[Aikido] Fix security issue in gitpython via minor version upgrade from 3.1.50 to 3.1.58

[aikido-autofix]

Upgrade GitPython to fix arbitrary file read/write and command injection vulnerabilities (RCE, file overwrite, file read) in checkout, tag creation, and archive operations.

✅ 3 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-3f7w-8rr8-f37f	HIGH	[gitpython] GitPython fails to validate dangerous git options in two API methods that forward user-controlled kwargs to git commands, allowing arbitrary file overwrite via IndexFile.checkout() with --prefix and arbitrary file read via TagReference.create() with -F. Both vulnerabilities enable attackers to read/write files at process privileges by controlling repository content.
GHSA-539m-9xh6-q6rr	MEDIUM	[gitpython] GitPython's Repo.archive() denylist is incomplete, missing --add-file and --add-virtual-file options, allowing arbitrary file read and content injection into archives. An attacker can exfiltrate files from the system or inject malicious content into repository archives when caller-controlled options are passed to the method.
GHSA-p538-c434-8v24	MEDIUM	[gitpython] A missing input validation guard in Commit.count() allows arbitrary file truncation via the output parameter passed to git rev-list, enabling attackers to destroy or blank files at process privilege level.

🤖 Remediation details

Fix gitpython vulnerabilities by raising minimum version floor

This PR remediates three security vulnerabilities in gitpython by updating its declared lower-bound constraint in the root pyproject.toml and refreshing uv.lock to resolve a patched version.

gitpython

gitpython is a direct dependency declared in pyproject.toml under [project].dependencies. The previous lower bound of >=3.1.55 still permitted vulnerable releases; this PR raises it to >=3.1.57, the minimum version that patches all three reported advisories (GHSA-3f7w-8rr8-f37f, GHSA-539m-9xh6-q6rr, and GHSA-p538-c434-8v24). Running uv lock --upgrade-package gitpython after the spec change caused the resolver to select 3.1.58, the latest available release, which satisfies every patched-version requirement.

Version changes

Package	From	To	Why updated
gitpython	>=3.1.55 (resolved 3.1.57)	>=3.1.57 (resolved 3.1.58)	Direct CVE fix — semver floor raised to exclude all vulnerable releases

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[aikido-autofix]

Closed by Aikido: the vulnerabilities are already resolved.