add bottom pin for gitpython

[bollwyvl]

References

• walks back (parts of) Make gitpython dependency optional? #296/make gitpython dependency optional #297
• conda-lock 1.4.0, remove gitpython, update docs, add maintainer conda-forge/conda-lock-feedstock#39 (review)

Changes

• restore gitpython as a hard dep
  • adds bottom pin to avoid CVE-2022-24439
• remove the lazy import

  • kind of inclined to keep it lazy

Alternatives

• keep this as an optional dependency, as it's a relatively niche metadata option that incurs three additional dependencies

[netlify]

✅ Deploy Preview for conda-lock ready!

Name	Link
🔨 Latest commit	ebaf1de
🔍 Latest deploy log	https://app.netlify.com/sites/conda-lock/deploys/63c6dd88ef686d00085c3b1f
😎 Deploy Preview	https://deploy-preview-318--conda-lock.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[mariusvniekerk]

Do we need to wait for the CVE to be reported as fixed?

[bollwyvl]

Do we need to wait for the CVE to be reported as fixed?

Yeah, I guess to close the loop, it probably makes sense to wait for updated findings.

[maresb]

This was modified on Feb 6th to have an up to (excluding) pin:

I'm guessing this makes it ready to merge?

BTW, since we have a sensible error message, I'm not opposed to the alternative of keeping gitpython optional.

[netlify]

✅ Deploy Preview for conda-lock ready!

Name	Link
🔨 Latest commit	f51f6b3
🔍 Latest deploy log	https://app.netlify.com/sites/conda-lock/deploys/63eeaf587d025700084c6c75
😎 Deploy Preview	https://deploy-preview-318--conda-lock.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.