new file mode 100644
@@ -0,0 +1,76 @@
+From f4029fab1d9f47bd31ccd8334f433249c430e0a4 Mon Sep 17 00:00:00 2001
+From: Sebastian Thiel <sebastian.thiel@icloud.com>
+Date: Sat, 25 Jul 2026 06:27:01 +0200
+Subject: [PATCH 19/38] fix: reject unsafe output options in Commit.count
+
+<!-- agent -->
+
+Commit.count forwards keyword arguments to git rev-list but did not apply the
+unsafe-option validation used by the sibling revision APIs.
+
+Validate forwarded options with the existing Git.check_unsafe_options helper
+and retain the explicit allow_unsafe_options escape hatch. This covers
+GHSA-p538-c434-8v24 without adding another option parser.
+
+Git baseline: git.git a23bace963 defines --output as a shared diff option
+consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option
+with rev-list.
+
+CVE: CVE-2026-73621
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2]
+
+Backport Changes:
+- Omit upstream regression test changes because the current PyPI
+ source archive does not include its test suite.
+
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 38553b6fddc7f6a667cdb45a6762343a08fc72b2)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/objects/commit.py | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/git/objects/commit.py b/git/objects/commit.py
+index ae60d286..ff852489 100644
+--- a/git/objects/commit.py
++++ b/git/objects/commit.py
+@@ -241,21 +241,34 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
+ else:
+ return self.message.split(b"\n", 1)[0]
+
+- def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) -> int:
++ def count(
++ self,
++ paths: Union[PathLike, Sequence[PathLike]] = "",
++ allow_unsafe_options: bool = False,
++ **kwargs: Any,
++ ) -> int:
+ """Count the number of commits reachable from this commit.
+
+ :param paths:
+ An optional path or a list of paths restricting the return value
+ to commits actually containing the paths.
+
++ :param allow_unsafe_options:
++ Allow unsafe options, like ``--output``.
++
+ :param kwargs:
+ Additional options to be passed to git-rev-list. They must not alter
+ the output style of the command, or parsing will yield incorrect results.
+
+ :return: An int defining the number of reachable commits
+ """
+- # Yes, it makes a difference whether empty paths are given or not in our case
+- # as the empty paths version will ignore merge commits for some reason.
++ if not allow_unsafe_options:
++ Git.check_unsafe_options(
++ options=Git._option_candidates([], kwargs), unsafe_options=self.unsafe_git_rev_options
++ )
++
++ # Yes, it makes a difference whether empty paths are given or not in our case as
++ # the empty paths version will ignore merge commits for some reason.
+ if paths:
+ return len(self.repo.git.rev_list(self.hexsha, "--", paths, **kwargs).splitlines())
+ return len(self.repo.git.rev_list(self.hexsha, **kwargs).splitlines())
+--
+2.35.6
@@ -32,6 +32,7 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-73623.patch \
file://CVE-2026-73624.patch \
file://CVE-2026-73622.patch \
+ file://CVE-2026-73621.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1] [1] https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2 [2] https://www.cve.org/CVERecord?id=CVE-2026-73621 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-73621.patch | 76 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch