2516 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Jordan Harband	1f99e4c20b	[Fix] nvm_download_artifact: only put an archive in the cache once its checksum has passed ... `nvm install --offline` installs whatever archive sits at the cache path without checking it again, which is only safe if everything nvm writes there has been verified. When a download failed its checksum, `nvm_download_artifact` removed only the empty `files` directory and left the rejected archive in `$NVM_DIR/.cache`, so a later `nvm install --offline` would install the very tarball the online install had just refused. An interrupted download was also left at the final cache name. Download to a temporary `.unverified` name instead, run the 404 and checksum checks on that file, and move it to the cache path only once the checksum has passed. Every failure path, including a checksum mismatch or a missing expected checksum, now removes the temporary file and the version's cache directory, so `--offline` no longer finds the version at all. The README's offline section now says that only verified downloads are cached and that `--offline` trusts the cache as-is. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-7NCT51FE.	2026-10-16 22:02:45 -07:00
Jordan Harband	aa0572b7c4	[Fix] nvm_normalize_lts, nvm_ls_remote_index_tab: keep untrusted text out of shell arithmetic and LTS aliases ... `nvm_normalize_lts` matched `lts/-N` with a glob that only pins the first digit after `lts/-`, then evaluated the rest inside `$((N+1))`. bash and zsh evaluate a variable's contents as an arithmetic expression there, including command substitutions in array subscripts, so a name like `lts/-10*path[$(cmd)1]` ran `cmd`. Such a name reaches this function from `nvm alias`, `nvm use`, `nvm install`, and `.nvmrc`, and also from LTS alias files written from a mirror's `index.tab`, which are resolved whenever `lts/*` or that codename is used. The version column of a mirror's `index.tab` was used verbatim: printed by `nvm ls-remote` and `nvm version-remote`, matched against patterns, and stored as the target of `lts/*` codename aliases. A hostile or compromised mirror could thus persist such a payload into `$NVM_DIR/alias/lts/`, where it is replayed later by `nvm alias` and alias resolution without the mirror being involved, and could put terminal escape sequences on the user's screen. `nvm_normalize_lts` now takes everything after `lts/-` with parameter expansion and passes the name through unchanged unless it is all digits, before any arithmetic happens. `lts/-1` through `lts/-N`, and the error when there are not that many LTS lines, behave as before; malformed offsets like `lts/-1x` or `lts/-10+1` are now returned unchanged in every shell, instead of erroring in dash or being evaluated in bash and zsh. This also drops the `$?` check after the arithmetic, which could never fire. `nvm_ls_remote_index_tab` now skips the header and keeps only rows whose version is `vX.Y.Z`, optionally followed by a `-` prerelease suffix of letters, digits, `.` and `-`, before anything is printed, stored, or matched. The check runs on the raw column, before the `iojs-` prefix is added. Every row of the current nodejs.org, nodejs.org nightly, and iojs.org index files passes, including `rc`, `nightly`, and `v8-canary` versions. Discovered by Anthropic's OSS Scanner, as vulnerabilities ANT-2026-0GXXE91V and ANT-2026-31ZIEY85.	2026-10-16 21:35:44 -07:00
Yashvardhan Thanvi	6131a266a4	[Fix] nvm install: keep nvm options after the version out of ./configure ... Options after the version went to `./configure` for a source install and were ignored for a binary install. `--latest-npm`, `--default`, `--alias`, `--save` and `--no-progress` now also work after the version, like `--reinstall-packages-from` already does. `-s`, `-b`, `-j`, `--offline` and `--lts` are checked, or used to find the version, before it is resolved: after the version they now fail right away with a message to put them first, and so do `---` typos. Fixes #2066.	2026-11-04 00:37:28 +05:30
