[SemiKyle]

Security fix for the open high GitPython alert in inferencex-e2e.

Packages changed:

• GitPython (inferencex-e2e/uv.lock, workflows extra): 3.1.62 to 3.2.1. Closes GHSA-83vg-56qc-22m7. 3.2.1 is 9 days old, so it meets the 7-day rule. The pyproject range GitPython>=3.1,<4 already allows it.

Skipped:

• Pillow (all open alerts need 13.0.0): 13.0.0 is 6 days old. It is eligible on 2026-10-24. It is also a major version.
• certifi (GHSA-6q48-6c7w-9gw2): the fix 2026.10.19 is 3 days old. It is eligible on about 2026-10-27.
• The alerts on the root uv.lock are stale. That file was removed in refactor: organize top-level benchmark projects / 重组顶层基准测试项目 #3525, and alert Questions / Comments on the Fairness of the Benchmark #99 is dismissed.

Notes:

• Made with uv lock --upgrade-package gitpython (uv 0.12.18), so no other package version moves.
• uv 0.12 writes the relative exclude-newer = "PT12H" setting in its new form: the [options] timestamp becomes the placeholder 0001-01-01T00:00:00Z. It also drops some sys_platform markers on torch dependencies. These are format changes only.
• Lockfile URLs point to pypi.org and files.pythonhosted.org. Hashes are unchanged.

[claude]

I reviewed this lockfile-only GitPython bump and found no bugs. The lock is covered by the repo-wide CODEOWNERS rule, and the 3.1 to 3.2 minor bump touches the code path that merges results, so a maintainer should still sign off.

What was reviewed:

• The gitpython entry moves 3.1.62 to 3.2.1, and the pyproject range GitPython>=3.1,<4 already allows it. The new sdist and wheel point at files.pythonhosted.org, and no other package version changes.
• The [options] change swaps the absolute exclude-newer timestamp for uv's placeholder. exclude-newer-span = "PT12H" is kept, and it matches exclude-newer = "PT12H" in pyproject.toml.
• The sys_platform markers dropped from the two torch 2.14.0 dependency lists are redundant, because each torch entry is already limited to its platform by its own resolution-markers.

Extended reasoning...

Only inferencex-e2e/uv.lock changes. It bumps gitpython from 3.1.62 to 3.2.1 and includes format-only changes from regenerating with a newer uv: the exclude-newer placeholder and the removed torch dependency markers. GitPython is imported by infx/workflows/merge_with_reuse.py, and test_merge_with_reuse.py tests it. Nothing here touches auth, injection or credentials, and the change itself is a supply-chain version bump. The deciding fact is that the lockfile falls under the catch-all CODEOWNERS rule (core team), so the change is not approved automatically.