V4 (#1193)

* - remove `simple-git/promise` and associated `gitP` export

* - switch from yarn to pnpm

* - convert jest to vitest

* - upgrade biome
- apply formatting to "new" code

* - migrate types into `src`
- add vite build script

* - vite build for mjs / cjs outputs, reusing the `baseConfig` helper from the `@simple-git/` sub-packages.
- apply the `node:` schema for node specific imports
- generate types with `tsc`

* - apply lint across tests

* - apply import ordering and type import settings to more packages

* - update package scripts to use pnpm from yarn

* - add declaration maps

* - enforce the use of `GIT_TEST_DISALLOW_ABBREVIATED_OPTIONS` environment variable to disable abbreviations in `git` commands

* - enforce the use of `GIT_TEST_DISALLOW_ABBREVIATED_OPTIONS` environment variable to disable abbreviations in `git` commands

* - split unit and integration tests as `projects` in vitest, apply module mocks only in unit tests.

* - use pnpm in the github actions

* - use `pnpm/setup` action in favour of `actions/setup-node`

* - use `pnpm/setup` action in favour of `actions/setup-node`

* - use `pnpm/setup` action in favour of `actions/setup-node`
- upgrade `actions/checkout`

* - update self-referential tests to import from root barrel file (argv-parser)

* - update self-referential tests to import from root barrel file (argv-parser)

* - update unit tests to be aware of the constant environment variable, and remove test asserting ability to use a default export on `simple-git`

* Lint

* Update unsafe spec - no longer viable to pwn with `--u`

* Use pnpm in build scripts

* - use `.ts` rather than `.d.ts` in source files

* - CI runs consumer tests outside of main test flow
- Remove duplication in consumer tests
- Remove babel configuration, obsolete following move to vitest

* - examples directory uses the named import

* - docs content uses the named import

* - add debug logging to the custom-binary plugin
- remove `console.warn` when permitting unsafe (configured through `unsafe.allowUnsafeCustomBinary`)

* - remove duplication in exported types

* - remove deprecated build tools

* - remove deprecated interfaces

* Update lock file

* - lint

* - path to windows test file

* - path to windows test file

* - path to windows test file

* - path to windows test file

* - path to windows test file

* - path to windows test file

* - path to windows test file

* - consumer tests allow rewriting lockfile before running

* - consumer tests allow rewriting lockfile before running

* - support `build:pkg` only modifying the `export` publish block, rather than full removal of `scripts` and `devDependencies`.
- `typescript-esm-consumer` package updated to build ESM JavaScript (includes type check) then run directly with node (includes validation of exported functionality).

* - add consumer tests asserting both TypeScript compilation and test running (directly via node to avoid any inline TS transpilation by TSX)
- removed obsolete block from biome config

* - apply config-only `build:pkg` switch to the github actions setup

* - Include `tar.command` to vulnerable config list
- `simple-git` depends on current workspace version rather than `^` version of arv-parser, avoids inconsistency in vulnerability detection expectations, noting an upgrade to argv-parser will require a new release of `simple-git`.

* - Add vulnerability test for use of `include.path`

* - Add option to `unsafe.allowAbbreviatedOptions`

* - Documentation for v4 release

* - Lint

* - Add `includeIf.<condition>.path` to the vulnerabilities list

* Add support for `input` plugin.

Closes #1178

* Create the `git.interpretTrailers` interface

Closes #1178

Author: steveukx

.changeset/calm-birds-listen.md

@@ -0,0 +1,7 @@
+---
+"simple-git": minor
+---
+
+Support one-shot stdin via `git.input(data)` (`string` or `Buffer`).
+
+Thanks to @felipecrs for the feature request and initial implementation.

.changeset/sha-zam-four.md

@@ -0,0 +1,11 @@
+---
+"@simple-git/args-pathspec": patch
+"@simple-git/argv-parser": major
+---
+
+Updates ahead of the v4 release for `simple-git`.
+
+- Adds support for TypeScript declaration maps
+- Exports the `isGitEnvKey` helper to detect whether an environment variable can be used to configure a `git` operation
+
+- Adds detection for `includeIf.<condition>.path`, thanks to @NotAFlightRisk for identifying the vulnerability

