fix(deps): bump simple-git and @wordpress/env - #406

Sourced from simple-git's releases.

simple-git@4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

simple-git@4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3

... (truncated)

Sourced from simple-git's changelog.

4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,

... (truncated)

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Sourced from @​wordpress/env's changelog.

12.0.0 (2026-10-20)

Breaking Changes

• Raise the minimum required Node.js version to >=22.13.0, for stable require(esm) support (#84313).

Bug Fixes

• Download the PHPUnit test library for a WordPress alpha, beta or RC version from its X.Y branch of WordPress/wordpress-develop when that branch exists, instead of always from trunk. A maintenance branch between point releases, such as 7.1.4-alpha, no longer gets trunk's tests, which can depend on code only trunk has. A release falls back to its X.Y branch when its tag does not exist yet. Cached test libraries now also update to the fetched version instead of staying on the first one downloaded (#84758).

• 8d30f92 chore(release): publish
• e7922b3 Update changelog files
• e4d93b0 Merge changes published in the Gutenberg plugin "release/24.3" branch
• fa4301b Update changelog files
• 5c222d1 Merge changes published in the Gutenberg plugin "release/24.3" branch
• 2555c8d Update changelog files
• 558d1e6 Merge changes published in the Gutenberg plugin "release/24.3" branch
• See full diff in compare view