285 Commits

Include renames

Author	SHA1	Message	Date
NUAAwqy	edde7ce995	[Refactor] install.sh: check profile lines through one comment-aware helper ... `nvm_do_install` checked for its `nvm.sh` and `bash_completion` source lines with two separate regexes that each had to skip commented-out lines. Move that into `nvm_profile_has_line`, which strips whole-line comments before matching, and test the `bash_completion` line and an already set up profile too.	2026-10-29 17:46:35 +00:00
Vaibhav CheruvuandJordan Harband	db03e5e1c3	[Fix] install.sh: ignore commented-out profile source lines ... `nvm_do_install` decided whether the profile already loads nvm, and its bash completion, by grepping for `/nvm.sh` and `$NVM_DIR/bash_completion` anywhere in it, so a commented-out line, the usual way to disable nvm, counted as present, and reinstalling left the shell with no nvm. Only count a line whose first non-blank character isn't `#`. Fixes #1889. Signed-off-by: Vaibhav Cheruvu <vaibhavsharma.c@gmail.com> Co-authored-by: Vaibhav Cheruvu <vaibhavsharma.c@gmail.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-11-03 13:21:38 -06:00
Jay Hemnani	c7a1b344da	[Fix] install.sh: only write $HOME when $NVM_DIR is inside it ... The profile line was built by replacing a leading `$HOME` with `sed`, without a path boundary, and with `$HOME` treated as a regex. With `HOME=/home/me` and `NVM_DIR=/home/me2/nvm`, or with `HOME=/` and `NVM_DIR=/usr/local/nvm`, the profile got `export NVM_DIR="$HOME2/nvm"` or `export NVM_DIR="$HOMEusr/local/nvm"`, which expand to the wrong directory, so nvm does not load in new shells. A `.` in `$HOME` matched any character, a `:` in it broke the `sed` expression, and a trailing slash on it left `$HOME.nvm`. Match `$HOME` literally, as a whole path component, and leave the path absolute when `$HOME` is empty.	2026-10-15 18:13:32 +05:30
NUAAwqyandCodex	f0d372b01b	[Fix] install.sh: nvm_check_global_modules: don't run a Windows npm under WSL ... Under WSL, `PATH` can include a Windows Node install, so `command -v npm` can find its `npm` shell shim, which then failed against Windows paths. That npm is not a system node that nvm would shadow, so under WSL, skip an npm that has an `npm.cmd` beside it: both the Node installer and npm's own shims put one there. Outside WSL (eg, Git Bash or Cygwin), a Windows npm is the system node, so the warning is kept. Fixes #3700. Signed-off-by: NUAAwqy <146524024+NUAAwqy@users.noreply.github.com> Co-Authored-By: Codex <noreply@openai.com>	2026-10-27 16:28:52 -07:00
Jordan Harband	00217de1e1	[Fix] install.sh: don't let a git repository in the current directory affect git ls-remote ... `install_nvm_from_git` checked whether `$NVM_INSTALL_VERSION` is a ref with a bare `git ls-remote`, which discovers and loads the config of whatever repository contains the current directory. That repository's `url.*.insteadOf` and `core.sshCommand` could then redirect or hijack the check, unlike every other git command in the function, which already passes `--git-dir="$INSTALL_DIR"/.git`. Pass `--git-dir` here too; `ls-remote` works even when that directory does not exist yet, as on a fresh install Discovered by Anthropic's OSS Scanner, as ANT-2026-JS4YHKRK; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	0333df56ca	[Robustness] install.sh, nvm uninstall: pass the version to grep with -e ... `install_nvm_from_git` passed `$NVM_INSTALL_VERSION` to grep as a bare argument, and `nvm uninstall` did the same with the resolved version when looking for aliases that point to it, so a value starting with `-` would have been parsed as grep options rather than as the pattern. Neither value crosses a trust boundary (the first is the user's own environment variable, and the second is an already-installed version, which never starts with `-`), but every grep that receives a version should put it after `-e`, which POSIX specifies and which nvm.sh already uses elsewhere Discovered by Anthropic's OSS Scanner, alongside vulnerability ANT-2026-EN9DM7WC; this change is not itself a vulnerability fix.	2026-10-23 08:53:59 -07:00
