npm / simple-git

simple-git

What changed in simple-git 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

12 breaking12 security3 new APIs and options3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

simple-git 416 changes

Abbreviated long-form git options are no longer accepted and now throw a GitConfigurationError; use full option names.
4.0.0release notes
Use this option to allow named environment variables through to the git child process; explicitly supplied disallowed variables throw when used.
4.0.0release notes
Ambient environment variables are filtered before they are passed into the git child process.
4.0.0release notes
The legacy gitP export was removed; use the main simpleGit export.
4.0.0release notes
Parsed properties are available only through error.git; they are no longer spread onto the error itself when accessed through a trailing callback.
4.0.0release notes
The deprecated import path was removed; use the main simple-git import.
4.0.0release notes
The default export was removed; import the named simpleGit export instead.
4.0.0release notes
The no-op clearQueue method was removed; switch to using the abort plugin.
4.0.0release notes
The silent method was removed; logging is configured through environment variables in the debug package.
4.0.0release notes

simple-git unsafe-operation guard does not block trailer command configuration
4.0.1security advisory
Detection of allowUnsafeExec was added for rebase -x and rebase --exec.
4.0.0release notes
simple-git allows command execution through unblocked Git configuration includes
4.0.0security advisory
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
4.0.0security advisory

VISUAL is now among the environment variables allowed by allowUnsafeEditor.
4.0.2release notes
Supports one-shot stdin via git.input(data), where data can be a string or Buffer.
4.0.0release notes

Binary rename entries without byte counts are now parsed in diff summaries.
4.0.0release notes

simple-git now blocks this exploitable configuration key.
3.36.0release notes
simple-git now blocks this per-task environment variable.
3.36.0release notes
This type from argv-parser is removed in favor of a readonly array of Vulnerability.
3.36.0release notes

simple-git is vulnerable to Remote Code Execution
3.36.0security advisory
Remote and local paths passed to git.clone and git.mirror are wrapped with pathspec to avoid unexpected outcomes from unsanitised data.
3.33.0release notes
Enhanced protocol.allow checks in allowUnsafeExtProtocol handling.
3.32.3release notes
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
3.32.3security advisory
Unsafe switch detection for clone has been enhanced.
3.32.2release notes
Fixes the regex for detecting unsafe clone options.
3.32.1release notes
simple-git Affected by Command Execution via Option-Parsing Bypass
3.32.0security advisory
The unsafe plugin blocks additional cases where the -u switch is disguised alongside other single-character options.
3.32.0release notes

A new API provides simpler access to identified vulnerabilities.
3.36.0release notes

Checks for git -c were enhanced in the unsafe plugin.
3.33.0release notes
Correctly identifies the current branch name in a cloned empty repository instead of reporting it as No.
3.30.0release notes