Update dependency simple-git to v4

[renovate-desselbane]

This PR contains the following updates:

Package	Type	Update	Change	Pending
simple-git (source)	devDependencies	major	3.36.0 → 4.0.1	4.0.2

---

Release Notes

steveukx/git-js (simple-git)

v4.0.1

Compare Source

Patch Changes

• 365f52d: Prepare package.json before publishing.

v4.0.0

Compare Source

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,
  @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify
  for identifying the vulnerability.

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  
  simpleGit({
    // explicitly allow the named environment variable so it can pass through.
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    // and enable the use of an unsafe behaviour
    unsafe: { allowUnsafeTemplateDir: true },
  });

  • Explicitly supplied disallowed environment variables will throw when used.

  // v3 used a single opt-in to potential unsafe actiity
  simpleGit({ unsafe: { allowUnsafeTemplateDir: true } })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();
  
  // v4 uses a double opt-in, allow the behaviour and the mechanism
  simpleGit({
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    unsafe: { allowUnsafeTemplateDir: true },
  })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();

  • Removed content deprecated during the v2 to v3 major change
    • simpleGit.silent() logging is configured through environment variables in the debug package
    • simpleGit.clearQueue() this has been a noop since v3, switch to using the abort plugin
    • Accessing parsed properties of a GitResponseError through a trailing callback function are available only through the error.git property (previously properties were also spread onto the error itself with a deprecation notice).

Minor Changes

• 98864c6: Support one-shot stdin via git.input(data) (string or Buffer).

  Thanks to @​felipecrs for the feature request and initial implementation.

Patch Changes

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• 76f308e: Parse binary rename entries without byte counts in diff summaries.

• Updated dependencies [c427fba]

• Updated dependencies [1bb14df]

• Updated dependencies [dfeb116]

• Updated dependencies [d762810]

• Updated dependencies [d762810]

• Updated dependencies [98864c6]

  • @​simple-git/argv-parser@2.0.0
  • @​simple-git/args-pathspec@1.0.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[changeset-bot]

🦋 Changeset detected

Latest commit: 87b2124

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@repo/scripts	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR