chore(deps): bump simple-git from 3.36.0 to 4.0.2

[dependabot]

Bumps simple-git from 3.36.0 to 4.0.2.

Release notes

Sourced from simple-git's releases.

simple-git@4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

simple-git@4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,

... (truncated)

Commits

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

Confidence Score: 5/5

[High risk] Bumps the git library to a major version.

The PR appears safe to merge based on the code and dependency records reviewed.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump simple-git from 3.36.0..."}