Anomaly: 3.1.50 has no GitHub release?

[lutzwillek-tomtom]

Anomaly: 3.1.50 has no GitHub release.

Every prior GitPython version follows a consistent release pattern:

3.1.46 → GitHub release ✅ + PyPI ✅
3.1.47 → GitHub release ✅ + PyPI ✅
3.1.48 → GitHub release ✅ + PyPI ✅
3.1.49 → GitHub release ✅ + PyPI ✅
3.1.50 → GitHub release ❌ (tag only) + PyPI ✅

The 3.1.50 tag exists and a PyPI package was published on May 6, 2026, but there is no corresponding GitHub release entry with release notes. This is a significant deviation from the established release process.

The GHSA ID for 3.1.50 is GHSA-mv93-w799-cj2w

Why this matters for supply chain security:
A PyPI package can be published by anyone with maintainer credentials — the PyPI upload alone does not confirm an intentional, reviewed release by the project maintainers. A proper GitHub release with associated release notes provides the second confirmation that the version was deliberately released via the official process. 3.1.50 lacks that confirmation.

The code commit itself (5453842) appears legitimate (co-authored by @Byron, the original maintainer), but the incomplete release process is a supply chain risk indicator that warrants caution.

I might be being overly cautious, yes.

[EliahKagan]

I think the absent or delayed GitHub release for 3.1.50 is unintended, and that the situation is similar to #2139 with 3.1.49.

In view of the (understandable) concern about supply chain security, I think it would worsen rather than improve the situation for me to attempt to make the GitHub release, since making GitHub releases for GitPython is not something I've been doing before.

The 3.1.50 tag is linked in changes.rst. I mention that in case it's relevant, but I don't think it necessarily addresses your concern. In addition to the global GHSA entry GHSA-mv93-w799-cj2w you referenced, there is also the repo-local GHSA-mv93-w799-cj2w, which helps demonstrate that a 3.1.50 release is intended.

cc @Byron

[Byron]

Sorry for the hassle - this was just me forgetting to click the additional button.

Here's the missing release on GitHub.
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50

Maybe beyond fixing this one occurrence, we could change our release script to use the GH tool to auto-generate a release on GitHub.
It's just a question if one can trigger it to auto generate the release notes just like you do from the web interface.