Skip to content

Bump the npm_and_yarn group across 2 directories with 4 updates - #505

Merged
mudabs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8cd253a1c4
Oct 11, 2026
Merged

Bump the npm_and_yarn group across 2 directories with 4 updates#505
mudabs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8cd253a1c4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 4 updates in the / directory: simple-git, @simple-git/argv-parser, proxy-addr and shell-quote.
Bumps the npm_and_yarn group with 1 update in the /boneset-api directory: proxy-addr.

Updates simple-git from 3.36.0 to 4.0.1

Release notes

Sourced from simple-git's releases.

simple-git@4.0.1

Patch Changes

  • 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

  • 98864c6: Major upgrade to v4. In this version:

    • Removed previously available default export, now uses a consistently named simpleGit export.
    • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
    • Removed legacy gitP export (change to using the main simpleGit export).
    // v3 - previously supported imports
import simpleGit from "simple-git";
import { gitP } from "simple-git";
import simpleGit from "simple-git/promise";
const simpleGit = require("simple-git");
// v4 - consolidates to a single supported import
import { simpleGit } from "simple-git";
const { simpleGit } = require("simple-git");

    • Prevents the use of abbreviated long-form git options:
    // v3 - allowed the use of unambiguous long-form options
git.raw("clone", "--conf=user.name=me", "...");
// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
git.raw("fetch", "--config=user.name=me", "...");

    • Ambient environment variables are filtered before passing into the git child process.
    // v3
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process can see both environment variables
// v4
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process now sees only FOO
simpleGit({

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.1

Patch Changes

  • 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

  • 98864c6: Major upgrade to v4. In this version:

    • Removed previously available default export, now uses a consistently named simpleGit export.
    • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
    • Removed legacy gitP export (change to using the main simpleGit export).
    // v3 - previously supported imports
import simpleGit from "simple-git";
import { gitP } from "simple-git";
import simpleGit from "simple-git/promise";
const simpleGit = require("simple-git");
// v4 - consolidates to a single supported import
import { simpleGit } from "simple-git";
const { simpleGit } = require("simple-git");

    • Prevents the use of abbreviated long-form git options:
    // v3 - allowed the use of unambiguous long-form options
git.raw("clone", "--conf=user.name=me", "...");
// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
git.raw("fetch", "--config=user.name=me", "...");

    Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev, @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify for identifying the vulnerability.

    • Ambient environment variables are filtered before passing into the git child process.
    // v3
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process can see both environment variables

... (truncated)

Commits

Updates @simple-git/argv-parser from 1.1.1 to 2.0.0

Release notes

Sourced from @​simple-git/argv-parser's releases.

@​simple-git/argv-parser@​2.0.0

Major Changes

  • 98864c6: Updates ahead of the v4 release for simple-git.

    • Adds support for TypeScript declaration maps

    • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

    • Adds detection for includeIf.<condition>.path, thanks to @​NotAFlightRisk for identifying the vulnerability

Patch Changes

  • c427fba: Additional argument parser vulnerability checks:

    • Thanks to @​mrillicit for identifying include.path, filter.*.process
    • Thanks to @​tejas619 for identifying url.*.insteadOf

  • 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

    Thanks to @​threalwinky and @​nuc13us for identifying.

  • dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

    • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
    • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

    These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

  • d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

    Thanks to @​gdegrange for the vulnerability report.

  • d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

    Thanks to @​sec-reex for the vulnerability report.

  • Updated dependencies [98864c6]

    • @​simple-git/args-pathspec@​1.0.4
Changelog

Sourced from @​simple-git/argv-parser's changelog.

2.0.0

Major Changes

  • 98864c6: Updates ahead of the v4 release for simple-git.

    • Adds support for TypeScript declaration maps

    • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

    • Adds detection for includeIf.<condition>.path, thanks to @​bhaswanthc, @​NotAFlightRisk, @​oss-security-shopify for identifying the vulnerability

Patch Changes

  • c427fba: Additional argument parser vulnerability checks:

  • 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

    Thanks to @​threalwinky and @​nuc13us for identifying.

  • dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

    • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
    • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

    These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

  • d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

    Thanks to @​gdegrange for the vulnerability report.

  • d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

    Thanks to @​sec-reex for the vulnerability report.

