chore(deps): remove pre-git and simple-commit-message

[MikeMcC399]

Situation

pre-git

The npm package pre-git@3.17.1, configured in the repo, was released on Mar 13, 2018. This was 7 ago and is the latest release of the package. The package is effectively unmaintained.

• pre-git contains multiple unfixable vulnerabilities:

  16 vulnerabilities (5 moderate, 7 high, 4 critical)

• The postinstall hook of pre-git adds a semantic-release configuration option, changing the default, if simple-commit-message has been uninstalled

    "release": {
    "analyzeCommits": "simple-commit-message"
  },

simple-commit-message

simple-commit-message is in the dependencies section of pre-git and therefore the two need to be considered together:

The npm package simple-commit-message@4.0.3 configured in the repo, was released on Feb 15, 2018 and is outdated.

The latest release of the package simple-commit-message@4.1.3, released on Jul 4, 2021 is effectively unmaintained and has the following issues:

• Uses non-standard commit message types (see https://github.com/bahmutov/simple-commit-message/blob/master/README.md#valid-commit-messages) major: and minor:. Does not allow the use of docs:, testing:, etc. used in other Cypress repos.
• Contains multiple unfixable vulnerabilities:

  10 vulnerabilities (1 low, 2 moderate, 4 high, 3 critical)

Assessment

At this time, where only emergency fixes are being applied to raise compatibility of the repo to Node.js 22 level, pre-git, its hooks and simple-commit-message are a hindrance, not a help, to these tasks.

pre-git manipulation of the analyzeCommits configuration of semantic-release adds unnecessary complexity to the general update task.

Change

In package.json, remove:

• npm packages pre-git and simple-commit-message
• config key containing pre-git
• semantic-release configuration "analyzeCommits": "simple-commit-message" which then falls back to using the default semantic-release/commit-analyzer which, in turn, uses Angular's commit-message-guidelines

Follow-up

Optionally look at introducing a mainstream and supported replacement for git hooks, such as Husky once other dependencies and configuration details have been successfully updated.

Locally, it may be necessary to remove hooks from .git/hooks. This can also be done with:

git config  --unset core.hooksPath