Skip to content

upgrade vulnerable dependencies and migrate to simple-git v4 - #739

Open
tusharf5 wants to merge 2 commits into
DataDog:mainfrom
tusharf5:bump-deps
Open

tusharf5 wants to merge 2 commits into
DataDog:mainfrom
tusharf5:bump-deps

Conversation

@tusharf5

@tusharf5 tusharf5 commented Oct 8, 2026

Copy link
Copy Markdown

What does this PR do?

Dependency audits identified vulnerabilities in simple-git, @simple-git/argv-parser, basic-ftp, and other transitive dependencies across the root and e2e projects.

Upgrade affected dependencies, refresh both Yarn lockfiles, and replace the removed gitP() API with simpleGit(). Verify builds, tests, lint, formatting, and audits on Node 22 and 24.

Motivation

Lots of dependency vulnerabilities at work came from this plugin.

Testing Guidelines

Ran the test suite in both node 22 and node 24. Added new tests. If a beta release is possible, I am willing to test this at work in a real project.

Additional Notes

Types of changes

  • Bug fix
  • New feature
  • Breaking change
  • Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests
  • This PR collects user input/sensitive content into Datadog

@tusharf5

tusharf5 commented Oct 8, 2026

Copy link
Copy Markdown
Author

@nina9753 thanks for the approval. I just re-pushed the commit after signing it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants