chore(deps): update dependency gitpython to v3.1.52

[elastic-renovate-prod]

This PR contains the following updates:

Package	Change	Age	Confidence
gitpython	==3.1.49 → ==3.1.52

---

Release Notes

gitpython-developers/GitPython (gitpython)

v3.1.52: Security

Compare Source

GHSA-rwj8-pgh3-r573: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

What's Changed

• Skip cross-drive relative config test on Windows by @​Byron in #​2171
• fix: preserve literal clone URLs by @​Byron in #​2172

Full Changelog: gitpython-developers/GitPython@3.1.51...3.1.52

v3.1.51: - Security

Compare Source

What's Changed

• Add AI-disclosure and quality requirements to the contribution guidelines by @​Byron in #​2143
• docs(cmd): clarify Git.execute() string vs list command argument by @​mvanhorn in #​2144
• Rewrite Git.execute() command parameter docstring per #​2146 by @​EliahKagan in #​2147
• Document init script behavior with multiple master remotes by @​EliahKagan in #​2148
• Bump git/ext/gitdb from 335c0f6 to 0a019a2 by @​dependabot[bot] in #​2149
• Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by @​elovelan in #​2151
• Defer xfail condition evaluation with xfail_if_raises context manager by @​elovelan in #​2153
• Run more submodule tests on Cygwin (fix flaky xfails) by @​EliahKagan in #​2154
• Cut xtrace noise from POSIX-ownership diagnostic steps by @​EliahKagan in #​2156
• Support index diffs against the empty tree by @​puneetdixit200 in #​2155
• refactor: seperate out Progress type by @​LoeschMaximilian in #​2157
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.12 to 0.15.15 in the pre-commit group by @​dependabot[bot] in #​2160
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2164
• Bump git/ext/gitdb from 0a019a2 to 4950ea9 by @​dependabot[bot] in #​2165
• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.15 to 0.15.20 in the pre-commit group by @​dependabot[bot] in #​2166
• Add Commit.is_shallow property; document stats() limitation at shallow boundary by @​harshitayadavv in #​2167
• Allow relative config paths with includes by @​Byron in #​2169
• Reject abbreviated forms of unsafe git options by @​Byron in #​2168
• guard unsafe git command options by @​Byron in #​2163

New Contributors

• @​elovelan made their first contribution in #​2151
• @​puneetdixit200 made their first contribution in #​2155
• @​LoeschMaximilian made their first contribution in #​2157
• @​harshitayadavv made their first contribution in #​2167

Full Changelog: gitpython-developers/GitPython@3.1.50...3.1.51

v3.1.50

Compare Source

What's Changed

• Bump https://github.com/astral-sh/ruff-pre-commit from v0.15.8 to 0.15.12 in the pre-commit group by @​dependabot[bot] in #​2140
• Bump git/ext/gitdb from 335c0f6 to 53c94d6 by @​dependabot[bot] in #​2141
• Fix Repo() autodiscovery in linked worktrees when GIT_DIR is set by @​meliezer in #​2128
• Validate config key names before writing by @​Byron in #​2142

New Contributors

• @​meliezer made their first contribution in #​2128

Full Changelog: gitpython-developers/GitPython@3.1.49...3.1.50

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[github-actions]

ECS PR Triage (automated)

PR Triage Report

PR: #2641 — chore(deps): update dependency gitpython to v3.1.50
Classification: Direct PR
Change type: Tooling
Scope: Minor

Summary

Automated Renovate bot PR that bumps the gitpython Python dependency from 3.1.49 to 3.1.50 (patch release) in scripts/requirements.txt. This is a routine, low-risk dependency update with no functional changes to ECS schemas, tooling logic, or documentation. It is clearly a Direct PR per classification-rules §2 ("Tooling only").

Files changed

• Schemas: none
• Generated: none
• Tooling/scripts/tests: scripts/requirements.txt (patch version bump: gitpython==3.1.49 → gitpython==3.1.50)
• Docs (hand-authored): none
• CI / GitHub: none
• RFCs: none

Routing decision

Direct PR — This change is a single-line patch version bump of a Python dependency used by the ECS generator tooling. It falls squarely under classification-rules §2 ("Tooling only — scripts/, generator templates, tests, Makefile"). No schema files are touched, no new fields are introduced, and no breaking changes or semantic shifts are present. No RFC or maintainer discussion is needed.

Risk notes

• Breaking / deprecation: No. Patch version bump only; gitpython 3.1.50 is a minor maintenance release.
• OTel / semconv: N/A — no schema or field changes.
• Scope / reuse: N/A — no fieldset, reuse, or categorization changes.

Completeness checklist

• PR description (all sections) — Missing. The PR uses the Renovate bot auto-generated template rather than the ECS PR template's 7 sections. This is standard and expected for automated dependency bumps; not a blocker.
• CHANGELOG.next.md — Missing. Since scripts/requirements.txt is under scripts/, a changelog entry under "Tooling and Artifact Changes" is technically expected per completeness rules. However, for a routine patch dependency bump with no functional change, this is low priority and at maintainer discretion.
• make + committed generated outputs — N/A. No schema changes; no regeneration needed.
• OTel otel: on new/changed semconv-related fields — N/A. No field changes.
• Tests / make check — Should be verified by CI. The dependency bump should not break tests, but CI confirmation is recommended.
• CLA (contributor) — N/A. Author is the Renovate bot (elastic-renovate-prod), an Elastic-managed automation account.

Recommended next actions

1. Verify CI passes — Confirm that make check and any CI workflows succeed with gitpython==3.1.50. This is the primary gate for this type of PR.
2. Optionally add a CHANGELOG.next.md entry — A one-line entry under "Tooling and Artifact Changes > Dependencies" could be added (e.g., "Bump gitpython to 3.1.50. chore(deps): update dependency gitpython to v3.1.52 #2641"), but this is at maintainer discretion for a patch dependency bump.
3. Merge when CI is green — No further review complexity; safe to merge once CI confirms compatibility.

---

Posted by PR Triage workflow