[blimpich]

Summary

simple-git 3.x (all versions up to 3.36.0) is affected by these advisories. They are fixed in 4.0.0/4.0.1:

• GHSA-x6jw-m9v5-85vh (critical): the unsafe-operation guard does not block trailer command configuration
• GHSA-g4wm-2vf7-vfgr (high): command execution through unblocked Git configuration includes
• GHSA-858h-whjf-mvg5 (high): unsafe-operations plugin bypass via abbreviated long options

Because @callstack/reassure-cli depends on simple-git@^3.36.0, downstream projects can't resolve to a patched version, and Dependabot keeps flagging them.

Reassure's own usage (checkIsRepo() and revparse with fixed arguments) can't be exploited. The point of this PR is to let consumers clear the alerts.

Changes

• Bump simple-git to ^4.0.2 in @callstack/reassure-cli
• Switch to the named simpleGit import, because v4 removed the default export (release notes). The named export also exists in v3.
• Add a patch changeset for @callstack/reassure-cli

Without the import change, v4 makes getGitBranch()/getGitCommitHash() throw. Their try/catch swallows the error, so branch and commitHash would silently become undefined in .perf output.

Test plan

• yarn validate passes
• Ran the built lib/commonjs/utils/git.js against simple-git@4.0.2: getGitBranch() and getGitCommitHash() return the current branch and HEAD SHA

No docs impact. No related issue.

– written by Claude on Ben's behalf