CM-70014: update dependencies (Aug 2026)

- marshmallow 3.26.2 -> 4.0.1 (capped <4.1.0; 4.1+ drops Python 3.9)
- rich 13.9.4 -> 15.0.0
- gitpython 3.1.50 -> 3.1.57 (floor raised to 3.1.51)
- pyinstaller 6.20.0 -> 6.21.0
- poetry.lock refreshed (7-day solver cooldown)

GitPython only inverts the `R` flag when diffing the index against HEAD, not against the
empty tree, so pre-commit scans of a repository with no commits yet sent staged content as
removed lines. Centralize the diff in get_staged_diff_index() so both call sites get a patch
oriented with staged content as additions, and assert that orientation in tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: omer-roth

cycode/cli/apps/scan/commit_range_scanner.py

@@ -27,7 +27,7 @@
     get_diff_file_content,
     get_diff_file_path,
     get_pre_commit_modified_documents,
-    get_safe_head_reference_for_diff,
+    get_staged_diff_index,
     parse_commit_range,
 )
 from cycode.cli.files_collector.documents_walk_ignore import filter_documents_with_cycodeignore
@@ -360,8 +360,7 @@ def _scan_sca_pre_commit(ctx: typer.Context, repo_path: str) -> None:
 def _scan_secret_pre_commit(ctx: typer.Context, repo_path: str) -> None:
     progress_bar = ctx.obj['progress_bar']
     repo = git_proxy.get_repo(repo_path)
-    head_reference = get_safe_head_reference_for_diff(repo)
-    diff_index = repo.index.diff(head_reference, create_patch=True, R=True)
+    _, diff_index = get_staged_diff_index(repo)
 
     progress_bar.set_section_length(ScanProgressBarSection.PREPARE_LOCAL_FILES, len(diff_index))
 

cycode/cli/files_collector/commit_range_documents.py

@@ -15,7 +15,7 @@
 from cycode.logger import get_logger
 
 if TYPE_CHECKING:
-    from git import Diff, Repo
+    from git import Diff, DiffIndex, Repo
 
     from cycode.cli.utils.progress_bar import BaseProgressBar, ProgressBarSection
 
@@ -47,6 +47,23 @@ def get_safe_head_reference_for_diff(repo: 'Repo') -> str:
         return consts.GIT_EMPTY_TREE_OBJECT
 
 
+def get_staged_diff_index(repo: 'Repo') -> tuple[str, 'DiffIndex']:
+    """Diff the index against HEAD, or against the empty tree in repositories with no commits.
+
+    GitPython only inverts the `R` flag for HEAD, so `R` must be off for the empty tree to keep
+    staged content showing up as added lines in both cases.
+
+    Args:
+        repo: Git repository object
+
+    Returns:
+        The reference that was diffed against, and the resulting diff index
+    """
+    head_reference = get_safe_head_reference_for_diff(repo)
+    reverse = head_reference == consts.GIT_HEAD_COMMIT_REV
+    return head_reference, repo.index.diff(head_reference, create_patch=True, R=reverse)
+
+
 def _does_reach_to_max_commits_to_scan_limit(commit_ids: list[str], max_commits_count: Optional[int]) -> bool:
     if max_commits_count is None:
         return False
@@ -411,8 +428,7 @@ def get_pre_commit_modified_documents(
     diff_documents = []
 
     repo = git_proxy.get_repo(repo_path)
-    head_reference = get_safe_head_reference_for_diff(repo)
-    diff_index = repo.index.diff(head_reference, create_patch=True, R=True)
+    head_reference, diff_index = get_staged_diff_index(repo)
     progress_bar.set_section_length(progress_bar_section, len(diff_index))
     for diff in diff_index:
         progress_bar.update(progress_bar_section)