curl only skips reading `.curlrc` when `-q` is its very first argument;
anywhere else, the config file has already been read by the time `-q` is seen.
a4f89c62 added `-q` to every curl call so that a user's `.curlrc` would not affect nvm,
but 6a3b1dd2 (v0.33.2)
put `--compressed` in front of it everywhere.
bd090ef7 (v0.40.0)
moved it back to the front in `nvm.sh`'s `nvm_download`,
and then 6d870d18 (v0.40.5) began building those arguments with `set --`,
prepending `--compressed` after `-q`,
so whenever curl supports compression, `-q` was second again.
`nvm_get_latest` and `install.sh`'s `nvm_download` have passed
`--compressed` before `-q` since v0.33.2.
Pass `-q` first in all three places.
Settings in a user's `.curlrc`
(such as a proxy, CA bundle, or `write-out`)
no longer apply to nvm's own curl calls,
as was intended,
and as in v0.40.0 through v0.40.4 for `nvm_download`;
the corresponding environment variables
(eg, `https_proxy`, `CURL_CA_BUNDLE`) still apply.
The existing `nvm_get_latest` test pinned the old argument order,
so its expectation is updated
Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.
zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time,
and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads.
Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`;
the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit.
The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead,
via a shared `make_fake_curl` helper in `test/common.sh`,
and a new test asserts the bypass.
Refs #2923
Add `try` and `try_err` helper functions to `test/common.sh` that capture stdout/stderr and exit code from a single invocation, eliminating duplicate command executions in tests.
Convert all existing tests that used the `OUTPUT`/`EXIT_CODE` double-invocation pattern to use the new helpers.
Also fixes a pre-existing bug in the `nvm_die_on_prefix` test where ASCII apostrophes were used instead of U+2019 to match nvm.sh output.
curl output is turned off by `-s` in the same place, we should unify the
behavior on wget, also, this help removes those wget outputs that can't
fit our coding style tests. cc #1739
Enable `--compressed` parameter on curl to automatically enable
compression on request content by sending coressponding header, if the
server side supports compression format like deflate or gzip, curl will
also decompress the content automatically, so there is no additional
works need to done manually on client side, but just enjoy the benifits
of bandwidth and time saving!
Take https://nodejs.org/dist/index.tab as an example which is last
modified on Tue, 14 Mar 2017 22:41:05 GMT, the compressed transmission
only take 4829 bytes howevet the not compressed on taks 48000 bytes,
which is about 10 times larger!
This feature can be traced back to Sep 3 2002, in curl commit:
- https://github.com/curl/curl/commit/64bbe9dfafc6693a96b742f3133c636385835a19
So should be supported on various versions widely.
Jordan Harband
ryenus
Peter Dave Hello
Qiangjun Ran