Merge branch 'master' into v2

* master:
  Revert #2126 (#2202)
  Use child_process.execFile to prevent unescaped stuff (#2206)
  1.4.4

app/config/init.js

@@ -1,5 +1,4 @@
 const vm = require('vm');
-const merge = require('lodash/merge');
 const notify = require('../notify');
 
 const _extract = function(script) {
@@ -38,9 +37,6 @@ const _init = function(cfg) {
       return _extractDefault(cfg.defaultCfg);
     }
 
-    // Use options from default config  when not specified in user config #1588
-    _cfg.config = merge(_extractDefault(cfg.defaultCfg).config, _cfg.config);
-
     // Ignore undefined values in plugin and localPlugins array Issue #1862
     _cfg.plugins = (_cfg.plugins && _cfg.plugins.filter(Boolean)) || [];
     _cfg.localPlugins = (_cfg.localPlugins && _cfg.localPlugins.filter(Boolean)) || [];

app/package.json

@@ -2,7 +2,7 @@
   "name": "hyper",
   "productName": "Hyper",
   "description": "A terminal built on web technologies",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "license": "MIT",
   "author": {
     "name": "Zeit, Inc.",
@@ -19,7 +19,6 @@
     "electron-config": "1.0.0",
     "electron-is-dev": "0.3.0",
     "electron-squirrel-startup": "1.0.0",
-    "lodash": "4.17.4",
     "file-uri-to-path": "1.0.0",
     "git-describe": "4.0.2",
     "mkdirp": "0.5.1",

app/plugins/install.js

@@ -16,14 +16,14 @@ module.exports = {
         //eslint-disable-next-line no-console
         console.log('Launching yarn:', cmd);
 
-        cp.exec(
-          cmd,
+        cp.execFile(
+          process.execPath,
+          [yarn].concat(args),
           {
             cwd: plugs.base,
             env,
-            shell: true,
             timeout: ms('5m'),
-            stdio: ['ignore', 'ignore', 'inherit']
+            maxBuffer: 1024 * 1024
           },
           err => {
             if (err) {
@@ -31,7 +31,6 @@ module.exports = {
             } else {
               cb(null);
             }
-
             end();
             spawnQueue.start();
           }