What's Changed

• prepare changelog for upcoming release by @Byron in #2207
• Block file-reading Git options by @Byron in #2208
• index: write blobs via git hash-object, not gitdb's odb.store by @caroescm in #2209
• Block separate git directories during clone by @Byron in #2210
• fix: harden config parsing boundaries by @Byron in #2211
• repo.index.add() now respects worktree filters #2209

Full Changelog: 3.1.58...3.1.59

What's Changed

• test: allow Python startup before timeout by @Byron in #2195
• Resolve Windows hook Bash through PATH by @Byron in #2199
• Revert "Resolve Windows hook Bash through PATH" by @Byron in #2200
• test: focus pytest summary on unexpected failures by @raisulchowdhury in #2203
• Validate submodule names before filesystem operations by @Byron in #2202
• Handle invalid submodule names during recursive updates by @Byron in #2205
• Fix Windows path handling on Python 3.13+ by @Byron in #2196
• fixup 2202 by @Byron in #2206
• Correct Windows hook Bash precedence by @Byron in #2201
• Harden config and Git option validation by @Byron in #2204
• Skip tests that need symlink privileges instead of erroring by @Cyrus580529 in #2197

New Contributors

• @raisulchowdhury made their first contribution in #2203
• @Cyrus580529 made their first contribution in #2197

Full Changelog: 3.1.57...3.1.58

What's Changed

• Merge gitdb and smmap into the GitPython repository by @Byron in #2179
• build(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #2185
• build(deps): bump the pre-commit group with 2 updates by @dependabot[bot] in #2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @dependabot[bot] in #2124
• Render protected Traversable methods in the reference by @pick7 in #2192
• Use standard prefixes for parsed patch diffs by @pick7 in #2191
• Honor kill_after_timeout with output streams by @pick7 in #2189
• Redact Authorization extra headers from command errors by @pick7 in #2188
• Improve RemoteProgress parse return typing by @pick7 in #2187
• Adopt basedpyright with a legacy baseline by @Byron in #2194
• Block unsafe Git file and URL options by @Byron in #2193

New Contributors

• @pick7 made their first contribution in #2192

Full Changelog: 3.1.56...3.1.57

What's Changed

• Add support for Python 3.15 by @hugovk in #2183
• fix: reject unsafe output options in Commit.count by @Byron in #2184

Full Changelog: 3.1.55...3.1.56

What's Changed

• fix: prevent environment expansion in remote URLs by @Byron in #2181

Full Changelog: 3.1.54...3.1.55

What's Changed

• Harden unsafe Git option validation by @Byron in #2180

Full Changelog: 3.1.53...3.1.54

What's Changed

• feat(submodule): add deinit method to Submodule (#2014) by @mvanhorn in #2129
• typing: introduce sensible basedpyright defaults by @Byron in #2174
• fix: make submodule.update() after submodule.deinit() work by @Byron in #2175
• Fix commit hooks respecting core.hooksPath by @Siesta0217 in #2159
• fix: validate config section delimiters by @Byron in #2176

New Contributors

• @Siesta0217 made their first contribution in #2159

Full Changelog: 3.1.52...3.1.53

GHSA-rwj8-pgh3-r573: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

What's Changed

• Skip cross-drive relative config test on Windows by @Byron in #2171
• fix: preserve literal clone URLs by @Byron in #2172

Full Changelog: 3.1.51...3.1.52

What's Changed

• Add AI-disclosure and quality requirements to the contribution guidelines by @Byron in #2143
• docs(cmd): clarify Git.execute() string vs list command argument by @mvanhorn in #2144
• Rewrite Git.execute() command parameter docstring per #2146 by @EliahKagan in #2147
• Document init script behavior with multiple master remotes by @EliahKagan in #2148
• Bump git/ext/gitdb from 335c0f6 to 0a019a2 by @dependabot[bot] in #2149
• Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by @elovelan in #2151
• Defer xfail condition evaluation with xfail_if_raises context manager by @elovelan in #2153
• Run more submodule tests on Cygwin (fix flaky xfails) by @EliahKagan in #2154
• Cut xtrace noise from POSIX-ownership diagnostic steps by @EliahKagan in #2156
• Support index diffs against the empty tree by @puneetdixit200 in #2155
• refactor: seperate out Progress type by @LoeschMaximilian in #2157
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.12 to 0.15.15 in the pre-commit group by @dependabot[bot] in #2160
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2164
• Bump git/ext/gitdb from 0a019a2 to 4950ea9 by @dependabot[bot] in #2165
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.15 to 0.15.20 in the pre-commit group by @dependabot[bot] in #2166
• Add Commit.is_shallow property; document stats() limitation at shallow boundary by @harshitayadavv in #2167
• Allow relative config paths with includes by @Byron in #2169
• Reject abbreviated forms of unsafe git options by @Byron in #2168
• guard unsafe git command options by @Byron in #2163

New Contributors

• @elovelan made their first contribution in #2151
• @puneetdixit200 made their first contribution in #2155
• @LoeschMaximilian made their first contribution in #2157
• @harshitayadavv made their first contribution in #2167

Full Changelog: 3.1.50...3.1.51

What's Changed

• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.8 to 0.15.12 in the pre-commit group by @dependabot[bot] in #2140
• Bump git/ext/gitdb from 335c0f6 to 53c94d6 by @dependabot[bot] in #2141
• Fix Repo() autodiscovery in linked worktrees when GIT_DIR is set by @meliezer in #2128
• Validate config key names before writing by @Byron in #2142

New Contributors

• @meliezer made their first contribution in #2128

Full Changelog: 3.1.49...3.1.50