fix(deps): force simple-git ^4.0.2 to clear critical audit CVEs

[rohit-sourcefuse]

What

Force simple-git to ^4.0.2 via a root overrides entry, and remove the unused simple-git direct dependency from packages/cli.

Why

The audit workflow on master is failing (exit 1). npm audit reports two critical simple-git advisories plus two high command-execution ones:

Advisory	Severity	Affected range
GHSA-v5rq-49vh-5v5c — @simple-git/argv-parser unsafe-editor detection omits VISUAL	critical	< 2.0.1
GHSA-x6jw-m9v5-85vh — unsafe-operation guard doesn't block trailer-command config	critical	>=3.15.0 <4.0.1
GHSA-g4wm-2vf7-vfgr — command execution via unblocked git config includes	high (8.1)	<=3.36.0
GHSA-858h-whjf-mvg5 — unsafe-operations bypass via git long-option abbreviation	high (8.1)	<=3.36.0

simple-git reaches the tree two ways, so just one change doesn't clear it:

1. An unused direct dependency in packages/cli/package.json (^3.36.0) — grepped the whole packages/cli tree (src, lib, generators, templates); there are zero references to it, it's dead.
2. A transitive ^3.2.6 pulled by cz-format-extension (commit-message tooling, dev-only).

The fix for all four advisories only ships in simple-git@4.0.2, which is a semver-major, so overrides/dedup to <4 can't reach it. This PR therefore:

• Adds "simple-git": "^4.0.2" to the root overrides block (there was no existing entry) so every copy — direct and transitive — resolves to the patched major. As a result @simple-git/argv-parser is pulled up to the patched 2.0.1.
• Removes the dead simple-git dependency from packages/cli (cleanup; no code uses it).

Why the major bump is safe here

• engines across the monorepo are node: 22 || 24 — well above simple-git v4's Node floor, so there's no runtime incompatibility.
• simple-git is only reachable through commit-time tooling (cz-format-extension) now that the dead packages/cli dep is gone — nothing in shipped code calls it, so the v3→v4 API change has no runtime impact.

Verification

The audit gate runs at high (audit.yml passes high as the trailing arg to the checker). The node_matrix_audit (22) and (24) jobs on this PR run that exact command and pass — simple-git resolves to a single 4.0.2 and @simple-git/argv-parser to the patched 2.0.1, so the simple-git criticals/highs are cleared and the audit workflow is green again.

Note: trivy is red, but that's pre-existing on master (red since Aug 2025) and unrelated to this change — it's flagging basic-ftp CVE-2026-102990 (a separate transitive dep). Worth a follow-up PR (basic-ftp ^6.2.1), out of scope here.

cc @yeshamavani @piyushsinghgaur1 @sf-sahil-jassal

[Copilot]

Copilot review overview

🟡 Changes recommended

The claimed audit verification uses critical, but the workflow actually checks high, and the description states that high-severity findings remain.

Review effort: Balanced
Findings: 1

Open (1)

• Verification misstates audit gate severity and leaves high findings · New

What changed in this PR

Updates simple-git to remediate security advisories and removes its unused CLI dependency.

Changes:

• Forces simple-git 4.0.2 or newer through root overrides.
• Removes the direct CLI dependency.
• Regenerates the lockfile with patched transitive packages.

File	Description
package.json	Adds the security override.
packages/​cli/​package.json	Removes the unused dependency.
package-lock.json	Records the updated dependency tree.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rohit-sourcefuse]

Good catch on the level — the gate runs at high, not critical; I've corrected the description. The important part holds though: the node_matrix_audit (22) and (24) jobs run that exact command with high and both pass on this PR, so the audit workflow is restored at the real gate level — simple-git resolves to a single 4.0.2 and @simple-git/argv-parser to the patched 2.0.1. The remaining trivy failure is pre-existing on master (basic-ftp CVE-2026-102990, unrelated to simple-git) and best handled in a separate PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud