chore(deps): update dependency simple-git to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
simple-git (source)	3.36.0 → 4.0.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

steveukx/git-js (simple-git)

v4.0.2

Compare Source

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@2.0.1

v4.0.1

Compare Source

Patch Changes

• 365f52d: Prepare package.json before publishing.

v4.0.0

Compare Source

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,
  @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify
  for identifying the vulnerability.

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  
  simpleGit({
    // explicitly allow the named environment variable so it can pass through.
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    // and enable the use of an unsafe behaviour
    unsafe: { allowUnsafeTemplateDir: true },
  });

  • Explicitly supplied disallowed environment variables will throw when used.

  // v3 used a single opt-in to potential unsafe actiity
  simpleGit({ unsafe: { allowUnsafeTemplateDir: true } })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();
  
  // v4 uses a double opt-in, allow the behaviour and the mechanism
  simpleGit({
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    unsafe: { allowUnsafeTemplateDir: true },
  })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();

  • Removed content deprecated during the v2 to v3 major change
    • simpleGit.silent() logging is configured through environment variables in the debug package
    • simpleGit.clearQueue() this has been a noop since v3, switch to using the abort plugin
    • Accessing parsed properties of a GitResponseError through a trailing callback function are available only through the error.git property (previously properties were also spread onto the error itself with a deprecation notice).

Minor Changes

• 98864c6: Support one-shot stdin via git.input(data) (string or Buffer).

  Thanks to @​felipecrs for the feature request and initial implementation.

Patch Changes

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• 76f308e: Parse binary rename entries without byte counts in diff summaries.

• Updated dependencies [c427fba]

• Updated dependencies [1bb14df]

• Updated dependencies [dfeb116]

• Updated dependencies [d762810]

• Updated dependencies [d762810]

• Updated dependencies [98864c6]

  • @​simple-git/argv-parser@2.0.0
  • @​simple-git/args-pathspec@1.0.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs.npmx.dev	Error		Oct 18, 2026 2:09am UTC
npmx.dev	Error		Oct 18, 2026 2:09am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
npmx-lunaria	Ignored		Oct 18, 2026 2:09am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	simple-git@​4.0.2

View full report

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[github-actions]

📊 Dependency Size Changes

Warning

This PR adds 382.8 kB of new dependencies, which exceeds the threshold of 200 kB.

📦 Package	📏 Size
simple-git@4.0.2	872 kB
@vue/language-core@3.3.6	-386.5 kB
@simple-git/argv-parser@2.0.1	129.1 kB
@jridgewell/sourcemap-codec@1.5.5	-87 kB
magic-string@1.1.0	-68 kB
vue-component-meta@3.3.6	-55.5 kB
tinyexec@1.2.4	-22.9 kB
@simple-git/args-pathspec@1.0.3 → @simple-git/args-pathspec@1.0.4	1.6 kB

Total size change: 382.8 kB