chore(deps): update pnpm.catalog.default simple-git to v4 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
simple-git (source)	^3.36.0 → ^4.0.2

---

Release Notes

steveukx/git-js (simple-git)

v4.0.2

Compare Source

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@2.0.1

v4.0.1

Compare Source

Patch Changes

• 365f52d: Prepare package.json before publishing.

v4.0.0

Compare Source

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,
  @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify
  for identifying the vulnerability.

  • Ambient environment variables are filtered before passing into the git child process.

  // v3
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process can see both environment variables
  
  // v4
  process.env.FOO = "bar";
  process.env.GIT_TEMPLATE_DIR = "./some/path";
  simpleGit().raw("clone"); // git child process now sees only FOO
  
  simpleGit({
    // explicitly allow the named environment variable so it can pass through.
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    // and enable the use of an unsafe behaviour
    unsafe: { allowUnsafeTemplateDir: true },
  });

  • Explicitly supplied disallowed environment variables will throw when used.

  // v3 used a single opt-in to potential unsafe actiity
  simpleGit({ unsafe: { allowUnsafeTemplateDir: true } })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();
  
  // v4 uses a double opt-in, allow the behaviour and the mechanism
  simpleGit({
    allowEnvoronment: ["GIT_TEMPLATE_DIR"],
    unsafe: { allowUnsafeTemplateDir: true },
  })
    .env({ GIT_TEMPLATE_DIR: "./foo" })
    .init();

  • Removed content deprecated during the v2 to v3 major change
    • simpleGit.silent() logging is configured through environment variables in the debug package
    • simpleGit.clearQueue() this has been a noop since v3, switch to using the abort plugin
    • Accessing parsed properties of a GitResponseError through a trailing callback function are available only through the error.git property (previously properties were also spread onto the error itself with a deprecation notice).

Minor Changes

• 98864c6: Support one-shot stdin via git.input(data) (string or Buffer).

  Thanks to @​felipecrs for the feature request and initial implementation.

Patch Changes

• d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

  Thanks to @​gdegrange for the vulnerability report.

• 76f308e: Parse binary rename entries without byte counts in diff summaries.

• Updated dependencies [c427fba]

• Updated dependencies [1bb14df]

• Updated dependencies [dfeb116]

• Updated dependencies [d762810]

• Updated dependencies [d762810]

• Updated dependencies [98864c6]

  • @​simple-git/argv-parser@2.0.0
  • @​simple-git/args-pathspec@1.0.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ui-repl	Ready	Preview	Sep 28, 2026 8:11am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	simple-git@​4.0.2

View full report

[codspeed]

Merging this PR will degrade performance by 11.76%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 1 regressed benchmark
✅ 30 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	plain <button>	1.2 ms	1.3 ms	-11.76%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing renovate/simple-git-4.x (7e3ccd5) with v4 (acc4bb8)}

[github-actions]

Bundle size

No change to the client output of the apps in test/bundle.

Fixture	JS (gzip)	CSS (gzip)
nuxt	115.9 kB	26.7 kB
nuxt-detection	115.9 kB	10.3 kB
nuxt-full	830.6 kB	26.9 kB
vue	91.3 kB	25.2 kB
vue-detection	91.3 kB	8.7 kB

Raw sizes

Fixture	JS	CSS
nuxt	335.7 kB	198.6 kB
nuxt-detection	335.7 kB	61.0 kB
nuxt-full	2627.1 kB	198.9 kB
vue	274.7 kB	197.0 kB
vue-detection	274.7 kB	57.8 kB

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxt/ui@7065

commit: 7e3ccd5