Bump simple-git from 3.27.0 to 3.36.0 by dependabot[bot] · Pull Request #6112 · EdgeApp/edge-react-gui

dependabot · 2026-07-27T18:33:33Z

Bumps simple-git from 3.27.0 to 3.36.0.

Release notes

simple-git@3.36.0

Minor Changes

89a2294: Extend known exploitable configuration keys and per-task environment variables.

Note - ParsedVulnerabilities from argv-parser is removed in favour of a readonly array of Vulnerability to match usage in simple-git, rolled into the new vulnerabilityCheck for simpler access to the identified issues.

Thanks to @zebbern for identifying the need to block core.fsmonitor. Thanks to @kodareef5 for identifying the need to block GIT_CONFIG_COUNT environment variables and --template / merge related config.

Patch Changes

1ad57e8: Remove conflicting node:buffer import

Updated dependencies [89a2294]

Updated dependencies [675570a]

@simple-git/argv-parser@1.1.0

@simple-git/args-pathspec@1.0.3

simple-git@3.35.2

Patch Changes

0cf9d8c: Improvements for mono-repo publishing pipeline

Updated dependencies [0cf9d8c]

@simple-git/args-pathspec@1.0.2

@simple-git/argv-parser@1.0.3

simple-git@3.35.1

Patch Changes

0de400e: Update monorepo version handling during publish

Updated dependencies [0de400e]

@simple-git/argv-parser@1.0.2

simple-git@3.33.0

Minor Changes

a263635: Use pathspec wrappers for remote and local paths when running either git.clone or git.mirror to avoid leaving them less open for unexpected outcomes when passing unsanitised data into these tasks.

Patch Changes

e253a0d: Enhanced git -c checks in unsafe plugin.

Thanks to @JohannesLks for identifying the issue

simple-git@3.32.3

Patch Changes

f704208: Enhanced protocol.allow checks in allowUnsafeExtProtocol handling.

... (truncated)

Changelog

Sourced from simple-git's changelog.

3.36.0

Minor Changes

89a2294: Extend known exploitable configuration keys and per-task environment variables.

Note - ParsedVulnerabilities from argv-parser is removed in favour of a readonly array of Vulnerability to match usage in simple-git, rolled into the new vulnerabilityCheck for simpler access to the identified issues.

Thanks to @zebbern for identifying the need to block core.fsmonitor. Thanks to @kodareef5 for identifying the need to block GIT_CONFIG_COUNT environment variables and --template / merge related config.

Patch Changes

1ad57e8: Remove conflicting node:buffer import

Updated dependencies [89a2294]

Updated dependencies [675570a]

@simple-git/argv-parser@1.1.0

@simple-git/args-pathspec@1.0.3

3.35.2

Patch Changes

0cf9d8c: Improvements for mono-repo publishing pipeline

Updated dependencies [0cf9d8c]

@simple-git/args-pathspec@1.0.2

@simple-git/argv-parser@1.0.3

3.35.1

Patch Changes

0de400e: Update monorepo version handling during publish

Updated dependencies [0de400e]

@simple-git/argv-parser@1.0.2

3.35.0

Minor Changes

3d8708b: Updating publish config

Patch Changes

Updated dependencies [3d8708b]

@simple-git/args-pathspec@1.0.1

@simple-git/argv-parser@1.0.1

3.34.0

... (truncated)

Commits

7dc1a53 Version Packages
76f5376 Merge pull request #1061 from Vinzent03/fix/buffer-import
89a2294 Environment Parsing (#1156)
1b91b76 fix: remove explicit node:buffer import
e390685 Version Packages
3c9e4b8 Pin version of @simple-git/args-pathspec
94ee21f Export pathspec types through simple-git for backward compatibility
6d7cb51 Version Packages
0de400e Switch to semver from workspace revisions
2264722 Version Packages
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for simple-git since your current version.

Note

Medium Risk
Touches the library that shells out to git (via git-refresher), so behavior of git operations could change slightly, but the upgrade is largely security hardening rather than new app logic.

Overview
Updates package-lock.json so the resolved simple-git version moves from 3.27.0 to 3.36.0 (pulled in via git-refresher’s ^3.27.0 range).

The lockfile also adds @simple-git/args-pathspec and @simple-git/argv-parser as direct dependencies of simple-git, and bumps its debug dependency to ^4.4.0. There are no application source changes in this PR—only the lockfile resolution.

Between these versions, simple-git adds hardening around git invocation (e.g. blocking more exploitable config/env keys, stronger git -c / protocol.allow checks, and pathspec wrapping for clone / mirror), which is the main functional impact for anything that runs git through this stack.

^{Reviewed by Cursor Bugbot for commit b6d2be8. Bugbot is set up for automated code reviews on this repo. Configure here.}

Bumps [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) from 3.27.0 to 3.36.0. - [Release notes](https://github.com/steveukx/git-js/releases) - [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md) - [Commits](https://github.com/steveukx/git-js/commits/simple-git@3.36.0/simple-git) --- updated-dependencies: - dependency-name: simple-git dependency-version: 3.36.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-05T23:44:48Z