fix(deps): update vulnerable dependencies (#27062)

packages/core/src/services/gitService.test.ts

@@ -205,7 +205,10 @@ describe('GitService', () => {
       hoistedMockCheckIsRepo.mockResolvedValue(false);
       const service = new GitService(projectRoot, storage);
       await service.setupShadowGitRepository();
-      expect(hoistedMockSimpleGit).toHaveBeenCalledWith(repoDir);
+      expect(hoistedMockSimpleGit).toHaveBeenCalledWith(
+        repoDir,
+        expect.anything(),
+      );
       expect(hoistedMockInit).toHaveBeenCalled();
     });
 

packages/core/src/services/gitService.ts

@@ -8,7 +8,12 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { isNodeError } from '../utils/errors.js';
 import { spawnAsync } from '../utils/shell-utils.js';
-import { simpleGit, CheckRepoActions, type SimpleGit } from 'simple-git';
+import {
+  simpleGit,
+  CheckRepoActions,
+  type SimpleGit,
+  type SimpleGitOptions,
+} from 'simple-git';
 import type { Storage } from '../config/storage.js';
 import { debugLogger } from '../utils/debugLogger.js';
 import {
@@ -19,6 +24,38 @@ import {
 export const SHADOW_REPO_AUTHOR_NAME = 'Gemini CLI';
 export const SHADOW_REPO_AUTHOR_EMAIL = 'gemini-cli@google.com';
 
+/**
+ * Common configuration for the shadow Git repository used for checkpointing.
+ *
+ * We enable all "unsafe" options because the shadow repository is an internal,
+ * isolated state management tool, and we want to ensure it works reliably
+ * regardless of the user's local environment (e.g., PAGER, EDITOR, or SSH settings).
+ */
+const SHADOW_REPO_GIT_OPTIONS: Partial<SimpleGitOptions> = {
+  unsafe: {
+    allowUnsafeAlias: true,
+    allowUnsafeAskPass: true,
+    allowUnsafeConfigEnvCount: true,
+    allowUnsafeConfigPaths: true,
+    allowUnsafeCredentialHelper: true,
+    allowUnsafeCustomBinary: true,
+    allowUnsafeDiffExternal: true,
+    allowUnsafeDiffTextConv: true,
+    allowUnsafeEditor: true,
+    allowUnsafeFilter: true,
+    allowUnsafeFsMonitor: true,
+    allowUnsafeGitProxy: true,
+    allowUnsafeGpgProgram: true,
+    allowUnsafeHooksPath: true,
+    allowUnsafeMergeDriver: true,
+    allowUnsafePack: true,
+    allowUnsafePager: true,
+    allowUnsafeProtocolOverride: true,
+    allowUnsafeSshCommand: true,
+    allowUnsafeTemplateDir: true,
+  },
+};
+
 export class GitService {
   private projectRoot: string;
   private storage: Storage;
@@ -101,7 +138,7 @@ export class GitService {
 
     const shadowRepoEnv = this.getShadowRepoEnv(repoDir);
     await fs.writeFile(shadowRepoEnv.GIT_CONFIG_SYSTEM, '');
-    const repo = simpleGit(repoDir).env(shadowRepoEnv);
+    const repo = simpleGit(repoDir, SHADOW_REPO_GIT_OPTIONS).env(shadowRepoEnv);
     let isRepoDefined = false;
     try {
       isRepoDefined = await repo.checkIsRepo(CheckRepoActions.IS_REPO_ROOT);
@@ -138,7 +175,7 @@ export class GitService {
 
   private get shadowGitRepository(): SimpleGit {
     const repoDir = this.getHistoryDir();
-    return simpleGit(this.projectRoot).env({
+    return simpleGit(this.projectRoot, SHADOW_REPO_GIT_OPTIONS).env({
       ...this.getShadowRepoEnv(repoDir),
       GIT_DIR: path.join(repoDir, '.git'),
       GIT_WORK_TREE: this.projectRoot,