From cfb33c84ed5ef391383dec8acdfefdb302c38769 Mon Sep 17 00:00:00 2001
From: Jordan Harband <ljharb@gmail.com>
Date: Sat, 17 Oct 2026 22:38:05 -0700
Subject: [PATCH] [Fix] `nvm_nvmrc_invalid_msg`: respect `--silent`

The invalid `.nvmrc` message, which includes the file's parsed content, was printed even when `NVM_SILENT` was set (eg, by `nvm use --silent`), unlike nvm's other `.nvmrc` messages. It is now suppressed there too; the exit status still reports the invalid file.

This is hardening, not a vulnerability fix: since 67268ebc (the fix for ANT-2026-G9REVGKT), the content of a symlinked `.nvmrc` is never shown, so this message only ever shows the content of a regular `.nvmrc`.
Found by Anthropic's OSS Scanner while analyzing ANT-2026-G9REVGKT.
---
 nvm.sh                                        |  4 ++++
 ..._process_nvmrc_content respects NVM_SILENT | 21 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100755 test/fast/Unit tests/nvm_process_nvmrc_content respects NVM_SILENT

diff --git a/nvm.sh b/nvm.sh
index 4d842ac0..7c183b83 100755
--- a/nvm.sh
+++ b/nvm.sh
@@ -880,6 +880,10 @@ nvm_find_nvmrc() {
 }
 
 nvm_nvmrc_invalid_msg() {
+  if [ "${NVM_SILENT:-0}" -eq 1 ]; then
+    return 0
+  fi
+
   local error_text
   error_text="invalid .nvmrc!
 all non-commented content (anything after # is a comment) must be either:
diff --git a/test/fast/Unit tests/nvm_process_nvmrc_content respects NVM_SILENT b/test/fast/Unit tests/nvm_process_nvmrc_content respects NVM_SILENT
new file mode 100755
index 00000000..b17f43da
--- /dev/null
+++ b/test/fast/Unit tests/nvm_process_nvmrc_content respects NVM_SILENT	
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+die () { echo "$@" ; exit 1; }
+
+: nvm.sh
+\. ../../../nvm.sh
+
+\. ../../common.sh
+
+try_err nvm_process_nvmrc_content 'secret=hunter2'
+[ "${CAPTURED_EXIT_CODE}" = '1' ] || die "expected exit code 1; got ${CAPTURED_EXIT_CODE}"
+case "${CAPTURED_STDERR}" in
+  *'invalid .nvmrc!'*'secret=hunter2'*) ;;
+  *) die "expected the invalid .nvmrc message; got >${CAPTURED_STDERR}<" ;;
+esac
+
+NVM_SILENT=1
+try_err nvm_process_nvmrc_content 'secret=hunter2'
+unset NVM_SILENT
+[ "${CAPTURED_EXIT_CODE}" = '1' ] || die "expected exit code 1 with NVM_SILENT=1; got ${CAPTURED_EXIT_CODE}"
+[ -z "${CAPTURED_STDERR}" ] || die "expected no output with NVM_SILENT=1; got >${CAPTURED_STDERR}<"