CVE-2023-41040

Advisory

Mentat 0.1.20 updates its dependency 'gitpython' to v3.1.35 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Support ending sessions with Ctrl-D by chadwhitacre in https://github.com/AbanteAI/mentat/pull/5
* Fix rel_path vs abs_path typo by yoDon in https://github.com/AbanteAI/mentat/pull/7
* Fix bug filter gitignore sooner by swinglejohn in https://github.com/AbanteAI/mentat/pull/13
* make required python version 3.10 or higher by PCSwingle in https://github.com/AbanteAI/mentat/pull/9
* move python version check, add python 3.11 to github actions by biobootloader in https://github.com/AbanteAI/mentat/pull/16
* check python version in __main__ by biobootloader in https://github.com/AbanteAI/mentat/pull/19
* Fix test bugs; Clean up tests by biobootloader in https://github.com/AbanteAI/mentat/pull/14
* Improve handling of large projects by yoDon in https://github.com/AbanteAI/mentat/pull/8
* add description, license to setup.py by biobootloader in https://github.com/AbanteAI/mentat/pull/22
* License check by PCSwingle in https://github.com/AbanteAI/mentat/pull/24
* Fix typo in code_file_manager.py by eltociear in https://github.com/AbanteAI/mentat/pull/26
* Encoding bug fix by PCSwingle in https://github.com/AbanteAI/mentat/pull/23
* update packages by PCSwingle in https://github.com/AbanteAI/mentat/pull/27
* Git migration by PCSwingle in https://github.com/AbanteAI/mentat/pull/28
* The great config migration by PCSwingle in https://github.com/AbanteAI/mentat/pull/29
* Remove filetype checking by PCSwingle in https://github.com/AbanteAI/mentat/pull/32
* Create directories as needed by biobootloader in https://github.com/AbanteAI/mentat/pull/35
* Exclude globs by PCSwingle in https://github.com/AbanteAI/mentat/pull/33
* add star to new files to git by PCSwingle in https://github.com/AbanteAI/mentat/pull/38
* Fix tiktoken crash by biobootloader in https://github.com/AbanteAI/mentat/pull/39
* Fix typo in readme for --exclude by yoDon in https://github.com/AbanteAI/mentat/pull/40
* Model error handling by PCSwingle in https://github.com/AbanteAI/mentat/pull/37
* Fix windows paths by PCSwingle in https://github.com/AbanteAI/mentat/pull/41
* Fix a type mismatch by chadwhitacre in https://github.com/AbanteAI/mentat/pull/44
* removed extra first_changed_line by civil-dude in https://github.com/AbanteAI/mentat/pull/47
* Use custom exceptions instead of KeyboardInterrupts and exit() by swinglejohn in https://github.com/AbanteAI/mentat/pull/45
* Check early if file tokens exceed or near limit by biobootloader in https://github.com/AbanteAI/mentat/pull/42
* Fix openAI error messages and API key messages by swinglejohn in https://github.com/AbanteAI/mentat/pull/52
* Refactor: keep git_root private to CodeFileManager by dheerajck in https://github.com/AbanteAI/mentat/pull/62
* Replaced most of the os path related methods with pathlib by dheerajck in https://github.com/AbanteAI/mentat/pull/68
* Fix `test_start_project_from_scratch` by waydegg in https://github.com/AbanteAI/mentat/pull/72
* Fix git root parsing when using msys2 git on Windows by vickunwu in https://github.com/AbanteAI/mentat/pull/67
* Add high-level code map to system prompt by waydegg in https://github.com/AbanteAI/mentat/pull/66
* Add commands by PCSwingle in https://github.com/AbanteAI/mentat/pull/59
* Partial files allowed by jakethekoenig in https://github.com/AbanteAI/mentat/pull/69
* Clear prompt with ctrl-c before quitting by waydegg in https://github.com/AbanteAI/mentat/pull/83
* Add auto completions by waydegg in https://github.com/AbanteAI/mentat/pull/79
* Add rename file action by PCSwingle in https://github.com/AbanteAI/mentat/pull/46
* update gitpython because of security vulnerabilities by PCSwingle in https://github.com/AbanteAI/mentat/pull/89
* Add pyright by waydegg in https://github.com/AbanteAI/mentat/pull/84
* refactor benchmarks by PCSwingle in https://github.com/AbanteAI/mentat/pull/90
* fail gracefully for paths without interval data by granawkins in https://github.com/AbanteAI/mentat/pull/95
* Test run in subdirectory by granawkins in https://github.com/AbanteAI/mentat/pull/96
* Switch package name on PyPI by biobootloader in https://github.com/AbanteAI/mentat/pull/98
* add /add and /remove commands by waydegg in https://github.com/AbanteAI/mentat/pull/88
* Exercism Benchmark by jakethekoenig in https://github.com/AbanteAI/mentat/pull/92
* Diff context by granawkins in https://github.com/AbanteAI/mentat/pull/86
* Model configuration by jakethekoenig in https://github.com/AbanteAI/mentat/pull/100
* Refactor context by granawkins in https://github.com/AbanteAI/mentat/pull/101
