-
89a2294: Extend known exploitable configuration keys and per-task environment variables.
Note -
ParsedVulnerabilitiesfromargv-parseris removed in favour of a readonly array ofVulnerabilityto match usage insimple-git, rolled into the newvulnerabilityCheckfor simpler access to the identified issues.Thanks to @zebbern for identifying the need to block
core.fsmonitor. Thanks to @kodareef5 for identifying the need to blockGIT_CONFIG_COUNTenvironment variables and--template/mergerelated config.
- 1ad57e8: Remove conflicting node:buffer import
- Updated dependencies [89a2294]
- Updated dependencies [675570a]
- @simple-git/argv-parser@1.1.0
- @simple-git/args-pathspec@1.0.3
- 0cf9d8c: Improvements for mono-repo publishing pipeline
- Updated dependencies [0cf9d8c]
- @simple-git/args-pathspec@1.0.2
- @simple-git/argv-parser@1.0.3
- 0de400e: Update monorepo version handling during publish
- Updated dependencies [0de400e]
- @simple-git/argv-parser@1.0.2
- 3d8708b: Updating publish config
- Updated dependencies [3d8708b]
- @simple-git/args-pathspec@1.0.1
- @simple-git/argv-parser@1.0.1
- 2b68331: Revised dependency tree to add helper modules as dependencies in main
simple-git
-
2e1f51c: Enhances scanning of arguments before passing on to the spawned
child_process.Caters for
-cflags prefixing thegittask (used when setting global inline config) and suffixing with either-c,--configor--config-env. Detectsgit configoperations that write to the configuration. -
Updated dependencies [2e1f51c]
- @simple-git/args-pathspec@1.0.0
- @simple-git/argv-parser@1.0.0
- a263635: Use
pathspecwrappers for remote and local paths when running eithergit.cloneorgit.mirrorto avoid leaving them less open for unexpected outcomes when passing unsanitised data into these tasks.
-
e253a0d: Enhanced
git -cchecks inunsafeplugin.Thanks to @JohannesLks for identifying the issue
-
f704208: Enhanced
protocol.allowchecks inallowUnsafeExtProtocolhandling.Thanks to @CodeAnt-AI-Security for identifying the issue
- 8d02097: Enhanced clone unsafe switch detection.
-
23b070f: Fix regex for detecting unsafe clone options
Thanks to @stevenwdv for reporting this issue.
-
1effd8e: Enhances the
unsafeplugin to block additional cases where the-uswitch may be disguised along with other single character options.Thanks to @JuHwiSang for identifying this as vulnerability.
- d5fd4fe: Use task runner for logging use of deprecated (already no-op) functions.
- a44184f: Resolve NPM publish steps
-
22dc93f: Custom binary plugin should support the use of
~character, used by Windows to shorten long folder names and folder names that have spaces in them (eg:C:\Program Filesmight becomeC:\PROGRA~1).Thanks to @skyshineb for reporting this issue.
-
7fbd379: Removes redundant uniqueness checks throughout the
git.statusparser, each file appears only once in the output fromgit.Thanks to @nathanael-ruf for contributing this change.
-
c8beec9: Update simple-git documentation for
cwdremove incorrect use ofawaitThank you to @siderdax for identifying this issue.
-
a0110fe: Build dependencies update
-
bc77774: Correctly identify current branch name when using
git.statusin a cloned empty repo.Previously
git.statuswould report the current branch name asNo. Thank you to @MaddyGuthridge for identifying this issue.
-
240ec64: Support for absolute paths on Windows when using
git.checkIngore, previously Windows would report paths with duplicate separators\\\\between directories.Following this change all paths returned from
git.checkIgnorewill be normalized throughnode:path, this should have no impact on non-windows users where thegitbinary doesn't wrap absolute paths with quotes.Thanks to @Maxim-Mazurok for reporting this issue.
-
9872f84: Support the use of
git.branch(['--show-current'])to limit the branch list to only the current branch.Thanks to @peterbe for pointing out the use-case.
-
5736bd8: Change to biome for lint and format
- 2adf47d: Allow repeating git options like
{'--opt': ['value1', 'value2']}
- 52f767b: Add
similarityto theDiffResultNameStatusFileinterface used when fetching log/diff with the--name-statusoption. - 739b0d9: Diff summary includes original name of renamed files when run wiht the
--name-statusoption. - bc90e7e: Fixes an issue with reporting name changes in the
filesarray returned bygit.status. Thank you @mark-codesphere for the contribution.
- 03e1c64: Resolve error in log parsing when fields have empty values.
- 28d545b: Upgrade build tools and typescript
- 0a5378d: Add support for parsing
count-objects
- 4aceb15: Upgrade dependencies and build tools
- c355317: Enable the use of a two part custom binary
- 9bfdf08: Bump package manager from yarn v1 to v4
- 8a3118d: Fixed a performance issue when parsing stat diff summaries
- 9f1a174: Update build tools and workflows for Yarn 4 compatibility
- df14065: add status to DiffResult when using --name-status
- 709d80e: Add firstCommit utility interface
- b4ab430: Add trailing callback support to git.firstCommit
- d3f9320: chore(deps): bump @babel/traverse from 7.9.5 to 7.23.2
- b76857f: chore(deps): bump axios from 1.1.3 to 1.6.1
- 2eda817: Use
pathspecingit.logto allow use of previously deleted files infileargument
- 2ab1936: keep path splitter without path specs
- f702b61: Create a utility to append pathspec / file lists to tasks through the TaskOptions array/object
- 5100f04: Add new interface for showBuffer to allow using
git showon binary files.
- f54cd0d: Examples and documentation for outputHandler
- a63cfc2: Timeout plugin can now be configured to ignore data on either stdOut or stdErr in the git process when determining whether to kill the spawned process.
- 066b228: Fix overly permissive regex in push parser
- 97fde2c: Support the use of
-Bin place of the default-bin checkout methods - 0a623e5: Adds vulnerability detection to prevent use of
--upload-packand--receive-packwithout explicitly opting in.
- ec97a39: Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.
- de570ac: Resolves an issue whereby non-strings can be passed into the config switch detector.
- 7746480: Disables the use of inline configuration arguments to prevent unitentionally allowing non-standard remote protocols without explicitly opting in to this practice with the new
allowUnsafeProtocolOverrideproperty having been enabled.
- 7746480: - Upgrade repo dependencies - lerna and jest
- Include node@19 in the test matrix
- 5a2e7e4: Add version parsing support for non-numeric patches (including "built from source" style
1.11.GIT)
- 19029fc: Create the abort plugin to allow cancelling all pending and future tasks.
- 4259b26: Add
.versionto return git version information, including whether the git binary is installed.
- 87b0d75: Increase the level of deprecation notices for use of
simple-git/promise, which will be fully removed in the next major - d0dceda: Allow supplying just one of to/from in the options supplied to git.log
- 6b3e05c: Use shared test utilities bundle in simple-git tests, to enable consistent testing across packages in the future
- bfd652b: Add a new configuration option to enable trimming white-space from the response to
git.raw
- 80d54bd: Added fields updated + deleted branch info to fetch response, closes #823
- 75dfcb4: Add prettier configuration and apply formatting throughout.
- 2f021e7: Support for importing as an ES module with TypeScript moduleResolution
node16or newer by addingsimpleGitas a named export.
- a0d4eb8: Branches that have been checked out as a linked work tree will now be included in the
BranchSummaryoutput, with alinkedWorkTreeproperty set totruein theBranchSummaryBranch.
-
25230cb: Support for additional log formats in diffSummary / log / stashList.
Adds support for the
--numstat,--name-onlyand--name-statin addition to the existing--statoption.
- 2cfc16f: Update CI environments to run build and test in node v18, drop node v12 now out of life.