  • Updated dependencies [98864c6]

    • @​simple-git/args-pathspec@​1.0.4
Commits

Updates proxy-addr from 2.0.7 to 2.0.8

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

What's Changed

New Contributors

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

Commits
  • a11ad82 2.0.8 (#70)
  • 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
  • 92e103e fix(ci): use publised as release trigger event (#71)
  • 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
  • 4b9db81 chore(ci): npm-publish via workflows (#54)
  • 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
  • 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
  • 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
  • 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
  • 0d45e2a Fix "arugment" typo in README (#61)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.


Updates shell-quote from 1.9.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

Commits

  • [New] parse: support tab-stripping here-documents (&lt;&lt;-) dbfac37
  • [New] parse: support output process substitution (&gt;() 2053315
  • [New] parse: support the case test-next terminator (;;&) 7d688b9
  • [New] parse: support the case fall-through terminator (;&) f27010e
  • [New] parse: support redirecting output despite noclobber (&gt;|) b78d19c
  • [New] parse: support opening a file for reading and writing (&lt;&gt;) 21cc333
  • [New] parse: support redirecting stdout and stderr (&&gt;) 6ad6cd2
  • [New] parse: support appending stdout and stderr (&&gt;&gt;) 90cde9c
  • [Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

Commits

  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e
  • [Fix] parse: preserve text after special shell parameters 81b08a5
  • [Fix] parse: an escaped backslash does not escape the character after it d708019
  • [Fix] quote: preserve ! in arguments that also contain ' ad39927
  • [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
  • [Fix] quote: preserve empty glob patterns 35c9b97
  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
  • [meta] npmignore some files ebfc308
  • [actions] add permissions 3429b0d
  • [actions] set least-privilege cache-mode 36f2394
  • [Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

Commits

  • [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
  • [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

... (truncated)

Commits
  • 6ecb8aa v1.12.0
  • 3a7b4ae [Dev Deps] update @ljharb/eslint-config
  • 7d688b9 [New] parse: support the case test-next terminator (;;&)
  • f27010e [New] parse: support the case fall-through terminator (;&)
  • 90cde9c [New] parse: support appending stdout and stderr (&>>)
  • 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
  • 2053315 [New] parse: support output process substitution (>()
  • b78d19c [New] parse: support redirecting output despite noclobber (>|)
  • 21cc333 [New] parse: support opening a file for reading and writing (\<>)
  • dbfac37 [New] parse: support tab-stripping here-documents (<<-)
  • Additional commits viewable in compare view

Updates proxy-addr from 2.0.7 to 2.0.8

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

What's Changed

New Contributors

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

Commits
  • a11ad82 2.0.8 (#70)
  • 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
  • 92e103e fix(ci): use publised as release trigger event (#71)
  • 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
  • 4b9db81 chore(ci): npm-publish via workflows (#54)
  • 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
  • 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
  • 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
  • 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
  • 0d45e2a Fix "arugment" typo in README (#61)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 2 directories with 4 updates
d3ef3b5 
Bumps the npm_and_yarn group with 4 updates in the / directory: [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git), [@simple-git/argv-parser](https://github.com/steveukx/git-js/tree/HEAD/packages/argv-parser), [proxy-addr](https://github.com/jshttp/proxy-addr) and [shell-quote](https://github.com/ljharb/shell-quote).
Bumps the npm_and_yarn group with 1 update in the /boneset-api directory: [proxy-addr](https://github.com/jshttp/proxy-addr).


Updates `simple-git` from 3.36.0 to 4.0.1
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/simple-git@4.0.1/simple-git)

Updates `@simple-git/argv-parser` from 1.1.1 to 2.0.0
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/packages/argv-parser/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/@simple-git/argv-parser@2.0.0/packages/argv-parser)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `shell-quote` from 1.9.0 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.9.0...v1.12.0)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

---
updated-dependencies:
- dependency-name: simple-git
  dependency-version: 4.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@simple-git/argv-parser"
  dependency-version: 2.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 11, 2026
@dependabot dependabot Bot mentioned this pull request Oct 11, 2026
Closed
@mudabs
mudabs merged commit ecc4c7e into main Oct 11, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-8cd253a1c4 branch October 11, 2026 18:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jacksayshi jacksayshi Awaiting requested review from jacksayshi jacksayshi is a code owner
@UcheWendy UcheWendy Awaiting requested review from UcheWendy
@leandrumartin leandrumartin Awaiting requested review from leandrumartin leandrumartin is a code owner
@mudabs mudabs Awaiting requested review from mudabs mudabs is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mudabs