Summary

GitPython 3.1.60 (published 2026-08-25 18:33 UTC) removed the Actor.name_email_regex class attribute as part of a security hardening fix (gitpython-developers/GitPython#2215, replacing backtracking-regex identity parsing to close GHSA-v6xg-m7rh-r365 and GHSA-g5vv-9gxw-82hx).

semantic_release/cli/config.py calls Actor.name_email_regex.match(...) directly when validating the configured commit author (commit_author), so any environment that resolves to gitpython>=3.1.60 now crashes on every invocation:

AttributeError: type object 'Actor' has no attribute 'name_email_regex'

Since PSR's own constraint is gitpython~=3.0, this affects every version — a fresh pip install python-semantic-release today resolves gitpython==3.1.60 and breaks immediately, with no code change on the caller's part. Confirmed via bisection: 3.1.59 still has the attribute, 3.1.60 does not.

Impact

This breaks release automation for anyone using PSR with an unpinned or loosely-pinned GitPython — several independent reports of the identical error surfaced within minutes of the GitPython release going out, all converging on the same workaround (pinning gitpython<3.1.60), e.g.:

• Pin GitPython below 3.1.60 for semantic-release compat sweetrpg/game-room-objects.py#6
• ci: pin the release tooling instead of rebuilding it unpinned every run gaussia-labs/pyboltzmann#17

Suggested fix

Stop depending on the removed Actor.name_email_regex (it was apparently never a stable/documented part of GitPython's public API, since it was removed rather than deprecated). A regex-based validation of "name <email>" could be inlined into PSR directly rather than reaching into GitPython's internals, or PSR could rely on Actor._from_string/Actor(...) construction to validate instead.

Workaround (in the meantime)

Pin gitpython<3.1.60 alongside python-semantic-release until this is fixed.

Environment

• python-semantic-release==10.6.1 (latest at time of filing)
• gitpython==3.1.60