.changeset/slow-pens-hear.md

@@ -0,0 +1,74 @@
+---
+"simple-git": major
+---
+
+Major upgrade to v4. In this version:
+
+- Removed previously available default export, now uses a consistently named `simpleGit` export.
+- Removed previously deprecated import `simple-git/promise` (change to using the main `simple-git` import).
+- Removed legacy `gitP` export (change to using the main `simpleGit` export).
+
+```typescript
+// v3 - previously supported imports
+import simpleGit from 'simple-git';
+import { gitP } from 'simple-git';
+import simpleGit from 'simple-git/promise';
+const simpleGit = require('simple-git');
+
+// v4 - consolidates to a single supported import
+import { simpleGit } from 'simple-git';
+const { simpleGit } = require('simple-git');
+```
+
+- Prevents the use of abbreviated long-form `git` options:
+
+```typescript
+// v3 - allowed the use of unambiguous long-form options
+git.raw('clone', '--conf=user.name=me', '...');
+
+// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
+git.raw('fetch', '--config=user.name=me', '...');
+```
+
+- Ambient environment variables are filtered before passing into the `git` child process.
+
+```typescript
+// v3
+process.env.FOO = 'bar';
+process.env.GIT_TEMPLATE_DIR = './some/path';
+simpleGit().raw('clone'); // git child process can see both environment variables
+
+// v4
+process.env.FOO = 'bar';
+process.env.GIT_TEMPLATE_DIR = './some/path';
+simpleGit().raw('clone'); // git child process now sees only FOO
+
+simpleGit({
+   // explicitly allow the named environment variable so it can pass through.   
+   allowEnvoronment: ['GIT_TEMPLATE_DIR'],
+   // and enable the use of an unsafe behaviour 
+   unsafe: { allowUnsafeTemplateDir: true },
+})
+```
+
+- Explicitly supplied disallowed environment variables will throw when used.
+
+```typescript
+// v3 used a single opt-in to potential unsafe actiity
+simpleGit({ unsafe: { allowUnsafeTemplateDir: true } })
+   .env({ GIT_TEMPLATE_DIR: './foo' })
+   .init();
+
+// v4 uses a double opt-in, allow the behaviour and the mechanism
+simpleGit({
+      allowEnvoronment: ['GIT_TEMPLATE_DIR'],
+      unsafe: { allowUnsafeTemplateDir: true }
+   })
+   .env({ GIT_TEMPLATE_DIR: './foo' }).init();
+
+```
+
+- Removed content deprecated during the v2 to v3 major change
+  - `simpleGit.silent()` logging is configured through environment variables in the `debug` package
+  - `simpleGit.clearQueue()` this has been a noop since v3, switch to using the `abort` plugin
+  - Accessing parsed properties of a `GitResponseError` through a trailing callback function are available only through the `error.git` property (previously properties were also spread onto the `error` itself with a deprecation notice).

.github/workflows/changesets.yml

@@ -16,21 +16,20 @@ jobs:
       environment: npm
       if: github.repository == 'steveukx/git-js'
       steps:
-         - uses: actions/checkout@v6
+         - uses: actions/checkout@v7
            with:
               fetch-depth: 0
 
-         - uses: actions/setup-node@v6
+         - uses: pnpm/setup@v2
            with:
-              cache: yarn
-              node-version: 24
+              runtime: node@24
+              cache: true
 
-         - run: yarn install --immutable
-         - run: yarn build
+         - run: pnpm build
 
          - uses: changesets/action@v1
            with:
-              publish: yarn changeset publish
+              publish: pnpm changeset publish
            env:
               GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
               NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/ci.yml

@@ -14,37 +14,48 @@ jobs:
       runs-on: ubuntu-latest
       strategy:
          matrix:
-            node-version: [20, 22, 23, 24, 25]
+            node-version: [20, 22, 24, 25, 26]
       steps:
-         - uses: actions/checkout@v6
-         - name: Use Node.js ${{ matrix.node-version }}
-           uses: actions/setup-node@v6
+         - uses: actions/checkout@v7
+         - uses: pnpm/setup@v2
            with:
-              node-version: ${{ matrix.node-version }}
-              cache: yarn
-         - run: yarn install --immutable
-         - run: yarn build
+              runtime: node@${{ matrix.node-version }}
+              cache: true
+         - run: pnpm build
          - name: Test
            env:
               GIT_AUTHOR_NAME: 'Simple Git Tests'
               GIT_AUTHOR_EMAIL: 'tests@simple-git.dev'
-           run: yarn test
-         - run: yarn build:pkg
-         - run: yarn test:consumer
+           run: pnpm test
 
    build-windows:
       runs-on: windows-latest
       steps:
-         - uses: actions/checkout@v6
-         - name: Use Node.js 24
-           uses: actions/setup-node@v6
+         - uses: actions/checkout@v7
+         - uses: pnpm/setup@v2
            with:
-              node-version: 24
-              cache: yarn
-         - run: yarn install --immutable
-         - run: yarn build
+              runtime: node@24
+              cache: true
+         - run: pnpm build
          - name: Test
            env:
               GIT_AUTHOR_NAME: 'Simple Git Tests'
               GIT_AUTHOR_EMAIL: 'tests@simple-git.dev'
-           run: yarn test:win
+           run: pnpm test:win
+
+   consumer:
+      runs-on: ubuntu-latest
+      strategy:
+         matrix:
+            node-version: [ 22, 24, 26 ]
+      steps:
+         - uses: actions/checkout@v7
+         - uses: pnpm/setup@v2
+           with:
+              runtime: node@${{ matrix.node-version }}
+              cache: true
+         - name: Build
+           env:
+              SIMPLE_GIT_PKG_CONFIG_ONLY: true
+           run: pnpm build && pnpm build:pkg
+         - run: pnpm test:consumer

.github/workflows/quality.yml

@@ -13,11 +13,9 @@ jobs:
    lint:
       runs-on: ubuntu-latest
       steps:
-         - uses: actions/checkout@v6
-         - name: Use Node.js
-           uses: actions/setup-node@v6
+         - uses: actions/checkout@v7
+         - uses: pnpm/setup@v2
            with:
-              node-version: 24
-              cache: yarn
-         - run: yarn install --immutable
-         - run: yarn lint
+              runtime: node@24
+              cache: true
+         - run: pnpm lint