- 13197f1: Update
debugdependency to latest4.x
- adb4346: Resolves issue whereby renamed files no longer appear correctly in the response to
git.status.
- fa2c7f7: Enable the use of types when loading with module-resolution
- 3805f6b: Timeout plugin no longer keeps short lived processes alive until timeout is hit
- f2fc5c9: Show full commit hash in a
CommitResult, prior to this changegit.commitwould result in a partial hash in thecommitproperty ifcore.abbrevis unset or has a value under40. Following this change thecommitproperty will contain the full commit hash.
- c4a2a13: chore(deps): bump minimist from 1.2.5 to 1.2.6
- 2040de6: Resolves potential command injection vulnerability by preventing use of
--upload-packingit.clone
- ed412ef: Use null separators in git.status to allow for non-ascii file names
- d119ec4: Resolves potential command injection vulnerability by preventing use of
--upload-packingit.fetch
- 80651d5: Resolve issue in prePublish script
- ac4f38f: Show readme in published package.
- d35987b: Release with changesets
- 1e4c591: Release with changesets
- 497d416: Releasing with changeset
- 0c3085d: Releasing library through changesets
- b47aa19: Switch to
changesetsas version and changelog manager
3.1.1 (2022-01-26)
- specify repository with
directoryidentifier to be discoverable within monorepo (655e23c)
3.1.0 (2022-01-23)
3.0.4 (2022-01-23)
3.0.3 (2022-01-20)
- allow branches without labels (07a1388)
- implement v3 deprecations (ed6d18e)
- publish v3 as
latest(5db4434)
3.0.2 (2022-01-18)
- Backward compatibility - permit loading
simple-git/promisewith deprecation notice until mid-2022. (4413c47)
3.0.1 (2022-01-18)
- Documentation update (4e000f6)
3.0.0 (2022-01-16)
- monorepo structure (#716)
2.48.0 (2021-12-01)
StatusResultreturned bygit.status()should includedetachedstate of the working copy. (#695) (f464ebe)
- Add example for empty commit message in
git.commit()(61089cb)
2.47.1 (2021-11-29)
2.47.0 (2021-10-19)
- git-grep (653065e)
2.46.0 (2021-09-29)
completionplugin (#684) (ecb7bd6)completionplugin to allow configuring whensimple-gitdetermines thegittasks to be complete. (ecb7bd6)
2.45.1 (2021-09-04)
- support progress events in locales other than western european character sets. (8cc42f8)
2.45.0 (2021-08-27)
- Use author email field that respects mailmap (589d624)
- getConfig always returns
nulldespite values being present in configuration (9fd483a)
2.44.0 (2021-08-14)
- add support for getting the current value of a git configuration setting based on its name. (1d09204)
2.43.0 (2021-08-13)
- task callback types defined as single function type (b0a832c)
2.42.0 (2021-07-31)
- move
logtask to separate task builder (0712f86) - support
scopeargument inlistConfigto return a specific scope's configuration (0685a8b)
2.41.2 (2021-07-29)
- use literal
trueandfalseinDiffResultTextFile | DiffResultBinaryFileto aid type assertions. (8059099)
2.41.1 (2021-07-11)
- Commit parsing should cater for file names with square brackets (ae81134)
2.41.0 (2021-07-11)
- allow setting the scope of
git config addto work on thelocal,globalorsystemconfiguration. (c7164e7) - allow setting the scope of git config add to work on the
local,globalorsystemconfiguration. (00ada06)
2.40.0 (2021-06-12)
- create the
spawnOptionsplugin to allow settinguid/gidowner for the spawnedgitchild processes. (cc70220)
2.39.1 (2021-06-09)
- add types and tests for the documented .exec API (#631) (c9207da)
- add types and tests for the documented
.execAPI (c9207da) - updates the documentation for
