search

prisma-labs / dripip

Opinionated CLI for continuous delivery of npm packages
100 stars 2 forks source link

fix: update dependency simple-git to v3 [security] #156

Open renovate[bot] opened 2 years ago

renovate[bot] commented 2 years ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
simple-git (source) ^2.23.0 -> ^3.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-24433

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.

CVE-2022-24066

simple-git (maintained as git-js named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.5.0.

CVE-2022-25912

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

CVE-2022-25860

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.

Release Notes

steveukx/git-js (simple-git) ### [`v3.16.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3160) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.15.1...simple-git@3.16.0) ##### Minor Changes - [`97fde2c`](https://togithub.com/steveukx/git-js/commit/97fde2c): Support the use of `-B` in place of the default `-b` in checkout methods - [`0a623e5`](https://togithub.com/steveukx/git-js/commit/0a623e5): Adds vulnerability detection to prevent use of `--upload-pack` and `--receive-pack` without explicitly opting in. ##### Patch Changes - [`ec97a39`](https://togithub.com/steveukx/git-js/commit/ec97a39): Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to [@​stsewd](https://togithub.com/stsewd) for the suggestion. ### [`v3.15.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3151) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.15.0...simple-git@3.15.1) ##### Patch Changes - [`de570ac`](https://togithub.com/steveukx/git-js/commit/de570ac): Resolves an issue whereby non-strings can be passed into the config switch detector. ### [`v3.15.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3150) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.14.1...simple-git@3.15.0) ##### Minor Changes - [`7746480`](https://togithub.com/steveukx/git-js/commit/7746480): Disables the use of inline configuration arguments to prevent unitentionally allowing non-standard remote protocols without explicitly opting in to this practice with the new `allowUnsafeProtocolOverride` property having been enabled. ##### Patch Changes - [`7746480`](https://togithub.com/steveukx/git-js/commit/7746480): - Upgrade repo dependencies - lerna and jest - Include node@19 in the test matrix ### [`v3.14.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3141) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.14.0...simple-git@3.14.1) ##### Patch Changes - [`5a2e7e4`](https://togithub.com/steveukx/git-js/commit/5a2e7e4): Add version parsing support for non-numeric patches (including "built from source" style `1.11.GIT`) ### [`v3.14.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3140) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.13.0...simple-git@3.14.0) ##### Minor Changes - [`19029fc`](https://togithub.com/steveukx/git-js/commit/19029fc): Create the abort plugin to allow cancelling all pending and future tasks. - [`4259b26`](https://togithub.com/steveukx/git-js/commit/4259b26): Add `.version` to return git version information, including whether the git binary is installed. ### [`v3.13.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3130) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.12.0...simple-git@3.13.0) ##### Minor Changes - [`87b0d75`](https://togithub.com/steveukx/git-js/commit/87b0d75): Increase the level of deprecation notices for use of `simple-git/promise`, which will be fully removed in the next major - [`d0dceda`](https://togithub.com/steveukx/git-js/commit/d0dceda): Allow supplying just one of to/from in the options supplied to git.log ##### Patch Changes - [`6b3e05c`](https://togithub.com/steveukx/git-js/commit/6b3e05c): Use shared test utilities bundle in simple-git tests, to enable consistent testing across packages in the future ### [`v3.12.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3120) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.11.0...simple-git@3.12.0) ##### Minor Changes - [`bfd652b`](https://togithub.com/steveukx/git-js/commit/bfd652b): Add a new configuration option to enable trimming white-space from the response to `git.raw` ### [`v3.11.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3110) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.10.0...simple-git@3.11.0) ##### Minor Changes - [`80d54bd`](https://togithub.com/steveukx/git-js/commit/80d54bd): Added fields updated + deleted branch info to fetch response, closes [#​823](https://togithub.com/steveukx/git-js/issues/823) ##### Patch Changes - [`75dfcb4`](https://togithub.com/steveukx/git-js/commit/75dfcb4): Add prettier configuration and apply formatting throughout. ### [`v3.10.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#3100) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.9.0...simple-git@3.10.0) ##### Minor Changes - [`2f021e7`](https://togithub.com/steveukx/git-js/commit/2f021e7): Support for importing as an ES module with TypeScript moduleResolution `node16` or newer by adding `simpleGit` as a named export. ### [`v3.9.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#390) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.8.0...simple-git@3.9.0) ##### Minor Changes - [`a0d4eb8`](https://togithub.com/steveukx/git-js/commit/a0d4eb8): Branches that have been checked out as a [linked work tree](https://git-scm.com/docs/git-worktree) will now be included in the `BranchSummary` output, with a `linkedWorkTree` property set to `true` in the `BranchSummaryBranch`. ### [`v3.8.