xapi-service icon indicating copy to clipboard operation
xapi-service copied to clipboard

Published 20 hours ago • verified publisher icon LearningLocker

chore(deps): update dependency simple-git to v3.16.0 [security]

Open renovate[bot] opened this issue 1 year ago • 1 comments

This PR contains the following updates:

Package Change Age Confidence
simple-git (source) 3.5.0 -> 3.16.0 age confidence

GitHub Vulnerability Alerts

CVE-2022-25912

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

CVE-2022-25860

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.

Release Notes

steveukx/git-js (simple-git)

v3.16.0

Compare Source

Minor Changes
  • 97fde2c: Support the use of -B in place of the default -b in checkout methods
  • 0a623e5: Adds vulnerability detection to prevent use of --upload-pack and --receive-pack without explicitly opting in.
Patch Changes
  • ec97a39: Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @​stsewd for the suggestion.

v3.15.1

Compare Source

Patch Changes
  • de570ac: Resolves an issue whereby non-strings can be passed into the config switch detector.

v3.15.0

Compare Source

Minor Changes
  • 7746480: Disables the use of inline configuration arguments to prevent unitentionally allowing non-standard remote protocols without explicitly opting in to this practice with the new allowUnsafeProtocolOverride property having been enabled.
Patch Changes
  • 7746480: - Upgrade repo dependencies - lerna and jest
    • Include node@​19 in the test matrix

v3.14.1

Compare Source

Patch Changes
  • 5a2e7e4: Add version parsing support for non-numeric patches (including "built from source" style 1.11.GIT)

v3.14.0

Compare Source

Minor Changes
  • 19029fc: Create the abort plugin to allow cancelling all pending and future tasks.
  • 4259b26: Add .version to return git version information, including whether the git binary is installed.

v3.13.0

Compare Source

Minor Changes
  • 87b0d75: Increase the level of deprecation notices for use of simple-git/promise, which will be fully removed in the next major
  • d0dceda: Allow supplying just one of to/from in the options supplied to git.log
Patch Changes
  • 6b3e05c: Use shared test utilities bundle in simple-git tests, to enable consistent testing across packages in the future

v3.12.0

Compare Source

Minor Changes
  • bfd652b: Add a new configuration option to enable trimming white-space from the response to git.raw

v3.11.0

Compare Source

Minor Changes
  • 80d54bd: Added fields updated + deleted branch info to fetch response, closes #​823
Patch Changes
  • 75dfcb4: Add prettier configuration and apply formatting throughout.

v3.10.0

Compare Source

Minor Changes
  • 2f021e7: Support for importing as an ES module with TypeScript moduleResolution node16 or newer by adding simpleGit as a named export.

v3.9.0

Compare Source

Minor Changes
  • a0d4eb8: Branches that have been checked out as a linked work tree will now be included in the BranchSummary output, with a linkedWorkTree property set to true in the BranchSummaryBranch.

v3.8.0

Compare Source

Minor Changes

  • 25230cb: Support for additional log formats in diffSummary / log / stashList.

    Adds support for the --numstat, --name-only and --name-stat in addition to the existing --stat option.

Patch Changes
  • 2cfc16f: Update CI environments to run build and test in node v18, drop node v12 now out of life.
  • 13197f1: Update debug dependency to latest 4.x

v3.7.1

Compare Source

Patch Changes
  • adb4346: Resolves issue whereby renamed files no longer appear correctly in the response to git.status.

v3.7.0

Compare Source

Minor Changes
  • fa2c7f7: Enable the use of types when loading with module-resolution
Patch Changes
  • 3805f6b: Timeout plugin no longer keeps short lived processes alive until timeout is hit

v3.6.0

Compare Source

Minor Changes
  • f2fc5c9: Show full commit hash in a CommitResult, prior to this change git.commit would result in a partial hash in the commit property if core.abbrev is unset or has a value under 40. Following this change the commit property will contain the full commit hash.
Patch Changes
  • c4a2a13: chore(deps): bump minimist from 1.2.5 to 1.2.6

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Aug 06 '24 13:08 renovate[bot]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

renovate[bot] avatar Aug 06 '24 13:08 renovate[bot]