🚨 [security] Update thor 0.20.3 → 1.4.0 (major) #249

depfu · 2025-07-21T20:26:17Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ thor (indirect, 0.20.3 → 1.4.0) · Repo · Changelog

Security Advisories 🚨

🚨 Thor can construct an unsafe shell command from library input.

Thor before 1.4.0 can construct an unsafe shell command from library input.

Release Notes

1.4.0

What's Changed

Lazily load YAML by @deivid-rodriguez in #892

Fix encoding error when trying to show a diff: by @Edouard-chin in #898

fix: Unsafe shell command constructed from library input by @odaysec in #897

Use git difftool for merge.tool identifiers by @moguls753 in #900

feat: support gsub_file erroring if gsub doesn't change anything, and add gsub_file! by @G-Rath in #877

New Contributors

@hlascelles made their first contribution in #893

@Edouard-chin made their first contribution in #898

@odaysec made their first contribution in #897

@moguls753 made their first contribution in #900

@G-Rath made their first contribution in #877

@Uaitt made their first contribution in #891

Full Changelog: v1.3.2...v1.4.0

1.3.2

What's Changed

Fix a few typos in README by @duffuniverse in #880

Correctly identify hyphenated and alias command names by @takmar in #878

New Contributors

@duffuniverse made their first contribution in #880

Full Changelog: v1.3.1...v1.3.2

1.3.1

What's Changed

Preserve Correct Indentation When Uncommenting Lines by @viktorianer in #873

Document the '--skip-' option for boolean options. by @andrewn617 in #876

New Contributors

@takmar made their first contribution in #865

@m-nakamura145 made their first contribution in #866

@cprodhomme made their first contribution in #863

@ancao90 made their first contribution in #872

@viktorianer made their first contribution in #873

@andrewn617 made their first contribution in #876

Full Changelog: v1.3.0...v1.3.1

1.3.0

What's Changed

use the correct class for shared namespaces by @Gerst20051 in #754

Allow to Override Order of Commands in Help by @alessio-signorini in #642

Add support for providing http headers to get by @dnlgrv in #801

Don't document negative boolean option named no_* by @BrentWheeldon in #797

CreateFile#identical? fixed for files containing multi-byte UTF-8 codepoints by @tomclose in #786

Drop support to Ruby 2.6 by @rafaelfranca in #821

Fix dashless option usage info by @sambostock in #800

Support Range in enum option by @phene in #775

Check if type: array values are in enum by @movermeyer in #784

Fix inject into file warning by @nicolas-brousse in #709

Support Thor::CoreExt::HashWithIndifferentAccess#slice method by @shuuuuun in #812

🌧️ long_desc: new option to disable wrapping by @igneus in #739

Print default in help when option type is :boolean and default is false by @nevesenin in #849

Silence encoding warnings in specs by @p8 in #857

Validate arguments for method_option and class_option by @p8 in #856

Fix help for file_collision method without block by @shuuuuun in #858

Extract print methods to seperate classes by @p8 in #854

Add support for printing tables with borders by @p8 in #855

Fix printing tables with borders and indentation by @p8 in #861

New Contributors

@Gerst20051 made their first contribution in #754

@alessio-signorini made their first contribution in #642

@dnlgrv made their first contribution in #801

@BrentWheeldon made their first contribution in #797

@tomclose made their first contribution in #786

@sambostock made their first contribution in #800

@phene made their first contribution in #775

@movermeyer made their first contribution in #784

@nicolas-brousse made their first contribution in #709

@shuuuuun made their first contribution in #812

@igneus made their first contribution in #739

@nevesenin made their first contribution in #849

Full Changelog: v1.2.2...v1.3.0

1.2.2

What's Changed

Respect implicit encoding of thorfiles by @timdiggins in #782

Switch hash from MD5 to SHA256 by @stanhu in #785

Respect the updated NO_COLOR specification by @coderjoe in #796

Remove support for deprecated OS by @peterzhu2118 in #798

Support thor install <uri> to install remote thor files by @deivid-rodriguez in #787

Update error message for content already exists case. by @jpgeek in #799

Allow setting file permissions with create_file by @skipkayhil in #820

Properly pad aliases for option usage by @p8 in #810

New Contributors

@ytkg made their first contribution in #767

@timdiggins made their first contribution in #780

@stanhu made their first contribution in #785

@jdufresne made their first contribution in #806

@peterzhu2118 made their first contribution in #798

@casperisfine made their first contribution in #807

@jpgeek made their first contribution in #799

@skipkayhil made their first contribution in #820

@p8 made their first contribution in #810

Full Changelog: v1.2.1...v1.2.2

1.2.1

What's Changed

Fix regressions with insert_into_file

Full Changelog: v1.2.0...v1.2.1

1.2.0

What's Changed

Support Thor::CoreExt::HashWithIndifferentAccess#except for Rails 6.0 by @koic in #734

The klass parameter 'inject_into_class' should be given a string type.(also inject_into_module) by @ratovia in #752

Added Shell::Basic#say_error by @postmodern in #750

Check for duplicate content in relevant section when inserting into files by @excid3 in #735

Loaded the directory under tasks. by @Mitsuru53 in #747

Update Thor::Actions#inside to return the value yielded by the block by @jordan-brough in #712

remove_file should unlink broken symlinks by @2called-chaos in #720

Use string interpolation for trailing whitespace by @jonathanhefner in #730

Indent multiline messages in say_status by @jonathanhefner in #714

Allow leading hyphen in switch values when specified with = by @univerio in #737

Fix for #707 by @scambra in #708

Support latest did_you_mean by @deivid-rodriguez in #761

New Contributors

@ratovia made their first contribution in #752

@excid3 made their first contribution in #735

@Mitsuru53 made their first contribution in #747

@jordan-brough made their first contribution in #712

@2called-chaos made their first contribution in #720

@univerio made their first contribution in #737

@scambra made their first contribution in #708

Full Changelog: v1.1.0...v1.2.0

1.1.0 (from changelog)

Don't use ANSI colors when terminal is dumb.

Ensure default option/argument is not erroneously aliased.

Fixes a bug in the calculation of the print_wrapped method.

Obey :mute and options[:quiet] in Shell#say.

Support Ruby 3.0.

Add force option to the gsub_file action.

1.0.1 (from changelog)

Fix thor when thor/base and thor/group are required without thor.rb.

Handle relative source path in create_link.

1.0.0 (from changelog)

Drop support to Ruby 1.8 and 1.9.

Deprecate relying on default exit_on_failure?. In preparation to make Thor commands exit when there is a failure we are deprecating defining a command without defining what behavior is expected when there is a failure.

To fix the deprecation you need to define a class method called exit_on_failure? returning

false if you want the current behavior or true if you want the new behavior.

Deprecate defining an option with the default value using a different type as defined in the option.

Allow options to be repeatable. See #674.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Update thor to version 1.4.0

d49bc38

depfu bot added the depfu label Jul 21, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚨 [security] Update thor 0.20.3 → 1.4.0 (major) #249

🚨 [security] Update thor 0.20.3 → 1.4.0 (major) #249

Uh oh!

depfu bot commented Jul 21, 2025

Uh oh!

Uh oh!

🚨 [security] Update thor 0.20.3 → 1.4.0 (major) #249

Are you sure you want to change the base?

🚨 [security] Update thor 0.20.3 → 1.4.0 (major) #249

Uh oh!

Conversation

depfu bot commented Jul 21, 2025

What changed?

↗️ thor (indirect, 0.20.3 → 1.4.0) · Repo · Changelog

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

1.1.0 (from changelog)

1.0.1 (from changelog)

1.0.0 (from changelog)

Uh oh!

Uh oh!