[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: simple-git and @simple-git/argv-parser.

Updates simple-git from 3.36.0 to 4.0.1

Release notes

Sourced from simple-git's releases.

simple-git@4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  simpleGit({

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev, @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify for identifying the vulnerability.

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables

... (truncated)

Commits

• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Updates @simple-git/argv-parser from 1.1.1 to 2.0.0

Release notes

Sourced from @​simple-git/argv-parser's releases.

@​simple-git/argv-parser@​2.0.0

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @​NotAFlightRisk for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @​mrillicit for identifying include.path, filter.*.process
  • Thanks to @​tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @​threalwinky and @​nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @​sec-reex for the vulnerability report.

• Updated dependencies [98864c6]

  • @​simple-git/args-pathspec@​1.0.4

Changelog

Sourced from @​simple-git/argv-parser's changelog.

2.0.0

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @​bhaswanthc, @​NotAFlightRisk, @​oss-security-shopify for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @​bhaswanthc, @​mrillicit, @​avrlab233, @​avrlab233 for identifying include.path, filter.*.process
  • Thanks to @​tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @​threalwinky and @​nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @​sec-reex for the vulnerability report.

• Updated dependencies [98864c6]

  • @​simple-git/args-pathspec@​1.0.4

Commits

• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• c427fba Argument parser vulnerability checks (#1167)
• 1bb14df Merge pull request #1163 from steveukx/claude/add-git-config-vulnerabilities-...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml