[dependabot]

Bumps @simple-git/argv-parser to 2.0.1 and updates ancestor dependency simple-git. These dependencies need to be updated together.

Updates @simple-git/argv-parser from 1.1.1 to 2.0.1

Release notes

Sourced from @​simple-git/argv-parser's releases.

@​simple-git/argv-parser@​2.0.1

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

@​simple-git/argv-parser@​2.0.0

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @​NotAFlightRisk for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @​mrillicit for identifying include.path, filter.*.process
  • Thanks to @​tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @​threalwinky and @​nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @​sec-reex for the vulnerability report.

• Updated dependencies [98864c6]

  • @​simple-git/args-pathspec@​1.0.4

Changelog

Sourced from @​simple-git/argv-parser's changelog.

2.0.1

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

2.0.0

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @​bhaswanthc, @​NotAFlightRisk, @​oss-security-shopify for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @​bhaswanthc, @​mrillicit, @​avrlab233, @​avrlab233 for identifying include.path, filter.*.process
  • Thanks to @​tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @​threalwinky and @​nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @​sec-reex for the vulnerability report.

... (truncated)

Commits

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• c427fba Argument parser vulnerability checks (#1167)
• 1bb14df Merge pull request #1163 from steveukx/claude/add-git-config-vulnerabilities-...
• See full diff in compare view

Updates simple-git from 3.36.0 to 4.0.2

Release notes

Sourced from simple-git's releases.

simple-git@4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

simple-git@4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,

... (truncated)

Commits

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
simple-git	[>= 4.a, < 5]