[GOOD FIRST ISSUE] Update simple-git to >= 3.36.0 to fix command injection vulnerability

[ulises-jeremias]

Task

Update simple-git to >= 3.36.0 in all affected examples to patch a critical command injection vulnerability that allows arbitrary code execution by passing a malicious remote URL.

This is a focused, dependency-only change — no logic changes required.

---

Vulnerability

Advisory	Severity	Description
GHSA-9p95-fw8f-mh6q	Critical	Command injection via remote URL (affects simple-git < 3.15.0)
GHSA-3f95-r44v-8xlg	Critical	Remote code execution via .git config poisoning
GHSA-p849-7qr6-m2j7	High	ReDoS in branch name parsing

Open Dependabot alerts: 18 (5 critical, 13 high)

Note: simple-git is used by the Serverless Framework CLI (as a dev dependency). It is not deployed to Lambda — this is a developer toolchain risk.

---

Affected Examples

All examples using serverless as a dev dependency pull in simple-git transitively:

Example	Path
examples/serverless-appsync-node-typescript	package-lock.json
examples/serverless-cognito-local	package-lock.json
examples/serverless-localstack-with-s3-and-dynamodb	pnpm-lock.yaml
examples/serverless-neo4j-ec2	package-lock.json
examples/serverless-s3-local	package-lock.json
examples/serverless-node-typescript-bundle	package-lock.json
…and others	—

---

Steps

1. Fork this repository
2. For each affected example, check if simple-git appears in the dependency tree:

   cd examples/<example>
   npm ls simple-git 2>/dev/null | head -5

3. Add an npm override to force a patched version:

   // package.json
   "overrides": {
     "simple-git": "^3.36.0"
   }

   For pnpm projects, use pnpm.overrides:

   // package.json
   "pnpm": {
     "overrides": {
       "simple-git": "^3.36.0"
     }
   }

4. Install:

   npm install   # or: pnpm install

5. Verify:

   npm ls simple-git   # should show >= 3.36.0
   npm audit | grep simple-git   # should return 0

6. Commit lock file changes and open a PR

---

Validation

npm audit --json | python3 -c "
import json, sys
d = json.load(sys.stdin)
sg = {k: v for k, v in d.get('vulnerabilities', {}).items() if 'simple-git' in k}
print('simple-git vulnerabilities:', len(sg))
"
# Expected: simple-git vulnerabilities: 0

---

Out of Scope

• Do not change any serverless.yml or application code
• Do not update unrelated packages
• Serverless v4 migration is tracked separately

---

References

• GHSA-9p95-fw8f-mh6q — simple-git command injection
• simple-git security advisory
• simple-git changelog
• npm overrides docs