Yashvardhan Thanvi	d190476345	[Fix] nvm install: apply --alias, --default and --save after every install ... `nvm_install_binary` set the alias from its caller's variables, so a source install or an `$NVM_INSTALL_THIRD_PARTY_HOOK` install never got it, and no fresh install wrote `.nvmrc`. Apply both at the end of `nvm install`, after the install is validated. `--lts` without a version, or `lts/*`, leaves no provided version, and `nvm alias` treats an empty target as `nvm unalias`: `nvm install --lts --default` on an installed version removed the default alias. In that case point the alias at `lts/<name>`, as the default alias already is.	2026-11-04 00:35:16 +05:30
Jordan Harband	00cc205d6f	[Fix] nvm install: don't leave NVM_NO_PROGRESS set in the caller's shell ... `nvm install` passed the progress setting to `nvm_install_binary` and `nvm_install_source` as a prefix assignment, which bash 3.2 in POSIX mode (macOS's `sh`) keeps after a function call returns, so one install left `NVM_NO_PROGRESS=0` set, and every later `nvm install --no-progress` was ignored. Set it as a local instead.	2026-11-03 16:46:55 -06:00
Jordan Harband	17270cd532	[Perf] nvm_print_implicit_alias: classify implicit aliases in one awk pass ... To resolve `stable` and `unstable`, `nvm_print_implicit_alias` started an awk process per installed minor version, plus another per pre-1.0 one to check its parity. Classify the whole list in a single awk pass instead, and skip it when there is nothing to classify. The results are unchanged. Refs #3416. Refs #3811.	2026-11-03 14:42:50 -06:00
Wei-Lun Li	84b176d46d	[Fix] nvm_get_default_packages: ignore CRLF line endings ... A `default-packages` file saved with Windows line endings left a carriage return on every package name, and turned each blank line into a lone `\r` entry, so `npm install -g` was given `rimraf\r` and failed. Strip a trailing `\r` from each line before parsing it, like `.nvmrc` parsing already tolerates. Assisted-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Wei-Lun Li <b84330808@gmail.com>	2026-11-02 01:47:37 +09:00
NUAAwqy	edde7ce995	[Refactor] install.sh: check profile lines through one comment-aware helper ... `nvm_do_install` checked for its `nvm.sh` and `bash_completion` source lines with two separate regexes that each had to skip commented-out lines. Move that into `nvm_profile_has_line`, which strips whole-line comments before matching, and test the `bash_completion` line and an already set up profile too.	2026-10-29 17:46:35 +00:00
Vaibhav CheruvuandJordan Harband	db03e5e1c3	[Fix] install.sh: ignore commented-out profile source lines ... `nvm_do_install` decided whether the profile already loads nvm, and its bash completion, by grepping for `/nvm.sh` and `$NVM_DIR/bash_completion` anywhere in it, so a commented-out line, the usual way to disable nvm, counted as present, and reinstalling left the shell with no nvm. Only count a line whose first non-blank character isn't `#`. Fixes #1889. Signed-off-by: Vaibhav Cheruvu <vaibhavsharma.c@gmail.com> Co-authored-by: Vaibhav Cheruvu <vaibhavsharma.c@gmail.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-11-03 13:21:38 -06:00
NUAAwqyandJordan Harband	7ab48a653b	[Fix] nvm_print_implicit_alias: keep STABLE bound, and STABLE and UNSTABLE independent of the caller ... `STABLE` is only assigned inside the loop over `LAST_TWO`, but it is echoed unconditionally afterwards. With nothing installed, or with only an odd minor, the loop never runs, so under `set -u` `nvm ls` dies on `STABLE: unbound variable` instead of resolving `stable` to nothing. `local STABLE` without an initializer also keeps the caller's value in sh and dash, so `STABLE=x nvm ls stable` resolves the alias to something that isn't installed. Initializing it where it is declared fixes both, the way 139ed9c did for `PATTERN`, `NVM_LTS`, `LTS` and `VERSION`. `local UNSTABLE` keeps the caller's value the same way, which its `N/A` fallback doesn't cover, so it is initialized too. The nounset test now covers the two states that leave `stable` unresolved, and the caller test that `nvm ls stable` answers the same either way, and that an outer `UNSTABLE` doesn't become the `unstable` alias. Co-authored-by: NUAAwqy <146524024+NUAAwqy@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-10-29 17:08:50 +00:00
NUAAwqy	c8dc8c9b1c	[Fix] nvm_ls: treat a version dir with only hidden entries as empty ... `nvm_ls` decides whether a version dir is worth searching with `ls -1qA`, which also counts dotfiles, but then collects versions with `find "${DIR}"/*`, which never matches them. A dir holding nothing but hidden entries passes the guard, so when `nullglob` is not set `find` is handed the literal `*` and `nvm ls` prints "No such file or directory" to stderr. Drop `-A` from the guard so both halves agree on what counts as an entry. Fixes #3727.	2026-10-29 16:59:39 +00:00