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#380) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.7.1...simple-git@3.8.0) ##### Minor Changes - [`25230cb`](https://togithub.com/steveukx/git-js/commit/25230cb): Support for additional log formats in diffSummary / log / stashList. Adds support for the `--numstat`, `--name-only` and `--name-stat` in addition to the existing `--stat` option. ##### Patch Changes - [`2cfc16f`](https://togithub.com/steveukx/git-js/commit/2cfc16f): Update CI environments to run build and test in node v18, drop node v12 now out of life. - [`13197f1`](https://togithub.com/steveukx/git-js/commit/13197f1): Update `debug` dependency to latest `4.x` ### [`v3.7.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#371) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.7.0...simple-git@3.7.1) ##### Patch Changes - [`adb4346`](https://togithub.com/steveukx/git-js/commit/adb4346): Resolves issue whereby renamed files no longer appear correctly in the response to `git.status`. ### [`v3.7.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#370) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.6.0...simple-git@3.7.0) ##### Minor Changes - [`fa2c7f7`](https://togithub.com/steveukx/git-js/commit/fa2c7f7): Enable the use of types when loading with module-resolution ##### Patch Changes - [`3805f6b`](https://togithub.com/steveukx/git-js/commit/3805f6b): Timeout plugin no longer keeps short lived processes alive until timeout is hit ### [`v3.6.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#360) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.5.0...simple-git@3.6.0) ##### Minor Changes - [`f2fc5c9`](https://togithub.com/steveukx/git-js/commit/f2fc5c9): Show full commit hash in a `CommitResult`, prior to this change `git.commit` would result in a partial hash in the `commit` property if `core.abbrev` is unset or has a value under `40`. Following this change the `commit` property will contain the full commit hash. ##### Patch Changes - [`c4a2a13`](https://togithub.com/steveukx/git-js/commit/c4a2a13): chore(deps): bump minimist from 1.2.5 to 1.2.6 ### [`v3.5.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#350) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.4.0...simple-git@3.5.0) ##### Minor Changes - [`2040de6`](https://togithub.com/steveukx/git-js/commit/2040de6): Resolves potential command injection vulnerability by preventing use of `--upload-pack` in `git.clone` ### [`v3.4.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#340) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.3.0...simple-git@3.4.0) ##### Minor Changes - [`ed412ef`](https://togithub.com/steveukx/git-js/commit/ed412ef): Use null separators in git.status to allow for non-ascii file names ### [`v3.3.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#330) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.2.6...simple-git@3.3.0) ##### Minor Changes - [`d119ec4`](https://togithub.com/steveukx/git-js/commit/d119ec4): Resolves potential command injection vulnerability by preventing use of `--upload-pack` in `git.fetch` ### [`v3.2.6`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#326) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.2.4...simple-git@3.2.6) ##### Patch Changes - [`80651d5`](https://togithub.com/steveukx/git-js/commit/80651d5): Resolve issue in prePublish script ### [`v3.2.4`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#324) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.1.1...simple-git@3.2.4) ##### Patch Changes - [`d35987b`](https://togithub.com/steveukx/git-js/commit/d35987b): Release with changesets ### [`v3.1.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#311-2022-01-26) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.1.0...simple-git-v3.1.1) ### [`v3.1.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#310-2022-01-23) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.4...simple-git-v3.1.0) ##### Features - optionally include ignored files in `StatusResult` ([70e6767](https://www.github.com/steveukx/git-js/commit/70e676759012d26ab644644e10f7957fba51ae2f)), closes [#​718](https://www.togithub.com/steveukx/git-js/issues/718) ##### [3.0.4](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.3...simple-git-v3.0.4) (2022-01-23) ##### Bug Fixes - support parsing empty responses ([91eb7fb](https://www.github.com/steveukx/git-js/commit/91eb7fb01fe466468537621cb94b9f932026506e)), closes [#​713](https://www.togithub.com/steveukx/git-js/issues/713) ##### [3.0.3](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.2...simple-git-v3.0.3) (2022-01-20) ##### Bug Fixes - allow branches without labels ([07a1388](https://www.github.com/steveukx/git-js/commit/07a138808fb0b78068da83030698a957e567541c)) - implement v3 deprecations ([ed6d18e](https://www.github.com/steveukx/git-js/commit/ed6d18e88a6a4f9fd18d4733a94b491e0e9e3ba1)) - publish v3 as `latest` ([5db4434](https://www.github.com/steveukx/git-js/commit/5db4434d00acba560fe2569c04f9813cde026468)) ##### [3.0.2](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.1...simple-git-v3.0.2) (2022-01-18) ##### Bug Fixes - Backward compatibility - permit loading `simple-git/promise` with deprecation notice until mid-2022. ([4413c47](https://www.github.com/steveukx/git-js/commit/4413c47fa3d9893734a5bb06075b962645f73cb9)) ##### [3.0.1](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.0...simple-git-v3.0.1) (2022-01-18) ##### Bug Fixes - Documentation update ([4e000f6](https://www.github.com/steveukx/git-js/commit/4e000f69aa876b3999ec98fe42e94186facd5790)) ### [`v3.0.4`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#304-2022-01-23) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.3...simple-git-v3.0.4) ### [`v3.0.3`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#303-2022-01-20) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.2...simple-git-v3.0.3) ### [`v3.0.2`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#302-2022-01-18) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.1...simple-git-v3.0.2) ### [`v3.0.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#301-2022-01-18) [Compare Source](https://togithub.com/steveukx/git-js/compare/v2.48.0...simple-git-v3.0.1)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.