From b076039a6037d69e82993d42b5f5061a264ccc4b Mon Sep 17 00:00:00 2001 From: Jordan Harband Date: Sun, 18 Oct 2026 23:10:53 -0700 Subject: [PATCH] [Tests] `nvm install v1 works`: get the version from `nvm_remote_version`, not the `ls-remote` display The test took the last `nvm ls-remote` line and trimmed its whitespace, which kept the markers `ls-remote` adds once that version is installed (a trailing ` *`) or current (a leading `->`), so it passed eg `iojs-v1.8.4 *` to `nvm run` as the version. That only resolved because `nvm_ls` interpreted ` *` as a regex; ask `nvm_remote_version` for the version instead. Discovered by Anthropic's OSS Scanner, as bug ANT-2026-HZAFTTUK; the scanner correctly classified it as not a vulnerability. --- test/installation_iojs/nvm install v1 works | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/installation_iojs/nvm install v1 works b/test/installation_iojs/nvm install v1 works index 4498ee2e..f684049b 100755 --- a/test/installation_iojs/nvm install v1 works +++ b/test/installation_iojs/nvm install v1 works @@ -5,7 +5,7 @@ die () { echo "$@" ; exit 1; } \. ../../nvm.sh NVM_VERSION="v1" -NVM_PREFIXED_TEST_VERSION="$(nvm ls-remote "$NVM_VERSION" | tail -1 | sed 's/^[ ]*//;s/[ ]*$//')" +NVM_PREFIXED_TEST_VERSION="$(nvm_remote_version "$NVM_VERSION")" NVM_TEST_VERSION="$(nvm_strip_iojs_prefix "$NVM_PREFIXED_TEST_VERSION")" # Remove the stuff we're clobbering.