NUAAwqy	c6bf252f7d	[Fix] ls: list versions whose directory is a symlink ... nvm_ls collects installed versions with `find <dirs>/* -name . -o -type d -prune -o -path ...`, and `-type d` is false for a symlink, so a version dir that links to another volume was skipped from the listing entirely - while `nvm version`, `nvm which` and `nvm use` all kept working on it. Have that find follow symlinks, which makes linked-in versions visible and still ignores a broken link. Fixes #617.	2026-10-29 14:59:29 +00:00
Wei-Lun Li	970ed9ea18	[Fix] nvm_die_on_prefix: check a nonexistent prefix on Windows ... On Windows, `npm_config_prefix` is resolved with `cd` + `pwd` so it can be compared with `$NVM_DIR`. When the directory does not exist yet, that resolution fails, the value becomes empty, and the check is skipped. Keep the value as given in that case, like on other systems. Assisted-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Wei-Lun Li <b84330808@gmail.com>	2026-10-29 09:48:45 +09:00
Jay Hemnani	c7a1b344da	[Fix] install.sh: only write $HOME when $NVM_DIR is inside it ... The profile line was built by replacing a leading `$HOME` with `sed`, without a path boundary, and with `$HOME` treated as a regex. With `HOME=/home/me` and `NVM_DIR=/home/me2/nvm`, or with `HOME=/` and `NVM_DIR=/usr/local/nvm`, the profile got `export NVM_DIR="$HOME2/nvm"` or `export NVM_DIR="$HOMEusr/local/nvm"`, which expand to the wrong directory, so nvm does not load in new shells. A `.` in `$HOME` matched any character, a `:` in it broke the `sed` expression, and a trailing slash on it left `$HOME.nvm`. Match `$HOME` literally, as a whole path component, and leave the path absolute when `$HOME` is empty.	2026-10-15 18:13:32 +05:30
Jordan Harband	93da6595ce	[Fix] nvm_is_version_or_alias: reject uppercase LTS names in every locale ... bash 3.2, macOS's `/bin/sh`, matches a bracket range like `[a-z]` by collation order in a UTF-8 locale, which interleaves upper- and lowercase letters, so `lts/Iron` from a symlinked `.nvmrc` was accepted there. Match with `[:lower:]` instead.	2026-11-02 15:58:23 -06:00
Jordan Harband	67268ebcb6	[Fix] nvm_process_nvmrc: don't show the content of a symlinked .nvmrc ... `.nvmrc` is found and read through symlinks, so a repository that commits `.nvmrc` as a symlink to a path outside itself (eg, `../../.npmrc`) made a plain `nvm use`, `nvm install`, or `nvm which` (or `nvm-exec`, or the README's auto-switching shell hook) print that file: the invalid `.nvmrc` message shows everything that was parsed, even with `--silent`, and a one-line file was taken as the version, which is printed in the "Found" message and in later errors. A symlinked `.nvmrc` is still followed, so linking to another version file (eg, `.node-version`, or a parent directory's `.nvmrc`) keeps working, but its content is never shown, and it is valid only if it names a version or an existing alias, via a new `nvm_is_version_or_alias` helper.	2026-11-02 11:34:39 -06:00
Jordan Harband	3f8411e58d	[Fix] nvm_write_nvmrc: don't write through a symlinked .nvmrc ... `nvm use --save` and `nvm install --save` wrote the version to `$PWD/.nvmrc` with `tee`, which follows a symlink, so a repository that commits `.nvmrc` as a symlink to a path outside itself made `--save` truncate any file the user can write (eg, a shell startup file or `~/.ssh/authorized_keys`) and replace it with the version string, or create the target of a dangling link. The link itself was left in place, so `git status` stayed clean. `nvm_write_nvmrc` now refuses, with a warning, when `.nvmrc` in the current directory is a symlink, dangling or not.	2026-11-02 11:27:17 -06:00
Jordan Harband	03f74a8666	[Fix] nvm_ls: match NVM_DIR literally ... `nvm_ls` strips `$NVM_DIR` and the io.js version dir from each installed version's path with sed, but put both into the regex as-is, so an `NVM_DIR` containing a backslash, `[`, or `*` listed no installed versions, and one containing `#` made sed fail. Escape both before use, as `SEARCH_PATTERN` already is.	2026-11-02 13:53:00 -06:00
