Package
renovate
Component
simple-git
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
simple-git 3.36.0 is affected by CVE-2026-102828, which is fixed in simple-git 4.0.1. Renovate pins simple-git 3.36.0, including in the latest upstream release (44.142.1). The fixed version cannot be adopted by a dependency override alone: simple-git 4.x blocks url.<base>.insteadOf rewriting unless the new allowUnsafeUrlRewrite option is enabled, and Renovate relies on that rewriting for host-rule authentication without enabling the option, so forcing the upgrade would break authenticated git operations. This will be remediated once upstream Renovate moves to simple-git 4.x.
Status