[Fix] nvm_remote_versions: only consult io.js's version list for majors 1 through 3

io.js only released v1 through v3,
but its version list was downloaded and searched for every pattern,
including ones like `0.12` or `20` that can only ever match node versions.
Besides the needless index.tab download on every such `nvm install`,
io.js's "no match" status was returned even when node had matches,
so `nvm ls-remote 20` printed node's versions and then exited 3.
Patterns whose major is 0 or 4+ now only consult node's list,
so `nvm ls-remote` exits 0 for them when node has matching versions.
The listed and resolved versions are unchanged

Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.

test/fast/Unit tests/nvm_remote_version

@@ -74,6 +74,7 @@ try nvm_remote_version node
 nvm_ls_remote() {
   case "${1-}" in
     20 | v20.0.0) echo "v20.0.0" ;;
+    0.12) echo "v0.12.18" ;;
     *) echo "N/A"; return 3 ;;
   esac
 }
@@ -86,6 +87,14 @@ for PATTERN in 20 v20.0.0; do
   [ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version ${PATTERN} should exit with code 0, got $CAPTURED_EXIT_CODE"
 done
 
+# io.js only released v1 through v3, so it is not consulted for any other major
+try nvm_remote_version 0.12
+[ "_$CAPTURED_STDOUT" = "_v0.12.18" ] || die "nvm_remote_version 0.12 should return v0.12.18, got $CAPTURED_STDOUT"
+[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 0.12 should exit with code 0, got $CAPTURED_EXIT_CODE"
+try nvm_remote_version 99
+[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 99 should return N/A, got $CAPTURED_STDOUT"
+[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 99 should exit with code 3, got $CAPTURED_EXIT_CODE"
+
 # Test LTS name rejection (Issue #3474)
 # When nvm_remote_versions returns a line with LTS name in description,
 # nvm_remote_version should reject it if the pattern doesn't match the version number

test/fast/Unit tests/nvm_remote_versions

@@ -69,6 +69,22 @@ try nvm_remote_versions iojs
   || die "nvm_remote_versions iojs did not return contents of nvm_ls_remote_iojs; got $CAPTURED_STDOUT"
 [ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions iojs did not exit with 0, got $CAPTURED_EXIT_CODE"
 
+# io.js only released v1 through v3, so only node is consulted for any other major
+for PATTERN in 0 0.12 v0.12.18 4 4.1 v4.0.0 9 10 v20 20.0 v20.0.0 30.1; do
+  try nvm_remote_versions "${PATTERN}"
+  [ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote "${PATTERN}")" ] \
+    || die "nvm_remote_versions ${PATTERN} did not return contents of nvm_ls_remote ${PATTERN} only; got $CAPTURED_STDOUT"
+  [ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions ${PATTERN} did not exit with 0, got $CAPTURED_EXIT_CODE"
+done
+
+for PATTERN in 1 v1 1.8 2 v2.5.0 3 3.3; do
+  try nvm_remote_versions "${PATTERN}"
+  [ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote "${PATTERN}")
+$(nvm_ls_remote_iojs "${PATTERN}")" ] \
+    || die "nvm_remote_versions ${PATTERN} did not return contents of nvm_ls_remote ${PATTERN} combined with nvm_ls_remote_iojs ${PATTERN}; got $CAPTURED_STDOUT"
+  [ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions ${PATTERN} did not exit with 0, got $CAPTURED_EXIT_CODE"
+done
+
 # io.js versions sort after node v0.x and before node v4+, even when node's list has no v4.0.0
 nvm_ls_remote() {
   echo "v0.10.48"
@@ -114,4 +130,16 @@ iojs-v3.3.1" ] \
   || die "nvm_remote_versions foo did not put io.js versions after node v0.x when node has no v4+; got $CAPTURED_STDOUT"
 [ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions foo did not exit with 0, got $CAPTURED_EXIT_CODE"
 
+# io.js having no matching versions does not make a node-only pattern fail
+nvm_ls_remote() {
+  echo "v20.0.0 Iron *"
+}
+nvm_ls_remote_iojs() {
+  echo "N/A"
+  return 3
+}
+try nvm_remote_versions 20
+[ "_$CAPTURED_STDOUT" = "_v20.0.0 Iron *" ] || die "nvm_remote_versions 20 did not return node's list; got $CAPTURED_STDOUT"
+[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions 20 did not exit with 0, got $CAPTURED_EXIT_CODE"
+
 cleanup