fix(deps): update dependency simple-git to v4 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
simple-git (source)	^3.0.0 → ^4.0.0

---

Release Notes

steveukx/git-js (simple-git)

v4.0.2

Compare Source

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@2.0.1

v4.0.1

Compare Source

Patch Changes

• 365f52d: Prepare package.json before publishing.

v4.0.0

Compare Source

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,
  @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify
  for identifying the vulnerability.

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  
  simpleGit({
    // explicitly allow the named environment variable so it can pass through.
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    // and enable the use of an unsafe behaviour
    unsafe: { allowUnsafeTemplateDir: true },
  });

  • Explicitly supplied disallowed environment variables will throw when used.

  // v3 used a single opt-in to potential unsafe actiity
  simpleGit({ unsafe: { allowUnsafeTemplateDir: true } })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();
  
  // v4 uses a double opt-in, allow the behaviour and the mechanism
  simpleGit({
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    unsafe: { allowUnsafeTemplateDir: true },
  })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();

  • Removed content deprecated during the v2 to v3 major change
    • simpleGit.silent() logging is configured through environment variables in the debug package
    • simpleGit.clearQueue() this has been a noop since v3, switch to using the abort plugin
    • Accessing parsed properties of a GitResponseError through a trailing callback function are available only through the error.git property (previously properties were also spread onto the error itself with a deprecation notice).

Minor Changes

• 98864c6: Support one-shot stdin via git.input(data) (string or Buffer).

  Thanks to @​felipecrs for the feature request and initial implementation.

Patch Changes

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• 76f308e: Parse binary rename entries without byte counts in diff summaries.

• Updated dependencies [c427fba]

• Updated dependencies [1bb14df]

• Updated dependencies [dfeb116]

• Updated dependencies [d762810]

• Updated dependencies [d762810]

• Updated dependencies [98864c6]

  • @​simple-git/argv-parser@2.0.0
  • @​simple-git/args-pathspec@1.0.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 430cd0a9-de0e-491b-86ef-63f5e8585d89

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}