Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @simple-git/argv-parser@2.0.1

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @oss-security-shopify for identifying the vulnerability.

Patch Changes

• 365f52d: Prepare package.json before publishing.

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  
  simpleGit({
    // explicitly allow the named environment variable so it can pass through.
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    // and enable the use of an unsafe behaviour
    unsafe: { allowUnsafeTemplateDir: true },
  });

  • Explicitly supplied disallowed environment variables will throw when used.

  // v3 used a single opt-in to potential unsafe actiity
  simpleGit({ unsafe: { allowUnsafeTemplateDir: true } })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();
  
  // v4 uses a double opt-in, allow the behaviour and the mechanism
  simpleGit({
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    unsafe: { allowUnsafeTemplateDir: true },
  })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();

  • Removed content deprecated during the v2 to v3 major change
    • simpleGit.silent() logging is configured through environment variables in the debug package
    • simpleGit.clearQueue() this has been a noop since v3, switch to using the abort plugin
    • Accessing parsed properties of a GitResponseError through a trailing callback function are available only through the error.git property (previously properties were also spread onto the error itself with a deprecation notice).

Minor Changes

• 98864c6: Support one-shot stdin via git.input(data) (string or Buffer).

  Thanks to @felipecrs for the feature request and initial implementation.

Patch Changes

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @gdegrange for the vulnerability report.

• 76f308e: Parse binary rename entries without byte counts in diff summaries.

• Updated dependencies [c427fba]

• Updated dependencies [1bb14df]

• Updated dependencies [dfeb116]

• Updated dependencies [d762810]

• Updated dependencies [d762810]

• Updated dependencies [98864c6]

  • @simple-git/argv-parser@2.0.0
  • @simple-git/args-pathspec@1.0.4

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @NotAFlightRisk for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @mrillicit for identifying include.path, filter.*.process
  • Thanks to @tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @threalwinky and @nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where
  the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked
    under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously
    grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and
    are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters
  (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are
  unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @sec-reex for the vulnerability report.

• Updated dependencies [98864c6]

  • @simple-git/args-pathspec@1.0.4

Patch Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @NotAFlightRisk for identifying the vulnerability

Patch Changes

• c38a674: Add backward compatible API, resolves issue caused by using simple-git@3.35.2 with @simple-git/argv-parser@1.1.0

Minor Changes

• 89a2294: Extend known exploitable configuration keys and per-task environment variables.

  Note - ParsedVulnerabilities from argv-parser is removed in favour of a readonly array of Vulnerability to match usage in simple-git, rolled into the new vulnerabilityCheck for simpler access to the identified issues.

  Thanks to @zebbern for identifying the need to block core.fsmonitor.
  Thanks to @kodareef5 for identifying the need to block GIT_CONFIG_COUNT environment variables and --template / merge related config.

Patch Changes

• 1ad57e8: Remove conflicting node:buffer import
• Updated dependencies [89a2294]
• Updated dependencies [675570a]
  • @simple-git/argv-parser@1.1.0
  • @simple-git/args-pathspec@1.0.3

Minor Changes

• 89a2294: Extend known exploitable configuration keys and per-task environment variables.

  Note - ParsedVulnerabilities from argv-parser is removed in favour of a readonly array of Vulnerability to match usage in simple-git, rolled into the new vulnerabilityCheck for simpler access to the identified issues.

  Thanks to @zebbern for identifying the need to block core.fsmonitor.
  Thanks to @kodareef5 for identifying the need to block GIT_CONFIG_COUNT environment variables and --template / merge related config.

Patch Changes

• 675570a: Update devDependencies
• Updated dependencies [675570a]
  • @simple-git/args-pathspec@1.0.3

Patch Changes

• 675570a: Update devDependencies