chore(deps): bump @simple-git/argv-parser and simple-git

[dependabot]

Bumps @simple-git/argv-parser to 2.0.1 and updates ancestor dependency simple-git. These dependencies need to be updated together.

Updates @simple-git/argv-parser from 1.1.1 to 2.0.1

Release notes

Sourced from @​simple-git/argv-parser's releases.

@​simple-git/argv-parser@​2.0.1

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

@​simple-git/argv-parser@​2.0.0

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @​NotAFlightRisk for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @​mrillicit for identifying include.path, filter.*.process
  • Thanks to @​tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @​threalwinky and @​nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @​sec-reex for the vulnerability report.

• Updated dependencies [98864c6]

  • @​simple-git/args-pathspec@​1.0.4

Changelog

Sourced from @​simple-git/argv-parser's changelog.

2.0.1

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

2.0.0

Major Changes

• 98864c6: Updates ahead of the v4 release for simple-git.

  • Adds support for TypeScript declaration maps

  • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

  • Adds detection for includeIf.<condition>.path, thanks to @​bhaswanthc, @​NotAFlightRisk, @​oss-security-shopify for identifying the vulnerability

Patch Changes

• c427fba: Additional argument parser vulnerability checks:

  • Thanks to @​bhaswanthc, @​mrillicit, @​avrlab233, @​avrlab233 for identifying include.path, filter.*.process
  • Thanks to @​tejas619 for identifying url.*.insteadOf

• 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

  Thanks to @​threalwinky and @​nuc13us for identifying.

• dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

  • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
  • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

  These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

  Thanks to @​sec-reex for the vulnerability report.

... (truncated)

Commits

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• c427fba Argument parser vulnerability checks (#1167)
• 1bb14df Merge pull request #1163 from steveukx/claude/add-git-config-vulnerabilities-...
• See full diff in compare view

Updates simple-git from 3.36.0 to 4.0.2

Release notes

Sourced from simple-git's releases.

simple-git@4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

simple-git@4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,

... (truncated)

Commits

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

🟢 Approval recommended

Existing usage already uses the supported named export and no incompatible v4 options were found.

0 open findings

What changed in this PR

Updates simple-git to v4, including coordinated parser security improvements.

Changes:

• Bumps simple-git from v3 to v4.0.2.
• Updates related argument-parser dependencies and lockfile integrity data.

File	Description
package.json	Updates the direct simple-git dependency.
package-lock.json	Locks compatible simple-git and parser versions.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jricardo1]

Can someone approve and release this change? This is getting blocked in our internal pipelines because of CVEs in this version of simple-git and @simple-git/argv-parser.