maliv2	bfabdbc278	[Fix] nvm use: do not pile up PATH entries in nested sessions ... `nvm_change_path` prepends the new version (instead of replacing the existing nvm path) when a system bin dir precedes an nvm path, to handle macOS `path_helper` reordering the `PATH` of nested sessions (#1652). However, the check matched a system dir followed by *any* nvm path. Once a stale nvm path sits after the system dirs (e.g. inherited by a nested shell, tmux, or an editor's terminal), the check stays true forever, so every `nvm use` prepends yet another entry and the previously used version is never removed from the `PATH`. Only consider the first nvm path: if it is not preceded by a system bin dir, replace it in place as usual. Fixes #3561	2026-10-14 20:53:08 +03:00
Jordan Harband	799de1d2dc	[actions] TOC: use node/install instead of setup-node ... `lts/*` is now node 26, which is not in the runner's tool cache, so `setup-node` downloads it from a GitHub release asset host that the harden-runner allowlist blocks. `node/install` installs node with nvm from nodejs.org, like the other workflows.	2026-11-02 13:42:07 -06:00
Jordan Harband	16df5aa69a	[Fix] nvm_filter_installed_versions, nvm_filter_lts_versions, nvm_record_lts_status, nvm_get_default_packages: keep backslashes in NVM_DIR paths ... These passed a path under `$NVM_DIR` to awk with `-v`, which processes backslash escapes, so with a backslash in `NVM_DIR` awk opened the wrong file: the LTS status record read as empty, so `nvm_filter_installed_versions` treated every version as non-LTS and `nvm_filter_lts_versions` matched none, `nvm_record_lts_status` could not merge an index without LTS versions into the record, and `nvm_get_default_packages` named the wrong file in its error. The LTS functions now pass the path through the environment, like `nvm_strip_path` and `nvm_replace_literal`; `nvm_get_default_packages` uses awk's `FILENAME`, which is taken literally.	2026-11-02 12:30:15 -06:00
Mola-maker	8486d07a5e	[Fix] nvm_strip_path: preserve literal backslashes in NVM_DIR	2026-11-02 12:16:01 -06:00
Jordan Harband	5e38bc0cae	[Tests] pin --lts and node installs to end-of-life lines, so a new node release can't break them ... `nvm install --lts` and `nvm install node` resolve to whatever is newest on nodejs.org, so a partial release (eg, v26.13.0, published to `index.tab` before its `SHASUMS256.txt`) these tests fail without any change to nvm. `nvm exec --lts` and `nvm run --lts` now run against v18.20.8, with `lts/*` pointed at `lts/hydrogen` after setup's installs (which rewrite the LTS aliases), and restored in teardown. The `set -E` test now installs `9`, which still resolves remotely, since the ERR trap handling it covers is in `nvm()` itself. See https://github.com/nodejs/node/issues/67087	2026-10-28 10:37:00 -07:00
Daniel OriyanandClaude Opus 5.5	ea84cb311e	[Fix] nvm_find_up, nvm_find_project_dir: stop at a Windows drive root instead of looping forever ... With a Windows-style `$PWD` (e.g. `D:/Work`, as Git Bash inherits when launched by a native Windows program), `${path_%/*}` stops changing at `D:`, so the walk never ends and sourcing `nvm.sh` hangs. Stop when going up doesn't change the path, which also covers the existing `.` case. Fixes #3967. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RBGzjdkmgq6LSA7SFtjRsY	2026-10-23 13:54:04 +03:00
Shuyun Yang	13eee46e7d	[Fix] nvm_ls_cached: match dots in the version literally, and ignore a trailing dot ... The pattern reached `grep` as a regex, so its dots matched any character: `20.1.1` also matched a cached `v20.111.1`, which `nvm install --offline 20.1.1` could then pick as the newest match. A trailing dot, as in `20.1.`, likewise matched `v20.10.0` but not `v20.1.x`. A bare `v`, `iojs-`, or `iojs-v` now matches every cached node or io.js version respectively.	2026-10-27 20:08:55 -07:00
NUAAwqyandCodex	f0d372b01b	[Fix] install.sh: nvm_check_global_modules: don't run a Windows npm under WSL ... Under WSL, `PATH` can include a Windows Node install, so `command -v npm` can find its `npm` shell shim, which then failed against Windows paths. That npm is not a system node that nvm would shadow, so under WSL, skip an npm that has an `npm.cmd` beside it: both the Node installer and npm's own shims put one there. Outside WSL (eg, Git Bash or Cygwin), a Windows npm is the system node, so the warning is kept. Fixes #3700. Signed-off-by: NUAAwqy <146524024+NUAAwqy@users.noreply.github.com> Co-Authored-By: Codex <noreply@openai.com>	2026-10-27 16:28:52 -07:00
