This lib function applies a patch to the VCS_INFO_formats function
in zsh versions from v5.0.3 until v5.8, which don't quote % chars
in some arguments received. Normally that just means that some
% characters in these strings (branch names, directories, etc.)
will be incorrectly parsed as formatting sequences.
With CVE-2021-45444, however, this means that one of these strings
from a malicious source (e.g. a malicious git repository) can
trigger command injection and run arbitrary code in the user's
machine when visiting such git repository.
Zsh 5.8.1 fixes this vulnerability [1], but older vcs_info setups
still need a workaround such as this one to patch the vulnerability.
[1] c3ea1e5d52
BREAKING CHANGE: some aliases have been renamed to be consistent with the rest.
Mainly, aliases for `juju show-` commands are renamed to `jsh*`. This also means
that `jsh` and `jshc` have been renamed to `jssh` and `jsshc`. Have a look at the
README for the complete alias changes.
The commands `omz plugin {enable,disable}` and `omz theme set`
automatically reload the zsh session on success. With this
change, the CLI checks whether the commands are run in an
interactive session before reloading the zsh session.
This change also conditionally sets the completion function
for `omz` so that it's not done in a non-interactive session.
BREAKING CHANGE: the `zsh_reload` was deprecated long ago and showed
a deprecation message. The `src` function was replaced by the CLI
command `omz reload`, so use that instead from now on.
BREAKING CHANGE: the `django` plugin was deprecated in 2021-09-22. With
this change it has now been removed altogether. Zsh already provides
built-in completion for Django commands.
BREAKING CHANGE: the `npx` plugin used a feature of `npx` to check for
npm packages and run them if a command was not found. This feature was
removed in v7.0.0 and was deemed insecure. The `npx` plugin is now
officially deprecated and will be removed soon.
Fixes#10452
Marc Cornellà
Carlo Sala
Sam Cook
Zachary Cutlip
sed-i
Michael Favia
Harris Miller
Robby Russell
Civan Yavuzşen
Gheritarish
Felipe Contreras
Lukas
ajr-dev
Kuri Schlarb
David Chin
Ricky Medina
Mathias Neerup
GitHubLeakedPAN, GitHubLeakedMyautsai