Repository navigation
upgrade vulnerable dependencies and migrate to simple-git v4 - #739
Merged
Merged
Conversation
nina9753
approved these changes
Oct 8, 2026
Contributor
Author
|
@nina9753 thanks for the approval. I just re-pushed the commit after signing it. |
2 of 10 tasks
Contributor
Author
|
updated the PR to resolve conflicts |
Bump @datadog/datadog-ci-base to ^5.26.1, which depends on simple-git ^4.0.2. Remove the simple-git resolution because it is no longer necessary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
simple-git 4 removes inherited GIT_* environment variables. The plugin's newSimpleGit did not allow GIT_DIR and GIT_WORK_TREE, so source code integration was skipped for repositories that use them. Use isGitRepo from datadog-ci-base, which allows these variables and returns false outside a git repository. Remove src/git.ts and the direct simple-git dependency. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nina9753
approved these changes
Oct 29, 2026
Contributor
There was a problem hiding this comment.
The Git helper cleanup looks good, and the new tests cover the main cases. One nonblocking follow-up: the basic-ftp resolution fixes installs in this repo, but consumers still resolve 5.3.1 through get-uri. Can we track the upstream dependency fix separately?
Contributor
@nina9753 Yes, we'll pull that in when it becomes available |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Dependency audits identified vulnerabilities in simple-git, @simple-git/argv-parser, basic-ftp, and other transitive dependencies across the root and e2e projects.
Upgrade affected dependencies, refresh both Yarn lockfiles, and replace the removed gitP() API with simpleGit(). Verify builds, tests, lint, formatting, and audits on Node 22 and 24.
Motivation
Lots of dependency vulnerabilities at work came from this plugin.
Testing Guidelines
Ran the test suite in both node 22 and node 24. Added new tests. If a beta release is possible, I am willing to test this at work in a real project.
Additional Notes
Types of changes
Check all that apply