Jordan Harband	c8a2a81f92	[Fix] nvm_download, nvm_get_latest, install.sh: pass -q to curl first, so .curlrc is ignored again ... curl only skips reading `.curlrc` when `-q` is its very first argument; anywhere else, the config file has already been read by the time `-q` is seen. a4f89c62 added `-q` to every curl call so that a user's `.curlrc` would not affect nvm, but 6a3b1dd2 (v0.33.2) put `--compressed` in front of it everywhere. bd090ef7 (v0.40.0) moved it back to the front in `nvm.sh`'s `nvm_download`, and then 6d870d18 (v0.40.5) began building those arguments with `set --`, prepending `--compressed` after `-q`, so whenever curl supports compression, `-q` was second again. `nvm_get_latest` and `install.sh`'s `nvm_download` have passed `--compressed` before `-q` since v0.33.2. Pass `-q` first in all three places. Settings in a user's `.curlrc` (such as a proxy, CA bundle, or `write-out`) no longer apply to nvm's own curl calls, as was intended, and as in v0.40.0 through v0.40.4 for `nvm_download`; the corresponding environment variables (eg, `https_proxy`, `CURL_CA_BUNDLE`) still apply. The existing `nvm_get_latest` test pinned the old argument order, so its expectation is updated Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:58 -07:00
Jordan Harband	cac4c8d7e0	[Fix] install.sh: a failed script-method download no longer clobbers the install or reports success ... With the script install method, `install_nvm_as_script` downloaded `nvm.sh`, `nvm-exec`, and `bash_completion` directly over the installed files. A dropped connection with curl left a truncated `nvm.sh`, and any wget failure (even just being offline) left all three files empty. Its failure was also ignored by `nvm_do_install`, which went on to edit the profile, source the broken `nvm.sh`, print the success message, and exit 0. Now each file is downloaded to a temporary `.download` name, every download is waited on (by PID, rather than returning while other downloads may still be writing), and the files are moved into place only once all of them have succeeded; on failure, the partial downloads are removed and the existing install is left untouched. `nvm_do_install` now exits with `install_nvm_as_script`'s failure status, matching the git install method Discovered by Anthropic's OSS Scanner, as bug ANT-2026-8TH8YGY5; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
lazerg	e45c2df7c0	[Fix] install.sh: start a new line before appending to a profile that does not end with one ... Fixes #3951	2026-10-08 18:50:50 +05:00
Jordan Harband	a885b885fe	v0.40.8 ... Bug Fixes - `nvm_alias`, `nvm_version_path`: reject `..` path components - `nvm_get_make_jobs`: count cores on platforms the `case` does not name - `nvm-exec`: improve the no-version failure message - `nvm use`: do not clobber `man`'s default search path (#3890) - `nvm_err`, `nvm_err_with_colors`: do not fail when stderr is closed (#3907) - `nvm_hash_reset`: only run `hash -r` where the shell supports it - `nvm_alias`: unset zsh's `extendedglob` while reading an alias file (#3891) - zsh: restore `nomatch` and `markdirs` rather than clobbering them - `nvm --help`: render the set-colors legend in color (#3915) - `nvm unload`: drop the undefined `nvm_format_help_message_colors` - `nvm_get_mirror`: allow ports, userinfo, IPv6 hosts, and percent-encoding - `nvm_sanitize_auth_header`: allow `~`, completing RFC 7235 `token68` (#3751) Refactors - `nvm --help`: extract the set-colors legend into `nvm_print_color_legend` Performance - Optimize nvm_tree_contains_path with in-memory POSIX parent-walk (#3912) Docs - [readme] document platforms with no official node binaries - `install.sh`: Fix missing words in