chore(deps): bump the python-minor-and-patch group across 1 directory with 2 updates

[dependabot]

Bumps the python-minor-and-patch group with 2 updates in the / directory: gitpython and bleach.

Updates gitpython from 3.1.54 to 3.1.57

Release notes

Sourced from gitpython's releases.

3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @​Byron in gitpython-developers/GitPython#2179
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in gitpython-developers/GitPython#2185
• build(deps): bump the pre-commit group with 2 updates by @​dependabot[bot] in gitpython-developers/GitPython#2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @​dependabot[bot] in gitpython-developers/GitPython#2124
• Render protected Traversable methods in the reference by @​pick7 in gitpython-developers/GitPython#2192
• Use standard prefixes for parsed patch diffs by @​pick7 in gitpython-developers/GitPython#2191
• Honor kill_after_timeout with output streams by @​pick7 in gitpython-developers/GitPython#2189
• Redact Authorization extra headers from command errors by @​pick7 in gitpython-developers/GitPython#2188
• Improve RemoteProgress parse return typing by @​pick7 in gitpython-developers/GitPython#2187
• Adopt basedpyright with a legacy baseline by @​Byron in gitpython-developers/GitPython#2194
• Block unsafe Git file and URL options by @​Byron in gitpython-developers/GitPython#2193

New Contributors

• @​pick7 made their first contribution in gitpython-developers/GitPython#2192

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

• Add support for Python 3.15 by @​hugovk in gitpython-developers/GitPython#2183
• fix: reject unsafe output options in Commit.count by @​Byron in gitpython-developers/GitPython#2184

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

• fix: prevent environment expansion in remote URLs by @​Byron in gitpython-developers/GitPython#2181

Full Changelog: gitpython-developers/GitPython@3.1.54...3.1.55

Commits

• ccbd573 prepare for new release
• d1a631d Merge pull request #2193 from gitpython-developers/more-unsafe-options
• ab33e33 Merge pull request #2194 from gitpython-developers/fix-basedpyright
• 52199b3 address review comments
• 60dec71 Adopt basedpyright with a legacy baseline
• 7a4f5dc Block unsafe archive additions and bundle URI
• 3af0c25 Block unsafe checkout-index and tag file options
• fb5d584 Merge pull request #2187 from pick7/codex/remote-progress-return-type
• 951cc44 Merge pull request #2188 from pick7/codex/redact-http-extraheader
• 2e5b13f Merge pull request #2189 from pick7/codex/output-stream-timeout
• Additional commits viewable in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

• Dropped support for pypy 3.10. (#764)

Security fixes

• Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

  Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

  For example::

  import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

  outputs::

  'Click'

  See the advisory for details.

• Fix GHSA-gj48-438w-jh9v.

  Fix issue where URI sanitization wasn't happening in formaction attributes.

  See the advisory for details.

Bug fixes

• Add support for pypy 3.11. (#764)

• Drop version max in tinycss2 pin. (#772)

  This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits

• f0355a7 fix: fix last release date in CHANGES
• ae4e8a2 chore: bleach 6.4.0 and final release
• 970df58 fix: uri-sanitization in formaction attributes
• 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
• 913ab75 fix: reduce redundancy in workflow jobs
• 218c15a fix: rework pip caching
• 4f0b097 fix: fix tox platform restrictions
• e95a79d chore: update pytest
• 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
• cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud