From 3741d1aa0253291c432e6ce3469f1d16dedbc914 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <hello@mcornella.com>
Date: Wed, 26 Jan 2022 17:13:10 +0100
Subject: [PATCH] fix(npx)!: detect new `npx` versions and fail gracefully
 (#10452)

BREAKING CHANGE: the `npx` plugin used a feature of `npx` to check for
npm packages and run them if a command was not found. This feature was
removed in v7.0.0 and was deemed insecure. The `npx` plugin is now
officially deprecated and will be removed soon.

Fixes #10452
---
 plugins/npx/README.md      | 25 +------------------------
 plugins/npx/npx.plugin.zsh | 17 +++++++++++------
 plugins/osx/osx.plugin.zsh |  4 ++--
 3 files changed, 14 insertions(+), 32 deletions(-)

diff --git a/plugins/npx/README.md b/plugins/npx/README.md
index 41e4c1352..4b2aba8f0 100644
--- a/plugins/npx/README.md
+++ b/plugins/npx/README.md
@@ -1,27 +1,4 @@
-# NPX Plugin
-
-> npx(1) -- execute npm package binaries. ([more info](https://github.com/npm/npx))
-
-This plugin automatically registers npx command-not-found handler if `npx` exists in your `$PATH`.
-
-To use it, add `npx` to the plugins array in your zshrc file:
-
-```zsh
-plugins=(.... npx)
-```
-
-## Note
-
-The shell auto-fallback doesn't auto-install plain packages. In order to get it to install something, you need to add `@`:
-
-```
-➜  jasmine@latest # or just `jasmine@`
-npx: installed 13 in 1.896s
-Randomized with seed 54385
-Started
-```
-
-It does it this way so folks using the fallback don't accidentally try to install regular typoes.
+# npx plugin
 
 ## Deprecation
 
diff --git a/plugins/npx/npx.plugin.zsh b/plugins/npx/npx.plugin.zsh
index 32bb67377..c1e2eca98 100644
--- a/plugins/npx/npx.plugin.zsh
+++ b/plugins/npx/npx.plugin.zsh
@@ -1,7 +1,12 @@
-# NPX Plugin
-# https://www.npmjs.com/package/npx
-# Maintainer: Pooya Parsa <pooya@pi0.ir>
+if (( ! $+commands[npx] )); then
+  return
+fi
 
-(( $+commands[npx] )) && {
- source <(npx --shell-auto-fallback zsh)
-}
+if ! npx_fallback_script="$(npx --shell-auto-fallback zsh 2>/dev/null)"; then
+  print -u2 ${(%):-"%F{yellow}This \`npx\` version ($(npx --version)) is not supported.%f"}
+else
+  source <(<<< "$npx_fallback_script")
+fi
+
+print -u2 ${(%):-"%F{yellow}The \`npx\` plugin is deprecated and will be removed soon. %BPlease disable it%b.%f"}
+unset npx_fallback_script
diff --git a/plugins/osx/osx.plugin.zsh b/plugins/osx/osx.plugin.zsh
index 9304e7f32..3b0935981 100644
--- a/plugins/osx/osx.plugin.zsh
+++ b/plugins/osx/osx.plugin.zsh
@@ -1,5 +1,5 @@
-print ${(%):-'%F{yellow}The `osx` plugin is deprecated and has been renamed to `macos`.'}
-print ${(%):-'Please update your .zshrc to use the `%Bmacos%b` plugin instead.%f'}
+print -u2 ${(%):-'%F{yellow}The `osx` plugin is deprecated and has been renamed to `macos`.'}
+print -u2 ${(%):-'Please update your .zshrc to use the `%Bmacos%b` plugin instead.%f'}
 
 (( ${fpath[(Ie)$ZSH/plugins/macos]} )) || fpath=("$ZSH/plugins/macos" $fpath)
 source "$ZSH/plugins/macos/macos.plugin.zsh"