bash/zsh completion message (#3887) - Remove stray closing HTML tag (#3919) Misc - [meta] remove CLAUDE.md symlink in favor of AGENTS.md (#3928) - [meta] add `release-notes.sh`, the release notes generator Tests - homebrew/actions changed their default branch - [actions] WSL: pin every distribution, and test the newest of each line - `nvm_print_color_legend`: look up the function with `PATH` emptied - `nvm_print_color_legend`: check for the function, not a same-named file - `nvm_print_color_legend`: fix the `fast` suite on GNU userlands - [actions] `release.yml`: provide `GH_TOKEN` so release-notes PR lookup can run	2026-09-21 10:23:47 +08:00
Hashim Khan	b6d7823bce	[Docs] install.sh: Fix missing words in bash/zsh completion message ... When profile detection fails, the completion hint omitted "correct file" between "to the" and "if you are using". Fixes #3528	2026-07-23 08:24:46 +05:00
Jordan Harband	f0b0c6bb0b	v0.40.7 ... New Stuff - `nvm install`: serialize concurrent installs of the same version - `nvm install`: add `NVM_NO_SOURCE_FALLBACK` to disable the source fallback Robustness - `nvm install`: reject a structurally broken installed version - `nvm_install_binary_extract`: replace a broken version dir atomically - `install.sh`: `nvm_download`: avoid `eval` so arguments aren't re-parsed by the shell Docs - [readme] link every referenced person and project to its canonical page Misc - [Dev Deps] update `markdown-link-check` Tests - install_nvm_from_git: don't fail when master is at the latest release tag	2026-08-17 23:08:13 -07:00
Jordan Harband	b17550a0b9	[Robustness] install.sh: nvm_download: avoid eval so arguments aren't re-parsed by the shell ... `install.sh` has its own `nvm_download`, which joined `"$@"` into a single string with `nvm_echo` and rewrote the curl-style flags with `sed`, then ran the result through `eval command wget $ARGS`. Flattening argv into a string is the root cause: every argument was re-parsed by the shell, so any shell metacharacter in a legitimate value was interpreted rather than passed through. An `$NVM_DIR` containing a space silently word-split and wrote to the wrong path, an apostrophe or parentheses were a syntax error, a glob character expanded against the cwd, and an `$NVM_SOURCE` mirror URL with an `&` in its query string backgrounded `wget` and ran the remainder as a bogus command. The `sed` rewrites were also unanchored substring replacements that would mangle a URL legitimately containing `-o `, and `ARGS` was an undeclared global that `nvm_reset` never unset. Translate the flags per-argument with a POSIX `set --` loop and invoke `command wget "$@"` instead, so each argument stays a literal argv element. This is the same shape `nvm.sh`'s `nvm_download` has used since 6d870d18, and it stops the two implementations from diverging. Unlike `nvm.sh`, no mirror-supplied data reaches this function: its arguments come only from `$NVM_SOURCE`, `$NVM_INSTALL_GITHUB_REPO`, `$NVM_INSTALL_VERSION`, `$NVM_DIR`, `$XDG_CONFIG_HOME`, and `$HOME`, and `install.sh`'s `nvm_latest_version` is a hardcoded string rather than `nvm.sh`'s `nvm_get_latest`. This is therefore a robustness fix and not a security one, since the only party who can influence these arguments is the one already running the installer.	2026-07-15 15:55:21 -07:00
Jordan Harband	b6cf55f6ad	v0.40.6	2026-07-15 14:09:54 -07:00
ryenus	0c1243a7ea	[Fix] bypass aliased curl ... Closes #2932	2023-01-10 15:32:47 +08:00
Jordan Harband	9142a92cdc	[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable ... `nvm_has` matches shell functions and aliases, but downloads now run via `command`, which skips them - a `curl` shell function with no curl binary on the PATH would select the curl path and fail with exit 127, instead of falling back to an available wget executable. The new `nvm_has_executable` helper resolves names the same way `command` does, so downloader selection and execution agree.	2026-07-08 13:03:16 -07:00
