chore(deps-dev): Bump simple-git from 3.36.0 to 4.0.1

[dependabot]

Bumps simple-git from 3.36.0 to 4.0.1.

Release notes

Sourced from simple-git's releases.

simple-git@4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  simpleGit({

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev, @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify for identifying the vulnerability.

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables

... (truncated)

Commits

• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.