[Snyk] Security upgrade simple-git from 1.132.0 to 3.15.0

[ekmixon]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/grafana-toolkit/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Command Injection SNYK-JS-SIMPLEGIT-2421199	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') SNYK-JS-SIMPLEGIT-2434306	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SIMPLEGIT-3112221	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: simple-git

The new version differs by 250 commits.

• e1d66b6 Merge pull request InfluxDB: take advantage of influx chunked reponses grafana/grafana#863 from steveukx/changeset-release/main
• d4764bf Version Packages
• 7746480 Chore: bump lerna, jest and create prettier workflow ([FEATURE] template "custom" type should offer a "ALL" choice grafana/grafana#862)
• 47030d5 Merge pull request Graph: Export data as JSON & CSV grafana/grafana#861 from steveukx/security/protocols
• 6b3c631 Create the `unsafe` plugin to configure how `simple-git` treats known potentially unsafe operations.
• 3324eed Merge pull request When editing Display Style for a graph you cannot scroll. grafana/grafana#855 from steveukx/changeset-release/main
• e459622 Version Packages
• 2ea0231 Merge pull request I want to use template variables to affect display styles, display styles overrides and/or metric visibility grafana/grafana#854 from steveukx/chore/update-lerna
• 5a2e7e4 Add version parsing support for non-numeric patches (to include built… (Graphite import dashboard modal doesn't scroll grafana/grafana#853)
• 88fee05 Chore: bump lerna to latest `5.5.1`
• 0f964ba Merge pull request Cannot use templating variable in axis label grafana/grafana#849 from steveukx/changeset-release/main
• 6460a1f Version Packages
• 4259b26 Create interface for retrieving git version information (Added shared tooltips option to show multiple timeSeries values in a graph grafana/grafana#850)
• 19029fc Abort plugin (Row editor not work correctly grafana/grafana#848)
• 1cd0dac Merge pull request Hide / Show (series) buttons are not saved grafana/grafana#842 from steveukx/changeset-release/main
• ee801ae Version Packages
• d0dceda Allow using just one of `from` and `to` in the `git.log` options. (Panel JSON editor is inaccessible for rows lower down the page grafana/grafana#846)
• 6b3e05c Share test utilities (Override default series color palette  grafana/grafana#843)
• a975980 Merge pull request Can't Add Annotations in 1.8 (might have existed prior) grafana/grafana#841 from steveukx/feat/remove-legacy-promise
• 87b0d75 Changeset
• 670d854 Remove `/promise` type definitions, allow JavaScript to `require('simple-git/promise')` with deprecation notice written to `console.error`
• bf97246 Revert "Remove ability to import `/promise` types and throw when required."
• 1631776 Remove legacy promise integration test
• 2ac1d3f Remove ability to import `/promise` types and throw when required.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

[secure-code-warrior-for-github]

Micro-Learning Topic: OS command injection (Detected by phrase)

Matched on "Command Injection"

What is this? (2min video)

In many situations, applications will rely on OS provided functions, scripts, macros and utilities instead of reimplementing them in code. While functions would typically be accessed through a native interface library, the remaining three OS provided features will normally be invoked via the command line or launched as a process. If unsafe inputs are used to construct commands or arguments, it may allow arbitrary OS operations to be performed that can compromise the server.

Try a challenge in Secure Code Warrior

Helpful references

• OWASP Command Injection - OWASP community page with comprehensive information about command injection, and links to various OWASP resources to help detect or prevent it.
• OWASP testing for Command Injection - This article is focused on providing testing techniques for identifying command injection flaws in your applications

Micro-Learning Topic: Argument injection (Detected by phrase)

Matched on "Argument Injection"

What is this? (2min video)

In many situations, applications will rely on OS provided functions, scripts, macros and utilities instead of reimplementing them in code. While functions would typically be accessed through a native interface library, the remaining three OS provided features will normally be invoked via the command line or launched as a process. If unsafe inputs are used to construct commands or arguments, it may allow arbitrary OS operations to be performed that can compromise the server.

Try a challenge in Secure Code Warrior

Helpful references

• OWASP Command Injection - OWASP community page with comprehensive information about command injection, and links to various OWASP resources to help detect or prevent it.
• OWASP testing for Command Injection - This article is focused on providing testing techniques for identifying command injection flaws in your applications