Bumps simple-git from 3.4.0 to 3.15.0 (opensearch-project#341)

Resolve CVE-2022-25912. The package simple-git before 3.15. vulnerable to Remote Code Execution (RCE) Signed-off-by: Anan Zhuang <ananzh@amazon.com>
nhtruong · Feb 27, 2023 · 4ed3ab1 · 4ed3ab1
1 parent 314c0f6
commit 4ed3ab1
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ### Removed
 ### Fixed
 ### Security
+- [CVE-2022-25912] Bumps simple-git from 3.4.0 to 3.15.0 ([#341](https://github.com/opensearch-project/opensearch-js/pull/341))
 
 ## [2.1]
 ### Added

diff --git a/package.json b/package.json
@@ -75,7 +75,7 @@
     "proxy": "^1.0.2",
     "rimraf": "^3.0.2",
     "semver": "^7.3.5",
-    "simple-git": "^3.5.0",
+    "simple-git": "^3.15.0",
     "simple-statistics": "^7.7.0",
     "split2": "^3.2.2",
     "standard": "^16.0.3",