* remove logging from test environment by PCSwingle in https://github.com/AbanteAI/mentat/pull/104
* Refactor changes by PCSwingle in https://github.com/AbanteAI/mentat/pull/94
* move the get_code_message() method from code_file_manager to code_context by granawkins in https://github.com/AbanteAI/mentat/pull/108
* Readme update: biobootloader to AbanteAI in github links by jakethekoenig in https://github.com/AbanteAI/mentat/pull/110
* refactor prompts to be in separate txt files, add replacement parser by PCSwingle in https://github.com/AbanteAI/mentat/pull/105
* add split diff parser and tests by PCSwingle in https://github.com/AbanteAI/mentat/pull/112
* Exercism Benchmark supports javascript by jakethekoenig in https://github.com/AbanteAI/mentat/pull/116
* Generic interface by waydegg in https://github.com/AbanteAI/mentat/pull/119
* add util func for async subprocess by waydegg in https://github.com/AbanteAI/mentat/pull/124
* Full gpt transcripts logged by jakethekoenig in https://github.com/AbanteAI/mentat/pull/120
* Flag to choose exercism exercises by jakethekoenig in https://github.com/AbanteAI/mentat/pull/125
* Exercism fix by jakethekoenig in https://github.com/AbanteAI/mentat/pull/127
* remove basicConfig and modify the root handler directly by PCSwingle in https://github.com/AbanteAI/mentat/pull/126
* turn all singletons into context vars, remove git_root from config by PCSwingle in https://github.com/AbanteAI/mentat/pull/123
* Add unified diff format by PCSwingle in https://github.com/AbanteAI/mentat/pull/118
* Version bump to 0.1.15 by biobootloader in https://github.com/AbanteAI/mentat/pull/132
* Exercism language refactor by jakethekoenig in https://github.com/AbanteAI/mentat/pull/133
* Implement basic auto-context generation by granawkins in https://github.com/AbanteAI/mentat/pull/115
* Automatic failure analysis by PCSwingle in https://github.com/AbanteAI/mentat/pull/130
* Python client added by jakethekoenig in https://github.com/AbanteAI/mentat/pull/134
* fix small bugs by PCSwingle in https://github.com/AbanteAI/mentat/pull/135
* use signal.signal instead of loop.add_signal_handler by PCSwingle in https://github.com/AbanteAI/mentat/pull/138
* Update configuration.md by jakethekoenig in https://github.com/AbanteAI/mentat/pull/137
* Clojure exercism added by jakethekoenig in https://github.com/AbanteAI/mentat/pull/136
* Version bump to 0.1.16 by jakethekoenig in https://github.com/AbanteAI/mentat/pull/142
* Manifest added by jakethekoenig in https://github.com/AbanteAI/mentat/pull/145
* Add undo by PCSwingle in https://github.com/AbanteAI/mentat/pull/143
* Broadcast hold events by PCSwingle in https://github.com/AbanteAI/mentat/pull/147
* Embeddings by granawkins in https://github.com/AbanteAI/mentat/pull/144
* add benchmark repos to .gitignore by granawkins in https://github.com/AbanteAI/mentat/pull/156
* Cleanup resources by PCSwingle in https://github.com/AbanteAI/mentat/pull/151
* Empty string handling by jakethekoenig in https://github.com/AbanteAI/mentat/pull/166
* Reversible parsing by jakethekoenig in https://github.com/AbanteAI/mentat/pull/150
* add way to exit main session loop, add command catching and quitting to sessioninput by PCSwingle in https://github.com/AbanteAI/mentat/pull/167
* Conversation viewer by PCSwingle in https://github.com/AbanteAI/mentat/pull/152
* Default to auto-token limit of 0 by biobootloader in https://github.com/AbanteAI/mentat/pull/175
* use graft instead of recursive-include by PCSwingle in https://github.com/AbanteAI/mentat/pull/177
* fix running mentat from a sub folder and also fix duplicated code features bug by PCSwingle in https://github.com/AbanteAI/mentat/pull/179
* Bump version to 0.1.19 by biobootloader in https://github.com/AbanteAI/mentat/pull/180
* Replacement parser inverse by jakethekoenig in https://github.com/AbanteAI/mentat/pull/172
* Unified diff tweaking by PCSwingle in https://github.com/AbanteAI/mentat/pull/168
* fix context checking in fileedit, remove test.conftest imports by PCSwingle in https://github.com/AbanteAI/mentat/pull/184
* switch to use abs-paths for parsers renames by PCSwingle in https://github.com/AbanteAI/mentat/pull/183
* Backoff llm api calls by PCSwingle in https://github.com/AbanteAI/mentat/pull/171
* remove backoff_delay_base by PCSwingle in https://github.com/AbanteAI/mentat/pull/193
* catch shlex error by PCSwingle in https://github.com/AbanteAI/mentat/pull/194
* Context command by PCSwingle in https://github.com/AbanteAI/mentat/pull/200
* fix abs path auto completions by PCSwingle in https://github.com/AbanteAI/mentat/pull/198