mergeFromToto more closely represent its functionality (see #50 for the original requirement). (dd2244e)
2.39.0 (2021-05-13)
git.cwdcan now be configured to affect just the chain rather than root instance. (4110662)
2.38.1 (2021-05-09)
2.38.0 (2021-04-14)
2.37.0 (2021-03-15)
errorDetectionPluginto handle creating error messages when tasks fail. (c65a419)
2.36.2 (2021-03-11)
2.36.1 (2021-03-06)
- Documentation update for
outputHandler(775d81e) - Support parsing
git.branchwhere branches have carriage returns in the commit detail. (5b71012)
2.36.0 (2021-03-03)
- Timeout Plugin (59f3d98)
- Fix broken link in
no-responseauto-generated comment (16fe73f)
2.35.2 (2021-02-23)
- Progress plugin should request progress events for fetch as well as other common long running tasks. (ea68857)
- upgrade debug from 4.3.1 to 4.3.2 (4b6eda8)
- While use of the
ListLogSummarytype is deprecated in favour of the newLogResult, the alias type should also support the default genericDefaultLogFieldsto allow downstream consumers to upgrade to newer2.xversions without the need to specify a generic. (508e602), closes #586
2.35.1 (2021-02-19)
- Update documentation for configuring
SimpleGit-optionsshould be aPartial<SimpleGitOptions>to allow for supplying just some of its properties. (30523df), closes #580
2.35.0 (2021-02-16)
- Progress Handler (5508bd4)
2.34.2 (2021-02-07)
- fix npm publish token definition (fb066c3)
2.34.1 (2021-02-07)
- auto-release with release-please (0ed2d96)
2.34.0 (2021-02-06)
- refactor
git pushto TypeScriptSimpleGitBaseinterface (e77ef1b) - refactor
git pushto TypeScriptSimpleGitBaseinterface (0691e85)
2.33.0 (2021-02-06)
- automate release/changelog with release-please (3848494)
- split the
git.addinto the tsSimpleGitApi(14432f9)
- Supports passing configuration arguments to the
gitbinary (via its-cargument as a prefix to any other arguments). Eg: to supply some custom http proxy to agit pullcommand, usesimpleGit('/some/path', { config: ['http.proxy=someproxy'] }).pull() - Add deprecation notice to
git.silent - Internal Updates:
- switch from
runtorunTaskingitcore - finish converting all mocks to TypeScript
- switch from
- Adds a
root: booleanproperty to theCommitResultinterface representing whether the commit was a 'root' commit (which is a commit that has no parent, most commonly the first commit in a repo).
- Reinstates native support for node.js v10 by removing use of ES6 constructs
- Update type definition for
git.mergeFromToto be theMergeResultreturned when using the more genericgit.mergemethod. Thanks to @ofirelias for the pull request.
-
Adds support for
git.applyPatchto apply patches generated in agit diffto the working index, TypeScript consumers can make use of theApplyOptionstype definition to make use of strong types for the supported options. Thanks to @andreterron for the pull request. -
Integration tests converted to TypeScript to ensure type safety across all tests.
- Update the
git.statusparser to account for staged deleted/modified files and staged files with subsequent modifications meaning a status of:RM old -> newwill now appear inrenamedandnewwill also appear inmodifiedD filewill now appear in bothdeletedandstagedwhereD filewould only appear indeleted
- Resolves an issue whereby using
git.logwith a callback (or awaiting the promise created from the now deprecatedsimple-git/promiseimport) would fail to return the response to the caller.
- See Legacy Node Versions for details of how to use
simple-gitwithnode.jsversions 11 and below. - To help keep the TypeScript definitions in line with functionality, unit tests are now written in TypeScript.
