# What changed in simple-git

> 30 changes in simple-git 3 to 4 from its official release notes, upgrade guides and advisories: 12 breaking, 12 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/simple-git/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## simple-git 4

### Breaking changes

- Abbreviated long-form git options are no longer accepted and now throw a GitConfigurationError; use full option names. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- Use this option to allow named environment variables through to the git child process; explicitly supplied disallowed variables throw when used. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- Ambient environment variables are filtered before they are passed into the git child process. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- The legacy gitP export was removed; use the main simpleGit export. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- Parsed properties are available only through error.git; they are no longer spread onto the error itself when accessed through a trailing callback. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- The deprecated import path was removed; use the main simple-git import. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- The default export was removed; import the named simpleGit export instead. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- The no-op clearQueue method was removed; switch to using the abort plugin. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- The silent method was removed; logging is configured through environment variables in the debug package. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)

### Security

- simple-git unsafe-operation guard does not block trailer command configuration (4.0.1) — [security advisory](https://github.com/advisories/GHSA-X6JW-M9V5-85VH)
- Detection of allowUnsafeExec was added for rebase -x and rebase --exec. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)
- simple-git allows command execution through unblocked Git configuration includes (4.0.0) — [security advisory](https://github.com/advisories/GHSA-G4WM-2VF7-VFGR)
- simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) (4.0.0) — [security advisory](https://github.com/advisories/GHSA-858H-WHJF-MVG5)

### New APIs and options

- VISUAL is now among the environment variables allowed by allowUnsafeEditor. (4.0.2) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.2)
- Supports one-shot stdin via git.input(data), where data can be a string or Buffer. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)

### Fixes and other changes

- Binary rename entries without byte counts are now parsed in diff summaries. (4.0.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%404.0.0)

## simple-git 3

### Breaking changes

- simple-git now blocks this exploitable configuration key. (3.36.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.36.0)
- simple-git now blocks this per-task environment variable. (3.36.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.36.0)
- This type from argv-parser is removed in favor of a readonly array of Vulnerability. (3.36.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.36.0)

### Security

- simple-git is vulnerable to Remote Code Execution (3.36.0) — [security advisory](https://github.com/advisories/GHSA-HFFM-XVC3-VPRC)
- Remote and local paths passed to git.clone and git.mirror are wrapped with pathspec to avoid unexpected outcomes from unsanitised data. (3.33.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.33.0)
- Enhanced protocol.allow checks in allowUnsafeExtProtocol handling. (3.32.3) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.3)
- simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE (3.32.3) — [security advisory](https://github.com/advisories/GHSA-R275-FR43-PM7Q)
- Unsafe switch detection for clone has been enhanced. (3.32.2) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.2)
- Fixes the regex for detecting unsafe clone options. (3.32.1) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.1)
- simple-git Affected by Command Execution via Option-Parsing Bypass (3.32.0) — [security advisory](https://github.com/advisories/GHSA-JCXM-M3JX-F287)
- The unsafe plugin blocks additional cases where the -u switch is disguised alongside other single-character options. (3.32.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0)

### New APIs and options

- A new API provides simpler access to identified vulnerabilities. (3.36.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.36.0)

### Fixes and other changes

- Checks for git -c were enhanced in the unsafe plugin. (3.33.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.33.0)
- Correctly identifies the current branch name in a cloned empty repository instead of reporting it as No. (3.30.0) — [release notes](https://github.com/steveukx/git-js/releases/tag/simple-git%403.30.0)