/add allow_unsafe_\* params in docstrings + fix typo by [@​obfusk](https://togithub.com/obfusk) in [https://github.com/gitpython-developers/GitPython/pull/1530](https://togithub.com/gitpython-developers/GitPython/pull/1530)
- use tempfile.TemporaryDirectory & fix clone_from_unsafe_protocol tests by [@​obfusk](https://togithub.com/obfusk) in [https://github.com/gitpython-developers/GitPython/pull/1531](https://togithub.com/gitpython-developers/GitPython/pull/1531)
- Fix some resource leaks by open file handles by [@​marlamb](https://togithub.com/marlamb) in [https://github.com/gitpython-developers/GitPython/pull/1532](https://togithub.com/gitpython-developers/GitPython/pull/1532)
- fix files list on file rename by [@​teknoraver](https://togithub.com/teknoraver) in [https://github.com/gitpython-developers/GitPython/pull/1537](https://togithub.com/gitpython-developers/GitPython/pull/1537)
- Declare support for Python 3.11 by [@​hugovk](https://togithub.com/hugovk) in [https://github.com/gitpython-developers/GitPython/pull/1541](https://togithub.com/gitpython-developers/GitPython/pull/1541)
- Fix ignored by [@​Lightborne](https://togithub.com/Lightborne) in [https://github.com/gitpython-developers/GitPython/pull/1545](https://togithub.com/gitpython-developers/GitPython/pull/1545)
- Fix timezone parsing functions for non-hour timezones by [@​jcowgill](https://togithub.com/jcowgill) in [https://github.com/gitpython-developers/GitPython/pull/1547](https://togithub.com/gitpython-developers/GitPython/pull/1547)
- Enable user to override default diff -M arg by [@​mellowed100](https://togithub.com/mellowed100) in [https://github.com/gitpython-developers/GitPython/pull/1551](https://togithub.com/gitpython-developers/GitPython/pull/1551)
- Remove optional from two member variables by [@​Sineaggi](https://togithub.com/Sineaggi) in [https://github.com/gitpython-developers/GitPython/pull/1550](https://togithub.com/gitpython-developers/GitPython/pull/1550)
- Fix RecursionError when iterating streams by [@​eric-wieser](https://togithub.com/eric-wieser) in [https://github.com/gitpython-developers/GitPython/pull/1554](https://togithub.com/gitpython-developers/GitPython/pull/1554)
- Fix get_values() so it correctly loads section names by [@​Codym48](https://togithub.com/Codym48) in [https://github.com/gitpython-developers/GitPython/pull/1555](https://togithub.com/gitpython-developers/GitPython/pull/1555)
#### New Contributors
- [@​stephan-cr](https://togithub.com/stephan-cr) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1524](https://togithub.com/gitpython-developers/GitPython/pull/1524)
- [@​obfusk](https://togithub.com/obfusk) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1530](https://togithub.com/gitpython-developers/GitPython/pull/1530)
- [@​marlamb](https://togithub.com/marlamb) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1532](https://togithub.com/gitpython-developers/GitPython/pull/1532)
- [@​teknoraver](https://togithub.com/teknoraver) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1537](https://togithub.com/gitpython-developers/GitPython/pull/1537)
- [@​Lightborne](https://togithub.com/Lightborne) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1545](https://togithub.com/gitpython-developers/GitPython/pull/1545)
- [@​jcowgill](https://togithub.com/jcowgill) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1547](https://togithub.com/gitpython-developers/GitPython/pull/1547)
- [@​mellowed100](https://togithub.com/mellowed100) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1551](https://togithub.com/gitpython-developers/GitPython/pull/1551)
- [@​Sineaggi](https://togithub.com/Sineaggi) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1550](https://togithub.com/gitpython-developers/GitPython/pull/1550)
- [@​Codym48](https://togithub.com/Codym48) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1555](https://togithub.com/gitpython-developers/GitPython/pull/1555)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/imagecraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44Ny4yIiwidXBkYXRlZEluVmVyIjoiMzcuODcuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate's GitPython 3.1.30-to-3.1.37 security update was autoclosed unmerged; no reviews, comments, or CI checks ran, and no imagecraft resolving commit was found. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate's GitPython 3.1.37 security update was autoclosed unmerged after 1,001 days without activity; no reviews, comments, or CI checks occurred. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed the unmerged GitPython 3.1.30-to-3.1.37 security update after prolonged inactivity; no reviews, comments, or CI checks occurred. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed the unmerged GitPython 3.1.30→3.1.37 security update; no reviews, comments, or CI ran, and the proposed change was abandoned. | |
| qwen/qwen3.6-35b-a3b | — | — | Automatically closed by Renovate after proposing GitPython v3.1.37 to fix CVE-2023-40267 and CVE-2023-41040. With zero reviews or CI checks, the update was superseded or resolved through an alternative channel. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The GitPython security update to v3.1.37 was automatically closed by Renovate, superseded by a newer dependency update. No manual merge occurred. |
Update history
No update history recorded yet.
Related work
-
Related To:
GitPython#1644
(confidence 100%)
Upstream fix for CVE-2023-41040 cited by the proposed upgrade; it did not resolve imagecraft#2.
-
Related To:
GitPython#1672
(confidence 100%)
Upstream refname-validation follow-up included in GitPython 3.1.37; it was not merged through imagecraft#2.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #17 Bump gitpython from 3.1.30 to 3.1.37 | imagecraft | closed | Dependabot’s GitPython 3.1.30-to-3.1.37 bump was closed unmerged because GitPython was no longer an Imagecraft dependency. | |
| #10 Update dependency Pygments to v2.15.0 [SECURITY] - autoclosed | imagecraft | closed | Renovate's Pygments 2.15.0 security bump for CVE-2022-40896 was autoclosed unmerged after receiving no reviews or CI, with no resolving commit recorded. | |
| #371 build(deps): update dependency python to 3.13 - autoclosed | starbase | closed | Python 3.13 update #371 was autoclosed unmerged after 10 days without review or CI, and no resolving commit was found. | |
| #20 Update dependency paramiko to v3 [SECURITY] - autoclosed | imagecraft | closed | Renovate PR updating Paramiko 2.12.0 to 3.4.0 was autoclosed after prolonged inactivity and was never merged. |