From 79472c537a54b9a79082fa8b04d24d14e7b22afe Mon Sep 17 00:00:00 2001
From: Leo Lamprecht <mindrun@icloud.com>
Date: Wed, 13 Sep 2017 20:55:47 +0200
Subject: [PATCH 1/3] 1.4.4

---
 app/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/package.json b/app/package.json
index b76a9b91..1374c7b6 100644
--- a/app/package.json
+++ b/app/package.json
@@ -2,7 +2,7 @@
   "name": "hyper",
   "productName": "Hyper",
   "description": "A terminal built on web technologies",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "license": "MIT",
   "author": {
     "name": "Zeit, Inc.",

From 53a5a425f7e9bc66785975ae626ab3c70288a5d0 Mon Sep 17 00:00:00 2001
From: Donghao Ren <donghao.ren@gmail.com>
Date: Fri, 15 Sep 2017 07:44:28 -0700
Subject: [PATCH 2/3] Use child_process.execFile to prevent unescaped stuff
 (#2206)

Fix #2173
---
 app/plugins/install.js | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/app/plugins/install.js b/app/plugins/install.js
index da322fbb..a4824a52 100644
--- a/app/plugins/install.js
+++ b/app/plugins/install.js
@@ -15,12 +15,11 @@ module.exports = {
         const cmd = [process.execPath, yarn].concat(args).join(' ');
         console.log('Launching yarn:', cmd);
 
-        cp.exec(cmd, {
+        cp.execFile(process.execPath, [yarn].concat(args), {
           cwd: plugs.base,
           env,
-          shell: true,
           timeout: ms('5m'),
-          stdio: ['ignore', 'ignore', 'inherit']
+          maxBuffer: 1024 * 1024
         }, err => {
           if (err) {
             cb(err);

From 97d1ae33d3d1fb4010f03994b5cc2c8e5be36637 Mon Sep 17 00:00:00 2001
From: CHaBou <chabup@delean.fr>
Date: Fri, 15 Sep 2017 20:23:03 +0200
Subject: [PATCH 3/3] Revert #2126 (#2202)

---
 app/config/init.js | 4 ----
 app/package.json   | 1 -
 2 files changed, 5 deletions(-)

diff --git a/app/config/init.js b/app/config/init.js
index 8cc446f7..65bbfa02 100644
--- a/app/config/init.js
+++ b/app/config/init.js
@@ -1,5 +1,4 @@
 const vm = require('vm');
-const merge = require('lodash/merge');
 const notify = require('../notify');
 
 const _extract = function (script) {
@@ -37,9 +36,6 @@ const _init = function (cfg) {
       return _extractDefault(cfg.defaultCfg);
     }
 
-    // Use options from default config  when not specified in user config #1588
-    _cfg.config = merge(_extractDefault(cfg.defaultCfg).config, _cfg.config);
-
     // Ignore undefined values in plugin and localPlugins array Issue #1862
     _cfg.plugins = (_cfg.plugins && _cfg.plugins.filter(Boolean)) || [];
     _cfg.localPlugins = (_cfg.localPlugins && _cfg.localPlugins.filter(Boolean)) || [];
diff --git a/app/package.json b/app/package.json
index 1374c7b6..4ab1befe 100644
--- a/app/package.json
+++ b/app/package.json
@@ -19,7 +19,6 @@
     "electron-config": "1.0.0",
     "electron-is-dev": "0.3.0",
     "electron-squirrel-startup": "1.0.0",
-    "lodash": "4.17.4",
     "file-uri-to-path": "1.0.0",
     "git-describe": "4.0.2",
     "mkdirp": "0.5.1",