[Fix] nvm_nvmrc_invalid_msg: respect --silent

The invalid `.nvmrc` message, which includes the file's parsed content, was printed even when `NVM_SILENT` was set (eg, by `nvm use --silent`), unlike nvm's other `.nvmrc` messages. It is now suppressed there too; the exit status still reports the invalid file.

This is hardening, not a vulnerability fix: since 67268ebc (the fix for ANT-2026-G9REVGKT), the content of a symlinked `.nvmrc` is never shown, so this message only ever shows the content of a regular `.nvmrc`.
Found by Anthropic's OSS Scanner while analyzing ANT-2026-G9REVGKT.
This commit is contained in:
Jordan Harband committed 2026-10-17 22:38:05 -07:00
1 parent 903e349369
commit cfb33c84ed
2 files changed
+25

No files matched your search

@@ -0,0 +1,21 @@
#!/bin/sh
die () { echo "$@" ; exit 1; }
: nvm.sh
\. ../../../nvm.sh
\. ../../common.sh
try_err nvm_process_nvmrc_content 'secret=hunter2'
[ "${CAPTURED_EXIT_CODE}" = '1' ] || die "expected exit code 1; got ${CAPTURED_EXIT_CODE}"
case "${CAPTURED_STDERR}" in
*'invalid .nvmrc!'*'secret=hunter2'*) ;;
*) die "expected the invalid .nvmrc message; got >${CAPTURED_STDERR}<" ;;
esac
NVM_SILENT=1
try_err nvm_process_nvmrc_content 'secret=hunter2'
unset NVM_SILENT
[ "${CAPTURED_EXIT_CODE}" = '1' ] || die "expected exit code 1 with NVM_SILENT=1; got ${CAPTURED_EXIT_CODE}"
[ -z "${CAPTURED_STDERR}" ] || die "expected no output with NVM_SILENT=1; got >${CAPTURED_STDERR}<"