
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
git-promise
Advanced tools
Simple wrapper to run any git command and process it's output using promises.
Simple wrapper that allows you to run any git command using a more intuitive syntax.
npm install git-promise --save
Once installed, you can use it in your JavaScript files like so:
const git = require("git-promise");
const branch = await git("rev-parse --abbrev-ref HEAD");
console.log(branch); // This is your current branch
The module will handle git exit code automatically, so
const git = require("git-promise");
try {
await git("merge origin/master");
// Everything was fine
} catch (err) {
// Something went bad, maybe merge conflict?
console.error(err);
}
err is an Error object augmented with code property. The following code:
try {
await git('clone http://example.org/notExistingExample.git');
} catch (err) {
console.log("MESSAGE");
console.log(err.message);
console.log("ERROR CODE");
console.log(err.code);
}
will log:
MESSAGE
Cloning into 'notExistingExample'...
fatal: remote error: Repository does not exist
The requested repository does not exist, or you do not have permission to
access it.
}
ERROR CODE
128
The git command accepts a second parameter that can be used to parse the output or to deal with non 0 exit code.
const git = require("git-promise");
const branch = await git("status -sb",
(stdout) => stdout.match(/## (.*)/)[1]);
console.log(branch); // This is your current branch
The callback accepts 2 parameters, (stdout, error), where stdout is the output of the git command and error is either null or an Error in case the git command fails.
The return value of this function will be the resolved value of the promise.
If the error parameter is not specified, it'll be handled automatically and the promise will be rejected in case of non 0 error codes.
const git = require("git-promise");
git("merge-base --is-ancestor master HEAD", function (stdout, error) {
if (!error) {
// the branch we are on is fast forward to master
return true;
} else if (error.code === 1) {
// no, it's not
return false;
} else {
// some other error happened
throw error;
}
}).then(function (isFastForward) {
console.log(isFastForward);
}).catch(function (err) {
// deal with the error
});
Version 1.0 changes the way the input command is parsed, so instead of executing anything that gets passed as the first parameter, it makes sure that git is the only executable used.
git("status | grep hello") won't be executed as a shell command, but everything will be passed as arguments to git, likely resulting in an error in this specific case.
If your git command stops working after upgrading to version 1.0
git(["merge-base", "--is-ancestor", "master", "HEAD"]);.Imagine to be on a local branch which is not fast forward with master and you want to know which commit were pushed on master after the forking point:
const git = require("git-promise");
function findForkCommit () {
return git("merge-base master HEAD", output => output.trim());
}
function findChanges (forkCommit) {
return git("log " + forkCommit + "..master --format=oneline",
output => output.trim().split("\n"));
}
const forkCommit = await findForkCommit();
const commits = await findChanges(forkCommit);
By default all git commands run in the current working directory (i.e. process.cwd()).
You can use the following syntax to run a git command in different folder
const git = require("git-promise");
await git("blame file1.js", {cwd: "src/"});
By default any command tries to use git in $PATH, if you have installed git in a funky location you can override this value using gitExec.
const git = require("git-promise");
await git("status", {gitExec: "/usr/local/sbin/git"});
This module comes with some utility methods to parse the output of some git commands
const util = require("git-promise/util");
util.extractStatus(output [, lineSeparator])Parse the output of git status --porcelain and returns an object with
{
branch: "current branch name, only if git status -b is used",
index: {
modified: ["list of files modified in the index"],
added: ["list of files added in the index"],
deleted: ["list of files deleted in the index"],
renamed: ["list of files renamed in the index"],
copied: ["list of files copied in the index"]
},
workingTree: {
modified: ["list of files modified in the local working tree"],
added: ["list of files added / renamed / copied in the local working tree"],
deleted: ["list of files deleted in the local working tree"]
}
}
The method works both with or without option -z.
util.hasConflict(output)Try to determine if there's a merge conflict from the output of git merge-tree
const git = require("git-promise");
const util = require("git-promise/util");
git("merge-tree <root-commit> <branch1> <branch2>").then(function (stdout) {
console.log(util.hasConflict(stdout));
});
Promise, not anymore a Q promise.
BREAKING CHANGE: Internally the library switches from shell to execFile to avoid problems with non sanitized input commands.
BREAKING CHANGE: Callbacks using 2 parameters now receive an error as second parameter instead of an error code.gitExec optionFAQs
Simple wrapper to run any git command and process it's output using promises.
The npm package git-promise receives a total of 13,485 weekly downloads. As such, git-promise popularity was classified as popular.
We found that git-promise demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.