Jordan Harband	3fda4d5542	[New] select versions by category: alpha, lts, non-lts, iojs; exclude alphas by default ... Node 27 and later publish Alpha prereleases, like `v27.0.0-alpha.1.0.0`, in the main `index.tab`, so `nvm install node` or `nvm install 27` would otherwise pick one. Every version is in exactly one category: `alpha` and `lts` or `non-lts` (by index.tab's LTS column) on the node mirror, and `iojs` on the io.js mirror. Commands select from every category but `alpha`, unless `$NVM_ONLY` lists others, and every command that selects or lists versions takes `--only=<categories>` to override both; an exact alpha needs `alpha` selected, like any other. An LTS selection, like `--lts` or an `lts/` version, can't combine with an `--only=` that excludes `lts`. Telling installed `lts` and `non-lts` versions apart uses the recorded LTS status, and fails rather than guess without it. `nvm alias` also stores `--only=`, so `nvm alias default --only=alpha node` makes the latest installed alpha the default, including in a new shell.	2026-10-21 14:09:18 -07:00
Jordan Harband	11df5ed6f1	[Perf] nvm_is_installed_exact_version: also take the fast path for an exact prerelease ... An installed prerelease, like `v24.0.0-rc.1`, now resolves to itself without the `nvm_ls` pipeline, as releases already do.	2026-10-21 13:09:25 -07:00
Jordan Harband	fe2900d176	[New] nvm alias: store --lts and --lts=<name> ... `nvm alias default --lts node` writes `--lts node` to the alias file, so it resolves to the latest installed LTS version, using each version's recorded LTS status; `--lts=<name>` limits it to one LTS line. The flags of the outermost alias apply when one alias points at another, an alias with a flag this version of nvm doesn't recognize resolves to nothing, rather than ignoring the flag, and `nvm uninstall` also removes aliases with flags that point at the uninstalled version. A new shell never downloads index.tab, so it explains a default alias that needs LTS status that isn't recorded yet.	2026-10-21 12:57:19 -07:00
Jordan Harband	e5f1288b40	[New] record every node version's LTS status ... Each download of node's `index.tab` now merges every version's LTS codename, or `-`, into `$NVM_DIR/.lts-status`, keeping versions that download doesn't list, so the status of an installed version is known, and refreshed on every remote connection. Only an index that includes LTS versions can start the record, so a nightly or release candidate mirror can't, and `nvm_ensure_lts_status` downloads it once for versions installed before it was recorded. `update_test_mocks.sh` writes the record of its `index.tab` mock to `nodejs.org-dist-lts-status.txt`.	2026-10-21 12:52:04 -07:00
Jordan Harband	4007c0d062	[Tests] bash_completion: don't let zsh's compinit wait for an answer ... On runners where zsh considers a completion directory insecure, `compinit` asks whether to use it, and on the test's terminal waited for an answer forever, which hung every Ubuntu `fast` job. The test now sets `ZSH_DISABLE_COMPFIX`, which `bash_completion` already honors, and gives zsh no stdin.	2026-10-26 11:11:53 -07:00
Jordan Harband	139ed9ccc6	[Fix] nvm: ignore option variables set by the caller ... In dash, and in bash for a variable assigned in the command's own prefix (like `PATTERN=x nvm ls`), `local` keeps the outer value, so a variable a subcommand only sets conditionally, like `PATTERN`, `NVM_LTS`, `LTS`, or `VERSION`, could come from the caller, replacing the version argument, applying an LTS filter that was never requested, or making `nvm use`, without a version or an .nvmrc, use the caller's `VERSION`. Each such local is now initialized where it is declared.	2026-10-21 12:48:18 -07:00
Jordan Harband	6a085bc8b4	[Fix] nvm reinstall-packages: don't print VERSION='' in zsh ... `nvm` already declares `VERSION` local, and declaring an existing local again makes zsh print it.	2026-10-21 12:47:13 -07:00
Jordan Harband	fe017ae9bd	[Fix] nvm_alias, nvm_ls_remote_index_tab, nvm use: return the exit code of a failed check ... `if ! cmd; then return $?` returns the status of the negation, which is 0, so an uppercase LTS name, or an unusable installed version, was reported but still exited successfully.	2026-10-21 12:46:19 -07:00
