Skip to content

Bump @simple-git/argv-parser and yeoman-generator - #607

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-ca4c683a2a
Open

Bump @simple-git/argv-parser and yeoman-generator#607
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-ca4c683a2a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps @simple-git/argv-parser to 2.0.1 and updates ancestor dependency yeoman-generator. These dependencies need to be updated together.

Updates @simple-git/argv-parser from 1.1.1 to 2.0.1

Release notes

Sourced from @​simple-git/argv-parser's releases.

@​simple-git/argv-parser@​2.0.1

Patch Changes

  • 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

    Thanks to @​oss-security-shopify for identifying the vulnerability.

@​simple-git/argv-parser@​2.0.0

Major Changes

  • 98864c6: Updates ahead of the v4 release for simple-git.

    • Adds support for TypeScript declaration maps

    • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

    • Adds detection for includeIf.<condition>.path, thanks to @​NotAFlightRisk for identifying the vulnerability

Patch Changes

  • c427fba: Additional argument parser vulnerability checks:

    • Thanks to @​mrillicit for identifying include.path, filter.*.process
    • Thanks to @​tejas619 for identifying url.*.insteadOf

  • 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

    Thanks to @​threalwinky and @​nuc13us for identifying.

  • dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

    • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
    • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

    These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

  • d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

    Thanks to @​gdegrange for the vulnerability report.

  • d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

    Thanks to @​sec-reex for the vulnerability report.

  • Updated dependencies [98864c6]

    • @​simple-git/args-pathspec@​1.0.4
Changelog

Sourced from @​simple-git/argv-parser's changelog.

2.0.1

Patch Changes

  • 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

    Thanks to @​oss-security-shopify for identifying the vulnerability.

2.0.0

Major Changes

  • 98864c6: Updates ahead of the v4 release for simple-git.

    • Adds support for TypeScript declaration maps

    • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

    • Adds detection for includeIf.<condition>.path, thanks to @​bhaswanthc, @​NotAFlightRisk, @​oss-security-shopify for identifying the vulnerability

Patch Changes

  • c427fba: Additional argument parser vulnerability checks:

  • 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

    Thanks to @​threalwinky and @​nuc13us for identifying.

  • dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

    • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
    • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

    These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

  • d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

    Thanks to @​gdegrange for the vulnerability report.

  • d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

    Thanks to @​sec-reex for the vulnerability report.

... (truncated)

Commits

Updates yeoman-generator from 8.2.2 to 10.0.1

Release notes

Sourced from yeoman-generator's releases.

v10.0.1

10.0.1 (2026-10-07)

Bug Fixes

  • storage: drop the cache when the file changes to other contents (#1870) (bf56faf)

v10.0.0

10.0.0 (2026-10-06)

⚠ BREAKING CHANGES

  • deps: bump simple-git from 3.36.0 to 4.0.2 (#1864)

Features

  • cancel a spawned command with the signal of the adapter (#1866) (b9840f6)
  • deps: bump simple-git from 3.36.0 to 4.0.2 (#1864) (c950cce)

Bug Fixes

  • storage: keep the objects read before a write (#1868) (e9cbb1b)

v9.2.0

9.2.0 (2026-09-14)

Features

  • add skipGlobalConfig option to disable the global config storage (#1858) (ea9ef51)

Bug Fixes

  • store answers of stored questions that follow a non-stored one (#1859) (df71470)

v9.1.0

9.1.0 (2026-09-12)

Features

  • add allowPackageTemplates feature (#1855) (a9d69dd)
  • create destination root on demand at createSimpleGit (#1854) (c1c5425)

v9.0.0

9.0.0 (2026-09-11)

... (truncated)

Changelog

Sourced from yeoman-generator's changelog.

10.0.1 (2026-10-07)

Bug Fixes

  • storage: drop the cache when the file changes to other contents (#1870) (bf56faf)

10.0.0 (2026-10-06)

⚠ BREAKING CHANGES

  • deps: bump simple-git from 3.36.0 to 4.0.2 (#1864)

Features

  • cancel a spawned command with the signal of the adapter (#1866) (b9840f6)
  • deps: bump simple-git from 3.36.0 to 4.0.2 (#1864) (c950cce)

Bug Fixes

  • storage: keep the objects read before a write (#1868) (e9cbb1b)

9.2.0 (2026-09-14)

Features

  • add skipGlobalConfig option to disable the global config storage (#1858) (ea9ef51)

Bug Fixes

  • store answers of stored questions that follow a non-stored one (#1859) (df71470)

9.1.0 (2026-09-12)

Features

  • add allowPackageTemplates feature (#1855) (a9d69dd)
  • create destination root on demand at createSimpleGit (#1854) (c1c5425)

9.0.0 (2026-09-11)

⚠ BREAKING CHANGES

  • do not eagerly create destinationRoot folder, create on demand at spawn (#1852)
  • update execa to v10 (#1850)
  • drop node 20 support and update dependencies (#1849)
  • templatePath() and destinationPath() throw when the resolved path is outside the source/destination root.

Features

  • do not eagerly create destinationRoot folder, create on demand at spawn (#1852) (0a14c27)

... (truncated)

Commits
  • 70e374d chore(main): release 10.0.1 (#1871)
  • bf56faf fix(storage): drop the cache when the file changes to other contents (#1870)
  • e60cd75 chore(main): release 10.0.0 (#1867)
  • c950cce feat(deps)!: bump simple-git from 3.36.0 to 4.0.2 (#1864)
  • e9cbb1b fix(storage): keep the objects read before a write (#1868)
  • 8541418 chore(deps): bump the codeql-action group with 4 updates (#1865)
  • b9840f6 feat: cancel a spawned command with the signal of the adapter (#1866)
  • 2421833 chore(deps): bump the codeql-action group with 4 updates (#1862)
  • fbd2640 chore(dependabot): use chore prefix for github-actions updates (#1861)
  • 1857358 chore(main): release 9.2.0 (#1860)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump @simple-git/argv-parser and yeoman-generator
53e254f 
Bumps [@simple-git/argv-parser](https://github.com/steveukx/git-js/tree/HEAD/packages/argv-parser) to 2.0.1 and updates ancestor dependency [yeoman-generator](https://github.com/yeoman/generator). These dependencies need to be updated together.


Updates `@simple-git/argv-parser` from 1.1.1 to 2.0.1
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/packages/argv-parser/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/@simple-git/argv-parser@2.0.1/packages/argv-parser)

Updates `yeoman-generator` from 8.2.2 to 10.0.1
- [Release notes](https://github.com/yeoman/generator/releases)
- [Changelog](https://github.com/yeoman/generator/blob/main/CHANGELOG.md)
- [Commits](yeoman/generator@v8.2.2...v10.0.1)

---
updated-dependencies:
- dependency-name: "@simple-git/argv-parser"
  dependency-version: 2.0.1
  dependency-type: indirect
- dependency-name: yeoman-generator
  dependency-version: 10.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rzhao271 Raymond Zhao (rzhao271) Awaiting requested review from rzhao271

At least 1 approving review is required to merge this pull request.

Assignees

@rzhao271 Raymond Zhao (rzhao271)

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rzhao271