Jordan Harband	04fef13bdc	[Fix] use command to bypass curl/wget shell functions and aliases ... zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time, and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads. Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`; the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit. The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead, via a shared `make_fake_curl` helper in `test/common.sh`, and a new test asserts the bypass. Refs #2923	2026-07-08 13:02:41 -07:00
Jordan Harband	1889911f08	v0.40.5	2026-06-04 09:33:05 -07:00
Peter Dave Hello	59d4ea8f3e	[Docs] Clean up wording in docs and shell comments ... Adjust a few spelling, grammar, and naming inconsistencies in the docs and related shell comments without changing behavior.	2026-03-23 23:48:23 +08:00
Jordan Harband	25f836f81b	[Fix] install.sh: check mkdir return codes ... If directory creation fails (e.g., permissions), the script would continue and fail with confusing errors later. Fail early with a clear error message instead. Bugs introduced in https://github.com/nvm-sh/nvm/commit/68bf93514bdf5d2852ce74819350bed99eb472a6, https://github.com/nvm-sh/nvm/commit/6cee20a0717298658dd222efbc94616d96d5224c, and https://github.com/nvm-sh/nvm/commit/703babe60a9fa09d55fbc67107a07beba09ef090.	2026-03-14 14:44:24 -07:00
Jordan Harband	581317d05c	[Fix] install.sh: fix POSIX compliance, printf format strings, and profile detection ... - Use `=` instead of `==` for string comparison (POSIX compliance) - Use `printf '%b'` instead of variable as format string (prevents `%` characters in paths from being interpreted as format specifiers) - Fix `TRIED_PROFILE` to reference `PROFILE` instead of `NVM_PROFILE` which is known to be empty at that point Bugs introduced in https://github.com/nvm-sh/nvm/commit/a24ff3e605d72ce9480b2fad2d4c93f0093fa306, https://github.com/nvm-sh/nvm/commit/b6f1c156da0a998442c1c0b638082390118085ce, and https://github.com/nvm-sh/nvm/commit/a461a0fffcd9163726f4d652ca974d97a1097356 (PR https://github.com/nvm-sh/nvm/pull/1605).	2026-03-14 14:41:11 -07:00
Jordan Harband	62387b8f92	v0.40.4	2026-01-29 14:12:03 -08:00
Wes ToddandJordan Harband	ec8906b284	[Fix] install.sh: do not log when user has requested no profile modifications ... [Tests] `install.sh`: add tests for PROFILE=/dev/null profile skip Verify that when PROFILE="/dev/null" is set: - The "Profile not found" warning is suppressed - Profile modification is skipped as expected Co-authored-by: Wes Todd <wes@wesleytodd.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2019-12-05 19:30:26 -08:00
Curt J. Sampson	7c82abdbef	[Fix] install.sh: Force remote name of cloned repo to be 'origin' ... The script assumes that the name of the remote is `origin`, but this is not the case if the user has set `clone.defaultRemoteName` to another value in the ~/.gitconfig (or elsewhere in the configuration). Adding `-o origin` ensures that the remote will be called `origin` regardless of the `clone.defaultRemoteName` setting. Per PR #3341: - The minimum Git version this should work with is v1.7.10. (This is not documented in the repo itself; it's just an implicit requirement.) - The `--origin` option was added to `git clone` in commit 98a4fef3f2 which was released in v1.2.5. From the diff of that commit, the `-o` option was already available at that time. So this easily satisfies the above. - A comment in #3341 indicates that `-o` was added in v1.1.0. I've not verified this, but we probably don't need to track that down since by the above we're already well within requirements.	2025-09-12 18:27:48 +09:00
Jordan Harband	977563e97d	v0.40.3	2025-04-23 16:34:31 -07:00