Jordan Harband	fd23eb2037	[Fix] nvm_print_versions: don't mark N/A as installed ... With nothing installed, `nvm_ls` prints `N/A`, which then counted as an installed version, so `nvm ls` and an unmatched `nvm ls-remote` printed `N/A *`.	2026-10-21 13:52:16 -07:00
Jordan Harband	6cef0edd18	[Fix] nvm_ls: no blank line before system when nothing is installed ... `nvm ls` then printed an empty row ahead of the system version.	2026-10-21 12:44:44 -07:00
Jordan Harband	d65637f2e8	[Fix] nvm_print_versions: widen the version column for long versions ... Versions longer than 15 characters, like nightlies and release candidates, overflowed the fixed-width column, so `nvm ls` and `nvm ls-remote` misaligned them; the column now also fits the `->` before the current version.	2026-10-21 12:44:19 -07:00
Jordan Harband	f58d43f4d5	[Fix] nvm_ls: match a prerelease only up to a . ... A prerelease pattern matched any installed version containing it, so `nvm use v24.0.0-rc.1` could pick `v24.0.0-rc.10`, and a partial prerelease like `v24.0.0-rc` matched nothing. An installed exact prerelease now resolves to itself, and a partial one matches only versions that continue with a `.`.	2026-10-21 12:43:37 -07:00
Jordan Harband	aed19eb997	[Fix] nvm_ls: list every installed prerelease, in semver order ... `sort -u` keyed only on X.Y.Z treated prereleases of a release, and the release itself, as duplicates, so `nvm ls` hid all but one of them, and which one survived depended on directory order. `nvm_sort_versions` orders them by semver precedence instead, so `v24.0.0-rc.2` sorts before `v24.0.0-rc.10`, and both before `v24.0.0`.	2026-10-21 12:40:42 -07:00
Jordan Harband	79214249bb	[Fix] nvm uninstall: only remove aliases that point at the uninstalled version ... Matching alias files by substring also removed aliases to longer versions, so uninstalling v20.1.1 deleted an alias to v20.1.10. Each alias's target is now read the way `nvm_alias` reads it, ignoring comments, and in zsh an empty alias directory no longer errors with "no matches found".	2026-10-21 12:39:28 -07:00
Jordan Harband	43a2abbfd5	[Fix] nvm_ls_cached: only match whole version numbers ... An unanchored `grep` let a pattern match any cached version containing it, so `nvm install --offline 20.1.1` could install a cached v20.1.10, and `nvm install --offline iojs`, whose pattern is empty, matched every cached node version.	2026-10-21 12:39:00 -07:00
Jordan Harband	e7363fa669	[actions] tests-alpine: time out jobs well before GitHub's 6-hour limit ... A hung `fast` job, like the busybox `sh` lanes in `nvm debug`, otherwise ran for 6 hours before being cancelled. `fast` jobs take a few minutes and `musl-binary` jobs under one, so they now time out after 15 and 10.	2026-10-25 11:43:54 -07:00
Jordan Harband	898124fd60	[Fix] nvm debug: don't let the shell read stdin when asked for its version ... busybox's shells have no `--version`, and start an interactive shell instead, so with `$SHELL` set to busybox `sh` on a terminal, `nvm debug` waited for input forever, which hung the alpine `sh` CI lanes in the "mirror URL credentials are masked in output" test. Like the other busybox tools, its version now comes from `--help`, and every shell is given no stdin to read.	2026-10-25 11:42:45 -07:00
Jordan Harband	e780535240	[Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER ... curl 7.58.0 and later drop a custom Authorization header when a redirect leads to another host, but wget sends `--header` along to every redirect target, so on a machine without curl, a mirror that redirected elsewhere handed the credential to that other host. When a header is sent with GNU Wget, run it with `--max-redirect=0`. When it then exits with 8 (an HTTP error, which includes a redirect it did not follow), read the `Location` with one more request, and re-request it only if it keeps the same scheme, host, and port, up to 20 times. A redirect to another origin, including a downgrade to `http`, fails with exit code 8 and an error that names the URL nvm requested and suggests curl. `--max-redirect` is not a BusyBox wget option, so other wgets are invoked as before; the README says so Discovered by Anthropic's OSS Scanner, as ANT-2026-PKUZHTT3; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	e3aa232901	[Fix] nvm_download: only send $NVM_AUTH_HEADER to URLs under a mirror it applies to ... The header was added to every download, whatever the host. With only `$NVM_NODEJS_ORG_MIRROR` set, a private mirror's credential therefore also went to the default `https://iojs.org/dist` (eg, from `nvm ls-remote`), and with only `$NVM_IOJS_ORG_MIRROR` set, to `https://nodejs.org/dist`; it also went to `npmjs.org` when installing an old npm. Add `nvm_auth_header_applies_to`, which uses `nvm_get_mirror` and accepts a URL only when it is under a mirror, compared literally, with a `/` after the mirror's prefix. When exactly one of the two mirror variables is set, the header belongs to that mirror alone; when both or neither are set, both mirrors (including the defaults, when neither is) still receive it, so the documented example keeps working. An invalid mirror matches nothing, and no empty `Authorization:` header is sent when sanitizing leaves nothing Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	6bbbf3e8d3	[Tests] nvm_download: point the httpbin Authorization check at a configured mirror ... The httpbin check sends `$NVM_AUTH_HEADER` to `http://127.0.0.1/bearer` without configuring a mirror. Set `$NVM_NODEJS_ORG_MIRROR` to that host, as a real user of the header would, so the check keeps exercising the header once it is only sent to URLs under a mirror Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	00217de1e1	[Fix] install.sh: don't let a git repository in the current directory affect git ls-remote ... `install_nvm_from_git` checked whether `$NVM_INSTALL_VERSION` is a ref with a bare `git ls-remote`, which discovers and loads the config of whatever repository contains the current directory. That repository's `url.*.insteadOf` and `core.sshCommand` could then redirect or hijack the check, unlike every other git command in the function, which already passes `--git-dir="$INSTALL_DIR"/.git`. Pass `--git-dir` here too; `ls-remote` works even when that directory does not exist yet, as on a fresh install Discovered by Anthropic's OSS Scanner, as ANT-2026-JS4YHKRK; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	0333df56ca	[Robustness] install.sh, nvm uninstall: pass the version to grep with -e ... `install_nvm_from_git` passed `$NVM_INSTALL_VERSION` to grep as a bare argument, and `nvm uninstall` did the same with the resolved version when looking for aliases that point to it, so a value starting with `-` would have been parsed as grep options rather than as the pattern. Neither value crosses a trust boundary (the first is the user's own environment variable, and the second is an already-installed version, which never starts with `-`), but every grep that receives a version should put it after `-e`, which POSIX specifies and which nvm.sh already uses elsewhere Discovered by Anthropic's OSS Scanner, alongside vulnerability ANT-2026-EN9DM7WC; this change is not itself a vulnerability fix.	2026-10-23 08:53:59 -07:00
Jordan Harband	cbd8f8e920	[Fix] nvm_remote_versions: only consult io.js's version list for majors 1 through 3 ... io.js only released v1 through v3, but its version list was downloaded and searched for every pattern, including ones like `0.12` or `20` that can only ever match node versions. Besides the needless index.tab download on every such `nvm install`, io.js's "no match" status was returned even when node had matches, so `nvm ls-remote 20` printed node's versions and then exited 3. Patterns whose major is 0 or 4+ now only consult node's list, so `nvm ls-remote` exits 0 for them when node has matching versions. The listed and resolved versions are unchanged Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	59e008fd62	[Fix] nvm_remote_versions: place io.js versions by major version, not at the literal v4.0.0 ... io.js versions were inserted into node's version list immediately before the `v4.0.0` line. Whenever node's filtered list did not contain that exact line, every io.js version was appended after all node versions, including newer ones, so `nvm_remote_version`'s `tail -1` could pick an io.js version over the latest matching node version. Node's list is sorted, so it is now split at the first version with a nonzero major, which keeps io.js versions between node v0.x and node v4+ regardless of which node versions the pattern matched Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00