[GHSA-v396-v7q4-x2qj] Correct GitPython fix references

[ECD5A]

Updates

• References

Comments

Summary

Replace the closed, unmerged remediation PR #2162 with the actual merged remediation PR #2168, and add the direct fixing commit for the joined-short-option bypass described by GHSA-v396-v7q4-x2qj.

Evidence

• GitPython PR [GHSA-x7g2-wrrp-r6h3] Use of a Broken or Risky Cryptographic Algorithm #2162 is closed without a merge commit.
• GitPython PR [GHSA-f8vr-r385-rh5r] h2 vulnerable to denial of service #2168 was merged on 2026-07-12 and contains commit 56806080c1348749b07daa4a2024ce47b3cad285.
• That commit explicitly rejects joined unsafe short-option forms including -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE, matching this advisory's -u<helper> / -cKEY=VALUE bypass.
• The commit is included in the upstream 3.1.50...3.1.51 comparison, consistent with the advisory's fixed version of 3.1.51.

Validation

• Limited to one advisory JSON file
• JSON syntax validated
• Searched open and closed pull requests for the advisory ID; no duplicate found

[ECD5A]

I rechecked the published advisory today: it still links to the closed, unmerged GitPython PR #2162. This correction points to the merged fix in GitPython #2168 and its fixing commit. Is there any additional information you need to review this change?