[MelvinBot]

Details

Fixes the open simple-git Dependabot alerts (2 critical, 4 high; all fixed in >= 4.0.1) by adding an npm overrides entry that forces simple-git from 3.28.0 to 4.0.2.

Usage: dev-only, transitive, through reassure → @callstack/reassure-cli. It calls checkIsRepo() and revparse() to label perf runs with the current branch and commit. Nothing ships in the published package.

Why use an override instead of bumping reassure: [email protected] is the first release on simple-git@^4. It was published 5 days ago, and .npmrc sets min-release-age=7.

Known caveat: v4 removed the default export, so [email protected] logs Failed to detect git branch / commit hash and labels runs (unknown). Perf tests still run and pass. CI doesn't read that metadata. Follow-up: bump to [email protected] and drop the override after 2026-10-28.

Change Log

4.0.2

• Add VISUAL env var to the allowUnsafeEditor set (security).

4.0.1

• Publishing fix.

4.0.0 (major)

• Remove the default export; use the named simpleGit export. Remove simple-git/promise and gitP.
• Reject abbreviated long-form git options (for example --conf=).
• Filter ambient env vars before passing them to the git child process.
• Add git.input(data) for one-shot stdin.
• Detect rebase -x / --exec under allowUnsafeExec.
• Parse binary renames without byte counts in diff summaries.

3.36.0

• Extend known exploitable config keys and per-task env vars.

3.34.0 – 3.35.2

• Improve argument scanning before spawning child_process. Publishing and dependency-tree changes.

3.33.0

• Use pathspec wrappers for clone/mirror paths. Improve git -c checks in the unsafe plugin.

3.29.0 – 3.32.3

• Several blockUnsafeOperationsPlugin bypass fixes, including case-insensitive protocol.allow and option-parsing bypasses.

Full log: https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md

Related Issues

https://github.com/Expensify/Expensify/issues/695664

Linked E/App PR

https://github.com/Expensify/App/pull/000

Automated Tests

None added; the change only affects dependencies. Existing Reassure Performance Tests CI covers the only consumer.

Manual Tests

1. npm ci completes without errors.
2. npm ls simple-git shows [email protected].
3. npm run perf-test passes all suites and writes .reassure/current.perf. The Failed to detect git branch warning is expected (see Details).
4. The Reassure Performance Tests check passes on this PR.

Author Checklist

• I linked the correct issue in the ### Related Issues section above
• I linked the corresponding Expensify/App PR in the ### Linked E/App PR section above, and verified this change against it (E/App CI passed and manual testing completed)
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android / native
  • Android / Chrome
  • iOS / native
  • iOS / Safari
  • MacOS / Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
  • I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
  • I verified the JSDocs style guidelines (in STYLE.md) were followed
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
• I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
• I verified that if a function's arguments changed that all usages have also been updated correctly
• If a new component is created I verified that:
  • A similar component doesn't exist in the codebase
  • All props are defined accurately and each prop has a /** comment above it */
  • The file is named correctly
  • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
  • The only data being stored in the state is data necessary for rendering and nothing else
  • If we are not using the full Onyx data that we loaded, I've added the proper selector in order to ensure the component only re-renders when the data it is using changes
  • For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
  • Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
  • All JSX used for rendering exists in the render method
  • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
• If any new file was added I verified that:
  • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
• I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T13:11:42.342849Z	551576d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 551576db24

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[pecanoro]

The AI left a comment, let me know when it's ready and I will review it!

[luacmartins]

Addressed

[pecanoro]

@MelvinBot Complete the checklist in the PR description

[pecanoro]

@luacmartins I think you need to approve it too or I won't be able to merge it

[luacmartins]

Done

[os-botify]

🚀 Published to npm in 3.0.134 🎉