Update GitPython to 3.1.57

[Shwai-He]

Summary

• update the pinned GitPython dependency from 3.1.31 to 3.1.57
• remediate GHSA-3f7w-8rr8-f37f using the minimum patched release

Security impact

GitPython versions through 3.1.56 are affected by unguarded Git option forwarding in IndexFile.checkout() and TagReference.create(). Version 3.1.57 is the first patched release.

Compatibility

This stays within the GitPython 3.1.x line. The repository's direct GitPython usage is limited to the stable git.Repo(...) API in a vendored Transformers conversion utility. The vendored Transformers dependency table contains a historical GitPython<3.1.19 optional/tooling constraint, but GitPython is not part of its runtime-enforced dependency checks, so this focused requirements pin does not create an import-time conflict.

Validation

• git diff --check
• installed the exact pinned stack: GitPython==3.1.57, gitdb==4.0.10, and smmap==5.0.0
• python -m pip check
• smoke-tested GitPython import, repository initialization, index add, and commit

Draft only; do not merge without explicit approval.