GHSA-whh4-5q6c-9v3x

### Summary GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile. However, the high-level diff API still permits --no-index with the default allow_unsafe_options=False. --no-index changes the semantics of the paths arguments: instead of repository-relative pathspecs, Git interprets them as arbitrary filesystem paths. When combined with the still-allowed -I/--ignore-matching-lines option, this creates a content-dependent Boolean oracle over a caller-selected local file. This was reproduced against the published GitPython 3.1.59 wheel. The original unsafe-option path is blocked in 3.1.59, while this alternate path remains reachable without setting allow_unsafe_options=True. ### Details Confirmed API surface: repo.index.diff( None, no_index=True, I=pattern, paths=[baseline_path, target_path], create_patch=True, ) The relevant behavior is: 1. --no-index makes the two values supplied via paths filesystem operands rather than repository pathspecs. 2. -I/--ignore-matching-lines makes Git's result depend on whether the supplied regular expression matches the relevant file content. 3. GitPython exposes the resulting bit through distinguishable behavior: - matching condition: normal return with an empty DiffIndex - non-matching condition: GitCommandError with exit status 1 An application that forwards attacker-influenced diff options and paths and exposes the success/error distinction can therefore be queried repeatedly to recover a guessable local single-line secret. The issue was confirmed with the default allow_unsafe_options=False. The behavior does not require the caller to explicitly opt into GitPython's unsafe-option mode. Verified intended security boundary: - GitPython 3.1.58 accepts the earlier -O/--orderfile local-file input path. - GitPython 3.1.59 rejects that same path with UnsafeOptionError. - GitPython 3.1.59 still permits the --no-index alternate pa