GeezerVison

GitPython is not imported anywhere in this repo (grep -rn "import git" finds nothing) — it is a transitive dependency of python-semantic-release. Hard-pinning a transitive dep to an exact patch version has two downsides worth weighing:

1. Resolver fragility. If a future python-semantic-release 10.6.x tightens its GitPython range past 3.1.59, pip install -r requirements-release.txt in the release env (hatch.toml:40) fails outright rather than resolving. The release-bump job then breaks for a reason unrelated to this repo.
2. No patch uptake. GitPython has a history of security advisories (e.g. CVE-2022-24439, CVE-2023-40590, CVE-2023-41040 — untrusted search path / argument injection). An == pin means a fixed patch release will not be picked up until someone edits this line by hand.

Every other requirement in this repo uses a minor-series wildcard (python-semantic-release == 10.6.*, and all of requirements-testing.txt). Suggest matching that convention:

GitPython == 3.1.*

If an exact pin is deliberate — i.e. a specific GitPython release broke the bump — please add a short comment naming the breakage (as requirements-testing.txt:8-9 does for black), so a future reader knows when the pin can be relaxed. The commit message ("chore: pin GitPython for release bump") does not record the reason.