[dependabot]

Bumps simple-git to 4.0.2 and updates ancestor dependency @wordpress/env. These dependencies need to be updated together.

Updates simple-git from 3.36.0 to 4.0.2

Release notes

Sourced from simple-git's releases.

[email protected]

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

[email protected]

Patch Changes

• 365f52d: Prepare package.json before publishing.

[email protected]

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  • Ambient environment variables are filtered before passing into the git child process.

  // v3

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.2

Patch Changes

• 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

  Thanks to @​oss-security-shopify for identifying the vulnerability.

• Updated dependencies [68874c2]

  • @​simple-git/argv-parser@​2.0.1

4.0.1

Patch Changes

• 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

• 98864c6: Major upgrade to v4. In this version:

  • Removed previously available default export, now uses a consistently named simpleGit export.
  • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
  • Removed legacy gitP export (change to using the main simpleGit export).

  // v3 - previously supported imports
  import simpleGit from "simple-git";
  import { gitP } from "simple-git";
  import simpleGit from "simple-git/promise";
  const simpleGit = require("simple-git");
  // v4 - consolidates to a single supported import
  import { simpleGit } from "simple-git";
  const { simpleGit } = require("simple-git");

  • Prevents the use of abbreviated long-form git options:

  // v3 - allowed the use of unambiguous long-form options
  git.raw("clone", "--conf=user.name=me", "...");
  // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
  git.raw("fetch", "--config=user.name=me", "...");

  Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev,

... (truncated)

Commits

• f09081b Version Packages
• 68874c2 Add VISUAL to tracked environment variables for allowUnsafeEditor (#1201)
• f26086d Version Packages
• 365f52d Prepare the main simple-git package.json immediately before publishing.
• 3971917 Version Packages
• d762810 Fix/vulnerability rebase exec (#1198)
• 76f308e Pr/1180 (#1195)
• dfeb116 Fix/exec path vulnerability (#1197)
• 98864c6 V4 (#1193)
• See full diff in compare view

Updates @wordpress/env from 11.15.0 to 12.1.0

Changelog

Sourced from @​wordpress/env's changelog.

12.1.0 (2026-11-04)

New Features

• Add an experimental php runtime that serves WordPress with the installed PHP's built-in web server and a SQLite database, without Docker (#85512, #85574).

Bug Fixes

• Point the bullseye-security apt sources of the bullseye-based WordPress images (PHP 7.3, 7.4, and 8.0) at archive.debian.org instead of dropping them, so the images keep receiving Debian security updates (#85469).

Internal

• Update the Vitest development dependency to 5.0.5 (#86173).

12.0.0 (2026-10-20)

Breaking Changes

• Raise the minimum required Node.js version to >=22.13.0, for stable require(esm) support (#84313).

Bug Fixes

• Download the PHPUnit test library for a WordPress alpha, beta or RC version from its X.Y branch of WordPress/wordpress-develop when that branch exists, instead of always from trunk. A maintenance branch between point releases, such as 7.1.4-alpha, no longer gets trunk's tests, which can depend on code only trunk has. A release falls back to its X.Y branch when its tag does not exist yet. Cached test libraries now also update to the fetched version instead of staying on the first one downloaded (#84758).

11.17.0 (2026-10-07)

New Features

• Add a mariadbVersion option and WP_ENV_MARIADB_VERSION environment variable to choose the MariaDB version used by the Docker runtime, including versions older than 10.4 (#83751).
• Explain why wp-env start fails when a database was last used by a newer MariaDB version, which MariaDB cannot downgrade from (#83751).
• Stop wp-env start with an error naming the image when an image cannot be pulled and is not available locally, such as a mariadbVersion that does not exist, instead of reporting that cached images will be used (#83751).
• Make wp db commands, and so wp-env reset, work with a mariadbVersion older than 11.4. The MariaDB client in the CLI image requires TLS, which those servers do not offer, so the CLI image now runs the client without verifying the server certificate, as WP-CLI does from db-command 3.0 (#83751).

Bug Fixes

• Reject a phpVersion or WP_ENV_PHP_VERSION that is not only a version number, such as 8.2-apache or abc8, instead of failing later because the Docker image does not exist (#83751).
• Pass -T to docker compose exec when stdin is not a terminal, so commands run from a Git hook, which has a TTY on stdout but not on stdin, no longer fail with "cannot attach stdin to a TTY-enabled container" (#78374).

Internal

• Update @wp-playground/cli to 3.1.56, which replaces the fs-ext optional dependency, compiled with node-gyp at install time, with fs-ext-extra-prebuilt, which ships prebuilt binaries and works without running install scripts (#84012).
• Update simple-git to v4, which has better TypeScript support (#84137).

11.16.0 (2026-09-23)

Bug Fixes

• Wait for lifecycle script output streams to close before reporting command failures, so their error output is not lost (#82735).

Commits

• 9b70363 chore(release): publish
• 75eac8c Update changelog files
• 3445af6 Merge changes published in the Gutenberg plugin "release/24.4" branch
• 8d30f92 chore(release): publish
• e7922b3 Update changelog files
• e4d93b0 Merge changes published in the Gutenberg plugin "release/24.3" branch
• fa4301b Update changelog files
• 5c222d1 Merge changes published in the Gutenberg plugin "release/24.3" branch
• 2555c8d Update changelog files
• 558d1e6 Merge changes published in the Gutenberg plugin "release/24.3" branch
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.