[🐸 Frogbot] Update version of simple-git to 3.36.0

[github-actions]

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Fixed Versions
Critical	CVE-2026-6951	Not Covered	simple-git:3.19.1	simple-git 3.19.1	[3.36.0]

🔖 Details

Vulnerability Details

Contextual Analysis:	Not Covered
Direct Dependencies:	simple-git:3.19.1
Impacted Dependency:	simple-git:3.19.1
Fixed Versions:	[3.36.0]
CVSS V3:	9.8

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.

---

🐸 JFrog Frogbot