fix(deps): update dependency simple-git to v3.16.0 [security] #605
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.9.0
->3.16.0
GitHub Vulnerability Alerts
CVE-2022-25912
The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the
ext
transport protocol, which makes it exploitable viaclone()
method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.
Release Notes
steveukx/git-js (simple-git)
v3.16.0
Compare Source
Minor Changes
97fde2c
: Support the use of-B
in place of the default-b
in checkout methods0a623e5
: Adds vulnerability detection to prevent use of--upload-pack
and--receive-pack
without explicitly opting in.Patch Changes
ec97a39
: Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.v3.15.1
Compare Source
Patch Changes
de570ac
: Resolves an issue whereby non-strings can be passed into the config switch detector.v3.15.0
Compare Source
Minor Changes
7746480
: Disables the use of inline configuration arguments to prevent unitentionally allowing non-standard remote protocols without explicitly opting in to this practice with the newallowUnsafeProtocolOverride
property having been enabled.Patch Changes
7746480
: - Upgrade repo dependencies - lerna and jestv3.14.1
Compare Source
Patch Changes
5a2e7e4
: Add version parsing support for non-numeric patches (including "built from source" style1.11.GIT
)v3.14.0
Compare Source
Minor Changes
19029fc
: Create the abort plugin to allow cancelling all pending and future tasks.4259b26
: Add.version
to return git version information, including whether the git binary is installed.v3.13.0
Compare Source
Minor Changes
87b0d75
: Increase the level of deprecation notices for use ofsimple-git/promise
, which will be fully removed in the next majord0dceda
: Allow supplying just one of to/from in the options supplied to git.logPatch Changes
6b3e05c
: Use shared test utilities bundle in simple-git tests, to enable consistent testing across packages in the futurev3.12.0
Compare Source
Minor Changes
bfd652b
: Add a new configuration option to enable trimming white-space from the response togit.raw
v3.11.0
Compare Source
Minor Changes
80d54bd
: Added fields updated + deleted branch info to fetch response, closes #823Patch Changes
75dfcb4
: Add prettier configuration and apply formatting throughout.v3.10.0
Compare Source
Minor Changes
2f021e7
: Support for importing as an ES module with TypeScript moduleResolutionnode16
or newer by addingsimpleGit
as a named export.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.