- When using
git.commit, the first argument must be a string or array of strings. Passing another data type has long been considered an error, but now a deprecation warning will be shown in the log and will be switched to an error in version 3. - Fixes an issue in
git.commitwhereby a commit that included only deleted lines would be parsed as though the deletions were inclusions.
pull,pushandpushTagsparameter types updated to match new functionality and tests switched to TypeScript to ensure they are kept in sync
- Upgrade
debugdependency and remove use of now deprecateddebug().destroy() - Renames the default source branch from
mastertomain
- Adds support for
git hash-object FILEandgit hash-object -w FILEwith new interfacegit.hashObject(...), with thanks to @MiOnim
- Adds
string[]to the set of types supported as options forgit.log - Fix readme typos
LogOptionsshould be intersection rather than union types
- move the command/task option processing function to TypeScript
git.cloneandgit.mirrorrewritten to fit the TypeScript tasks style.- resolves issue whereby
git.clonedidn't accept an object of options despite being documented as supporting.
git pull(and by extensiongit merge) adds remote message parsing to thePullResulttype- Remote message parsing adds property
remoteMessages.objectsof typeRemoteMessagesObjectEnumerationto capture the objects transferred in fetch and push.
git.mvrewritten to fit the TypeScript tasks style.- set up github actions for CI
- adds the
TaskParsertype to describe a task's parser function and creates theLineParserutility to simplify line-by-line parsing of string responses. - renames some interfaces for consistency of naming, the original name remains as a type alias marked as
@deprecateduntil version 3.x:- BranchDeletionSummary > BranchSingleDeleteResult
- BranchDeletionBatchSummary > BranchMultiDeleteResult
- MergeSummary > MergeResult
- resolves an issue whereby the
git.checkoutBranchmethod would not pass the branch detail through to the underlying child process.
- Further to
2.13.0includes all (non-empty)remote:lines in thePushResult, includingremote:lines used for other parser results (ie:pullRequestUrletc).
- Further to
2.13.0adding support for parsing the reponse togit.push, adds support for the pull request message used by gitlab.
-
.pushand.pushTagsrewritten as v2 style tasks. The git response is now parsed and returned as a PushResult -
Pull and merge rewritten to fit the TypeScript tasks style.
-
Integration tests updated to run through jest directly without compiling from nodeunit
- resolves an issue whereby the
git.tagsmethod could not be chained or used as an async/promise.
-
until now,
simple-gitreject all pending tasks in the queue when a task has failed. From2.11.0, only tasks chained from the failing one will be rejected, other tasks can continue to be processed as normal, giving the developer more control over which tasks should be treated as atomic chains, and which can be run in parallel.To support this, and to prevent the issues seen when
gitis run concurrently in too many child processes,simple-gitwill limit the number of tasks running in parallel at any one time to be at most 1 from each chain (ie: chained tasks are still run in series) and at most 5 tasks across all chains ( configurable by passing{maxConcurrentProcesses: x}in thesimpleGitconstructor). -
add support to
git.status()for parsing the response of a repo that has no commits yet, previously it wouldn't determine the branch name correctly. -
resolved a flaw introduced in
2.9.0wherebycheckoutLocalBranchwould silently fail and not check out the branch
git.checkoutnow supports both object and array forms of supplying trailing options.
import simpleGit from "simple-git";
await simpleGit().checkout("branch-name", ["--track", "remote/branch"]);
await simpleGit().checkout(["branch-name", "--track", "remote/branch"]);
await simpleGit().checkout({ "branch-name": null });git.initnow supports both object and array forms of supplying trailing options and now parses the response to return an InitResult;
import simpleGit, { InitResult } from "simple-git";
const notSharedInit: InitResult = await simpleGit().init(false, [
"--shared=false",
]);
const notSharedBareInit: InitResult = await simpleGit().init([
"--bare",
"--shared=false",
]);
const sharedInit: InitResult = await simpleGit().init(false, {
"--shared": "true",
});
const sharedBareInit: InitResult = await simpleGit().init({
"--bare": null,
"--shared": "false",
});git.statusnow supports both object and array forms of supplying trailing options.
