new file mode 100644
@@ -0,0 +1,60 @@
+From dd5d1c4ddcc5d44faf4e71bcfa338f09db2022d6 Mon Sep 17 00:00:00 2001
+From: w <w@mac.lan>
+Date: Mon, 20 Apr 2026 23:29:50 -0400
+Subject: [PATCH] Block unsafe underscored git kwargs / Fix for
+ GHSA-rpm5-65cw-6hj4
+
+CVE: CVE-2026-42215
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6]
+
+Backport Changes:
+- Omitted test/test_clone.py, test/test_git.py, and
+ test/test_remote.py because the PyPI 3.1.43 source used by the
+ recipe does not ship the upstream test tree.
+
+(cherry picked from commit 142195888e713542189533a52cdfc333f05c3af6)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ git/cmd.py | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 90fc39cd..2ecb8e66 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -711,6 +711,12 @@ class Git(metaclass=_GitMeta):
+ f"The `{protocol}::` protocol looks suspicious, use `allow_unsafe_protocols=True` to allow it."
+ )
+
++ @classmethod
++ def _canonicalize_option_name(cls, option: str) -> str:
++ """Normalize an option or kwarg name for unsafe-option checks."""
++ option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
++ return dashify(option_name)
++
+ @classmethod
+ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
+ """Check for unsafe options.
+@@ -718,15 +724,14 @@ class Git(metaclass=_GitMeta):
+ Some options that are passed to ``git <command>`` can be used to execute
+ arbitrary commands. These are blocked by default.
+ """
+- # Options can be of the form `foo`, `--foo bar`, or `--foo=bar`, so we need to
+- # check if they start with "--foo" or if they are equal to "foo".
+- bare_unsafe_options = [option.lstrip("-") for option in unsafe_options]
++ # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
++ canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
+ for option in options:
+- for unsafe_option, bare_option in zip(unsafe_options, bare_unsafe_options):
+- if option.startswith(unsafe_option) or option == bare_option:
+- raise UnsafeOptionError(
+- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+- )
++ unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
++ if unsafe_option is not None:
++ raise UnsafeOptionError(
++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
++ )
+
+ class AutoInterrupt:
+ """Process wrapper that terminates the wrapped process on finalization.
new file mode 100644
@@ -0,0 +1,29 @@
+From e77461e6953a67f17ecd1808c352e6613a17345b Mon Sep 17 00:00:00 2001
+From: w <w@mac.lan>
+Date: Mon, 20 Apr 2026 23:43:59 -0400
+Subject: [PATCH] linter fix
+
+CVE: CVE-2026-42215
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826]
+
+(cherry picked from commit 9aed7cf8c20f69effcfcf7ebef09f312f73ab826)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ git/cmd.py | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 2ecb8e66..372eac28 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -729,9 +729,7 @@ class Git(metaclass=_GitMeta):
+ for option in options:
+ unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
+ if unsafe_option is not None:
+- raise UnsafeOptionError(
+- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+- )
++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
+
+ class AutoInterrupt:
+ """Process wrapper that terminates the wrapped process on finalization.
new file mode 100644
@@ -0,0 +1,45 @@
+From 3ee4db90229dbb1fbdc8572dc8219990d70db368 Mon Sep 17 00:00:00 2001
+From: w <w@mac.lan>
+Date: Tue, 21 Apr 2026 12:03:20 -0400
+Subject: [PATCH] git.cmd: harden unsafe option canonicalization and isolate
+ push test cases
+
+CVE: CVE-2026-42215
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8]
+
+Backport Changes:
+- Omitted test/test_remote.py because the PyPI 3.1.43 source used
+ by the recipe does not ship the upstream test tree.
+
+(cherry picked from commit 43d92dec4683568d11495956dd556161f17c3ea8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ git/cmd.py | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 372eac28..a1e77bdb 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -713,9 +713,18 @@ class Git(metaclass=_GitMeta):
+
+ @classmethod
+ def _canonicalize_option_name(cls, option: str) -> str:
+- """Normalize an option or kwarg name for unsafe-option checks."""
+- option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
+- return dashify(option_name)
++ """Return the option name used for unsafe-option checks.
++
++ Examples:
++ ``"--upload-pack=/tmp/helper"`` -> ``"upload-pack"``
++ ``"upload_pack"`` -> ``"upload-pack"``
++ ``"--config core.filemode=false"`` -> ``"config"``
++ """
++ option_name = option.lstrip("-").split("=", 1)[0]
++ option_tokens = option_name.split(None, 1)
++ if not option_tokens:
++ return ""
++ return dashify(option_tokens[0])
+
+ @classmethod
+ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
@@ -13,6 +13,9 @@ PYPI_PACKAGE = "GitPython"
inherit pypi python_setuptools_build_meta
SRC_URI += "file://CVE-2026-42284.patch \
+ file://CVE-2026-42215_p1.patch \
+ file://CVE-2026-42215_p2.patch \
+ file://CVE-2026-42215_p3.patch \
"
SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"