fix(deps): bump gitpython 3.1.59, pyasn1 0.6.4, sqlparse 0.6.0 (CTO-5188, CTO-5190, CTO-5320)

[shrish-browserstack]

What

Three pins in requirements.txt moved to patched releases. No other dependency moves.

Package	Before	After	Advisories closed
gitpython	3.1.50	3.1.59	GHSA-v396-v7q4-x2qj (joined short option -u<helper> bypasses the unsafe-clone gate, fixed 3.1.51) plus the five 2026-09-08 advisories fixed only in 3.1.59: GHSA-284h-m62q-gf8w (critical, multi-line git-config injection), GHSA-7833-fr7j-v32q (high, file disclosure via [include]), GHSA-8mcc-hrx5-hvxc (high, --separate-git-dir missing from unsafe clone options), GHSA-5xxx-qhh7-9287, GHSA-3wxw-xv34-2frg
pyasn1	0.6.3	0.6.4	GHSA-hm4w-wwcw-mr6r (huge-exponent REAL conversion hangs on str()/compare)
sqlparse	0.5.4	0.6.0	GHSA-f2ff-p2ww-7p4p (O(n²) group_comments on comment-only input)

Also drops the trailing blank line at end of file that the repo's end-of-file-fixer pre-commit hook flags (the hook rewrites the file on main today).

Supersedes the Dependabot PRs #338 (gitpython 3.1.59), #325 (pyasn1 0.6.4) and #335 (sqlparse 0.6.0); those can be closed when this merges.

Compatibility

• pyasn1-modules==0.4.2 requires pyasn1<0.7,>=0.6.1, so 0.6.4 is in range.
• Django==4.2.30 requires sqlparse>=0.3.1. sqlparse 0.6.0 needs Python ≥ 3.10; the image is python:3.11-slim-bullseye and CI runs 3.12/3.13/3.14. Its changelog's only breaking change is dropping Python 3.8/3.9. grep -rn sqlparse --include='*.py' finds no direct usage in this repo (transitive via Django only).
• gitpython 3.1.59 requires gitdb<5,>=4.0.1 (unchanged). It is used directly in scripts/clone_access_modules.py; that script ran on 3.1.59 during the test bootstrap below. Clone URLs come from admin-owned config.json, so the clone-option advisories need admin-controlled input here.

Verification (fresh Python 3.11.9 venv, same steps as unit-tests.yml)

pip install -r requirements.txt                 # exit 0
pip check                                       # No broken requirements found.
cp config.json.sample config.json
python -m scripts.clone_access_modules          # exit 0 (GitPython 3.1.59)
pip install -r Access/access_modules/requirements.txt --no-cache-dir --ignore-installed
python -m pytest -q --disable-warnings -p no:pylama
# 107 passed, 8 skipped
pre-commit run --files requirements.txt         # all file hooks pass (local and gh-action configs)
commitlint                                      # both commit messages pass the repo config

Not run locally: pylama lint step and the 3.12/3.13/3.14 matrix (CI covers both).

Out of scope

Other Dependabot PRs on this repo (Django 5.2, DRF 3.17, cryptography 50, httplib2, soupsieve 2.9, social-auth) are feature/major bumps, not the advisories these tickets track. ajv / cross-spawn npm findings are pre-existing. The Node dev-tooling fix for fast-uri/js-yaml is in #342.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 83259626-b4ae-43e1-ab91-45f147cea5b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}