Jordan Harband	ffec9fec72	v0.40.2 ... New Stuff - `install.sh`: add `$ZDOTDIR` to zsh search (#3458) Fixes - `reinstall-packages`: do not reinstall corepack (#3544) - avoid bash-specific syntax (#3499) - `install-latest-npm`: npm v11 is out - `nvm_install_latest_npm`: avoid unbound variable (#3447) - give a more helpful message when `lts` alias is mistakenly used (#3441) - `nvm ls`, `nvm alias`, `nvm install`: error when an LTS name is invalid - `nvm_normalize_lts`: error when an LTS name is not lowercase (#3417) Documentation - [readme] update link - [readme] fix `--no-use` example (#3479) - [readme] update copyright notice (#3507) - [readme] note zsh-nvm's AUTO_USE option (#2670) - [readme] add note about reloading zshrc after editing (#3052) - [readme] Update shell profile file install notes (#2241) - [readme] add docker tips (#2318) - [readme] remove `avn` from readme (#3469) - [readme] fnm -> nvm.fish (#2541) Refactors - prefer `case` over if/else chains - combine `sed -e` invocations/arguments Tests - `nvm exec`/`nvm run`: add `--silent` tests (#1259) - [actions] release test needs git tags - migrate `installation_iojs` test suite to GitHub Actions (#3476) - Migrate slow test suite from Travis CI (#3470) - temporarily skip this failing travis test to unblock progress - [actions] TOC: use latest LTS node - `install.sh`: clean up `nvm_detect_profile` tests - `nvm_detect_profile`: refactor (#3467) - run urchin tests on pull requests (#3466) - update mocks - ensure that unit tests use only mocked LTS names - [actions] use `node/install` instead of `node/run` Meta - disable blank issues - update issue template - add DCO (#3456) - Rename .github/ISSUE_TEMPLATE.md to .github/ISSUE_TEMPLATE/ISSUE_TEMPLATE.md (#3454)	2025-03-11 13:39:40 -07:00
menaechmi	abd02e5aae	[Fix] install.sh: fix failing install tests (#3458)	2024-11-12 11:57:02 -06:00
menaechmi	cd22c84026	[New] install.sh: add $ZDOTDIR to zsh search ... Fixes #3128	2024-11-06 16:53:58 -06:00
Jordan Harband	179d45050b	v0.40.1	2024-08-27 13:44:15 -07:00
Jordan Harband	81f18bc445	[patch] install.sh: fix node capitalization	2024-08-09 13:46:16 +12:00
Jordan Harband	deac4e0932	v0.40.0	2024-07-30 12:50:18 -07:00
Jordan Harband	bab86d5de5	v0.39.7	2023-12-05 21:50:27 -08:00
Jordan Harband	c73009f503	v0.39.6	2023-12-04 22:03:25 -08:00
Jordan Harband	4bdd57ba0f	[Fix] install.sh: when NVM_INSTALL_GITHUB_REPO is set, issue a warning ... This should only annoy those testing their PRs; real users should never set this env var	2023-11-02 21:10:09 -07:00
Jordan Harband	c92adb3c47	v0.39.5	2023-08-21 21:10:10 -07:00
Jordan Harband	8fbf8ab694	v0.39.4	2023-07-24 18:29:54 -07:00
Jordan Harband	552db40622	v0.39.3	2022-12-23 12:57:56 -08:00
Jordan Harband	0ccd099bff	v0.39.2	2022-10-13 16:25:25 -07:00
Maxim Lepekha	7c929f8742	[Fix] install.sh: support ~/.zprofile	2022-09-21 22:38:50 +02:00
Robert Shuford	35758b75ed	[Tests] github actions removed homebrew and broke shellcheck ... See https://github.com/actions/runner-images/issues/6283	2022-10-06 11:13:47 -04:00
Jordan Harband	39d9a42c35	[Fix] install.sh: error out if the install instructions are not followed	2022-02-08 10:40:11 -08:00
Jordan Harband	6cfaede5a0	[Fix] install: better error message when xcode command line tools are needed ... Fixes #2697. Fixes #2663.	2021-11-27 22:16:14 -08:00
Jordan Harband	9600617c52	v0.39.1	2021-12-17 14:55:52 -08:00
Jérôme Foray	4856407d26	[Fix] install: fix method=script install condition ... Fixes #2665; see 8937917	2021-11-30 16:07:22 +01:00
Jordan Harband	89379176ac	[Fix] install: properly check for curl/wget	2021-11-25 14:26:35 -08:00
Jordan Harband	2f40eeef2e	[shellcheck] apply v0.8.0 updates	2021-11-19 08:53:43 -08:00
Nix	c9e7bb2da1	[Fix] install script: Add --no-pager option to git branch	2021-10-23 22:23:55 +09:00
Jordan Harband	5b3d188b83	v0.39.0	2021-10-07 10:11:35 -07:00
Thomas Geirhovd	e98e9d9e4b	[Fix] install: Detect correct profile based on $SHELL var	2021-08-12 15:51:32 +02:00
Jordan Harband	3fea5493a4	v0.38.0	2021-03-29 12:49:10 -07:00