Denial of Service via catastrophic backtracking (ReDoS) in Actor.name email regex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling path field still reaches os.makedirs() unguarded, although GitPython already owns the containment guard