import simpleGit, { StatusResult } from "simple-git";
const repoStatus: StatusResult = await simpleGit().status();
const subDirStatus: StatusResult = await simpleGit().status(["--", "sub-dir"]);git.resetupgraded to the new task style and exports an enumResetModewith all supported merge modes and now supports both object and array forms of supplying trailing options.
import simpleGit, { ResetMode } from "simple-git";
// git reset --hard
await simpleGit().reset(ResetMode.HARD);
// git reset --soft -- sub-dir
await simpleGit().reset(ResetMode.SOFT, ["--", "sub-dir"]);- bug-fix: it should not be possible to await the
simpleGit()task runner, only the tasks it returns.
expect(simpleGit().then).toBeUndefined();
expect(simpleGit().init().then).toBe(expect.any(Function));-
.checkIsRepo()updated to allow choosing the type of check to run, either by using the exportedCheckRepoActionsenum or the text equivalents ('bare', 'root' or 'tree'):checkIsRepo(CheckRepoActions.BARE): Promise<boolean>determines whether the working directory represents a bare repo.checkIsRepo(CheckRepoActions.IS_REPO_ROOT): Promise<boolean>determines whether the working directory is at the root of a repo.checkIsRepo(CheckRepoActions.IN_TREE): Promise<boolean>determines whether the working directory is a descendent of a git root.
-
.revparse()converted to a new style task
- Enables support for using the default export of
simple-gitas an es module, in TypeScript it is no longer necessary to enable theesModuleInteropflag in thetsconfig.jsonto consume the default export.
- Closes #471, whereby the source for the promise wrapped runner would be included in the published artifact
due to sharing the same name as the explicitly included
promise.jsin the project root.
- Fixes #464, whereby using
awaitongit.logwithout having supplied a callback would ignore the leading options object or options array.
- Updated to the
outputHandlertype to add a trailing argument for the arguments passed into the child process. - All logging now uses the debug library. Enable logging by adding
simple-gitto theDEBUGenvironment variable.git.silent(false)can still be used to explicitly enable logging and is equivalent to callingrequire('debug').enable('simple-git').
- TL;DR -
.thenand.catchcan now be called on the standardsimpleGitchain to handle the promise returned by the most recently added task... essentially, promises now just work the way you would expect them to. - The main export from
simple-gitno longer shows the deprecation notice for using the.thenfunction, it now exposes the promise chain generated from the most recently run task, allowing the combination of chain building and ad-hoc splitting off to a new promise chain.- See the unit and integration tests.
- See the typescript consumer test.
- Promise / async interface and TypeScript types all available from the
simple-gitimport rather than needingsimple-git/promise, see examples in the ReadMe or in the consumer tests.
-
Tasks that previously validated their usage and rejected with a
TypeErrorwill now reject with aTaskConfigurationError. -
Tasks that previously rejected with a custom object (currently only
git.mergewhen the auto-merge fails) will now reject with aGitResponseErrorwhere previously it was a modifiedError.
git.clean(...)will now return aCleanSummaryinstead of the raw string data
git.raw(...)now accepts any number of leading string arguments as an alternative to the single array of strings.
- all
git.remoterelated functions converted to TypeScript
- all
git.subModulerelated functions converted to TypeScript
- add new
git.listConfigto get current configuration git.addConfigsupports a newappendflag to append the value into the config rather than overwrite existing
- all
git.branchrelated functions converted to TypeScript - add new
git.deleteLocalBranchesto delete multiple branches in one call git.deleteLocalBranchesandgit.deleteLocalBranchnow support an optionalforceDeleteflag
.tags,.addTagand.addAnnotatedTagconverted to TypeScript, no backward compatibility changes
-
If your application depended on any functions with a name starting with an
_, the upgrade may not be seamless, please only use the documented public API. -
git.logdate format is now strict ISO by default (ie: uses the placeholder%aI) instead of the 1.x default of%aifor an "ISO-like" date format. To restore the old behaviour, addstrictDate = falseto the options passed togit.log.
Please see the historical changelog;