* Create file not in context by PCSwingle in https://github.com/AbanteAI/mentat/pull/197
* add include and exclude warnings by PCSwingle in https://github.com/AbanteAI/mentat/pull/196
* Git diff parsing by jakethekoenig in https://github.com/AbanteAI/mentat/pull/195
* update diff_context and tests to use absolute path by granawkins in https://github.com/AbanteAI/mentat/pull/199
* add session context and remove old contextvars by PCSwingle in https://github.com/AbanteAI/mentat/pull/185
* Remove async from send by PCSwingle in https://github.com/AbanteAI/mentat/pull/203
* add search command by granawkins in https://github.com/AbanteAI/mentat/pull/157
* fix codecontext test to not be brittle by PCSwingle in https://github.com/AbanteAI/mentat/pull/204
* rename code_file to code_feature, CodeFile to CodeFeature by granawkins in https://github.com/AbanteAI/mentat/pull/208
* standardize import format to absolute by granawkins in https://github.com/AbanteAI/mentat/pull/207
* Update openai by jakethekoenig in https://github.com/AbanteAI/mentat/pull/211
* Ignore Paths by granawkins in https://github.com/AbanteAI/mentat/pull/186
* Function-level Features by granawkins in https://github.com/AbanteAI/mentat/pull/209
* Generate synthetic transcripts from commits by jakethekoenig in https://github.com/AbanteAI/mentat/pull/210
* Fix Interactive Mode suggestion count by waydegg in https://github.com/AbanteAI/mentat/pull/212
* Remove git dependency for CodeMap by waydegg in https://github.com/AbanteAI/mentat/pull/217
* Add `preview` setting to black in `pyproject.toml` by waydegg in https://github.com/AbanteAI/mentat/pull/220
* Config refactor by jakethekoenig in https://github.com/AbanteAI/mentat/pull/219
* Config Command by jakethekoenig in https://github.com/AbanteAI/mentat/pull/221
* Benchmark generation from git commits by jakethekoenig in https://github.com/AbanteAI/mentat/pull/214
* reset auto tokens default to 0 by PCSwingle in https://github.com/AbanteAI/mentat/pull/224
* Fix: --diff/--pr-diff by jakethekoenig in https://github.com/AbanteAI/mentat/pull/230
* Run github actions on all pushes / PRs by biobootloader in https://github.com/AbanteAI/mentat/pull/222
* Git Parser Fix by jakethekoenig in https://github.com/AbanteAI/mentat/pull/232
* Git transcript processing tweaks by jakethekoenig in https://github.com/AbanteAI/mentat/pull/233
* Don't skip Github Action PR checks by biobootloader in https://github.com/AbanteAI/mentat/pull/234
* Rubric benchmark by jakethekoenig in https://github.com/AbanteAI/mentat/pull/236
* Parser held by config by jakethekoenig in https://github.com/AbanteAI/mentat/pull/240
* Fix: cli flag parsing by jakethekoenig in https://github.com/AbanteAI/mentat/pull/238
* Include paths from diff/pr-diff if no paths given by granawkins in https://github.com/AbanteAI/mentat/pull/241
* Auto context with llm by granawkins in https://github.com/AbanteAI/mentat/pull/228
* Parser change midconversation by jakethekoenig in https://github.com/AbanteAI/mentat/pull/244
* Parser prompt optional by jakethekoenig in https://github.com/AbanteAI/mentat/pull/245
* Interval uses attr by jakethekoenig in https://github.com/AbanteAI/mentat/pull/247
* Display exception by jakethekoenig in https://github.com/AbanteAI/mentat/pull/250
* Refactor context benchmark by granawkins in https://github.com/AbanteAI/mentat/pull/249
* Add new gpt-4-turbo 128k model (gpt-4-1106-preview) to cost and token… by hesiod-au in https://github.com/AbanteAI/mentat/pull/252
* Conversation command shows old transcripts by jakethekoenig in https://github.com/AbanteAI/mentat/pull/251
* Feature Selection Refactor by jakethekoenig in https://github.com/AbanteAI/mentat/pull/248
* Speed up embeddings/search by granawkins in https://github.com/AbanteAI/mentat/pull/254
* Auto context interface by granawkins in https://github.com/AbanteAI/mentat/pull/255
* Aider attribution by jakethekoenig in https://github.com/AbanteAI/mentat/pull/258
* remove split diff by PCSwingle in https://github.com/AbanteAI/mentat/pull/259
* change back to find packages by PCSwingle in https://github.com/AbanteAI/mentat/pull/261
* Javascript Exercism Fix by jakethekoenig in https://github.com/AbanteAI/mentat/pull/267
* Default temperature changed to 0.05 by jakethekoenig in https://github.com/AbanteAI/mentat/pull/266
* fix error handling by PCSwingle in https://github.com/AbanteAI/mentat/pull/263
* version -> 0.1.20 by biobootloader in https://github.com/AbanteAI/mentat/pull/270
* add cd and conf.ini by PCSwingle in https://github.com/AbanteAI/mentat/pull/275

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41040