2372 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Jordan Harband	4e48294bd6	[Fix] nvm_ls_cached: include source-cached and io.js artifacts ... `--offline` version resolution could only see cached node binaries: `nvm_ls_cached` listed `.cache/bin` with a `node-` prefix filter, so cached source tarballs, and everything io.js, could never resolve offline. List both cache kinds, for both flavors, and update the pinned test expectations to match.	2026-07-09 22:35:15 -07:00
Jordan Harband	1a39786c8a	[Tests] nvm_offline_version: make it executable; pin nvm_ls_cached cache visibility ... The test was born without its executable bit, and urchin silently skips non-executable files, so it has never run. Also pin what `nvm_ls_cached` can currently see: only bin-cached node artifacts - bin-cached io.js, and src-cached anything, are invisible to it, and thus to `--offline` version resolution.	2026-07-09 22:35:15 -07:00
Mathew DodgsonandJordan Harband	3a8b51c46c	[Fix] auth header: Add all valid base64 chars to sanitize function	2026-05-25 11:14:39 +10:00
Jordan Harband	ebada63259	[Tests] aliases: cover the regex-metachar cycle fix; clean up fixtures in teardown ... The cycle scenarios all pass with the old grep-based detection too; the bug the `case`-based detection actually fixes is resolved names interpolated into the grep pattern as regexes, where resolving axb -> a.b falsely reported ∞ because the pattern `a.b` matches the seen name `axb`. Pin both directions: the fixed false positive, and a genuine cycle through a metachar name. Also correct the space-name scenario comment (the old anchored grep passed that scenario; only token-delimited seen-storage would not), and register every new fixture name in the suite teardown, so a mid-test failure can not leak aliases into later tests.	2026-07-09 15:58:41 -07:00
Jake LodwickandJordan Harband	0a9dead76d	[Refactor] nvm_alias: one-pass trailing whitespace strip ... Replace the per-character trailing-whitespace loop with a one-pass parameter expansion, per review.	2026-05-05 23:32:58 -04:00
Jake LodwickandJordan Harband	304a22ad59	[Refactor] nvm_alias: use [[:space:]] instead of literal tab ... [Tests] `nvm_alias`: add edge-case tests for hostile file content	2026-02-18 14:29:52 -07:00
Jake LodwickandJordan Harband	d22bf7f538	[Refactor] nvm_alias, nvm_resolve_alias: use builtins ... [Tests] `nvm_alias`, `nvm_resolve_alias`: add edge-case tests nvm_alias() used a sed/awk pipeline to strip comments and blank lines from alias files that almost always contain a single word. A while-read loop with parameter expansion does the same filtering more directly. nvm_resolve_alias() piped nvm_alias through head and tail to extract one line, and used printf/grep for cycle detection. Parameter expansion and a case statement replace both without the extra plumbing. All replacements are POSIX (read -r, case, IFS=, parameter expansion). As a side effect, this also removes 4 external process invocations during shell init. [Fix] `nvm_resolve_alias`: detect cycles via newline-anchored `case` The original commit referenced above changed SEEN_ALIASES from `\n`-delimited storage (interpreted by `printf '%b' | nvm_grep -e "^${name}$"`) to space- delimited but left the line-anchored grep in place — without newlines in the haystack the anchored pattern can never match, so cycles never break. Switch to literal-newline storage and a `case` pattern anchored on those newlines. Newline anchoring also handles alias names containing spaces, which token-based patterns false-positive on (e.g. lookup of `bar` matches substring " bar " inside " foo bar midway " when the chain visits the multi-token alias `foo bar`). New test file covers self-loop, multi-hop loop, cycle through a space-bearing alias name, and a non-cycle through a space-bearing alias name. Existing `test/fast/Aliases/circular/` fixtures continue to pass.	2026-02-17 13:44:31 -07:00
Jordan Harband	dd61ae4bc8	[Robustness] nvm_alias: explicitly succeed when the alias file is unreadable ... The sed/awk pipeline exits with awk's status, so an existing-but-unreadable alias file produces empty output with status 0 - but only by accident, alongside sed's read error on stderr. Make that contract explicit: a nonzero status here would flip `nvm_ensure_default_set` from "default is already set" to recreating it, silently overwriting a write-only default alias.	2026-07-09 15:43:56 -07:00
Jordan Harband	59cf9a4ef6	[actions] nvm-install-test: turn the expected v0.40.0 failures green ... The two `v0.40.0` + `nvmrc` jobs fail by design (https://github.com/nvm-sh/nvm/issues/3405), but job-level `continue-on-error` still displays them as failures on every run, which reads like the contributor broke something. Tolerate failure only in the steps that exercise the bug, scoped to that matrix combination, and add a final step that fails the job when the expected failure did not happen - so those jobs are green exactly when v0.40.0 misbehaves as documented, and turn red as a signal to remove this handling if v0.40.0 ever starts passing. This also restores strict failure semantics to the passing `v0.40.0` + `no nvmrc` jobs, which the job-level `continue-on-error` was needlessly masking.	2026-07-09 17:01:32 -07:00
Jordan Harband	21d33ef04a	[Tests] nvm_ls handles hash in pattern: fix cleanup, isolate NVM_DIR, cover the sed path ... - `cleanup` unset TEST_DIR before `rm -rf "${TEST_DIR-}"`, so the temp dir (with an executable fake `node`) was never removed, and urchin executes any executable file it finds under the test dir on the next local run. - the preexisting `foo#bar` assertions ran against the ambient NVM_DIR; now that `#` patterns comment-strip to `foo`, a real local alias named `foo` would resolve and break them, so all assertions now run against an isolated NVM_DIR. - the multiline content used a full x.y.z version, which takes nvm_ls's explicit-version fast path and never reaches the find/sed pipeline where the newline actually broke sed; a partial version exercises that path, and matching on "unterminated" covers both the BSD and GNU sed error wordings.	2026-07-08 23:14:23 -07:00
jinhyuk9714andJordan Harband	82315e2b18	[Fix] Parse commented nvmrc content in nvm_ls ... Fixes #3761 Signed-off-by: jinhyuk9714 <jinhyuk9714@gmail.com>	2026-06-09 00:21:55 +09:00
Yinan QinandJordan Harband	ab77712867	[New] install: add support for loongarch64 architecture	2025-10-25 19:19:05 +08:00
ryenusandJordan Harband	0c1243a7ea	[Fix] bypass aliased curl ... Closes #2932	2023-01-10 15:32:47 +08:00
Jordan Harband	9142a92cdc	[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable ... `nvm_has` matches shell functions and aliases, but downloads now run via `command`, which skips them - a `curl` shell function with no curl binary on the PATH would select the curl path and fail with exit 127, instead of falling back to an available wget executable. The new `nvm_has_executable` helper resolves names the same way `command` does, so downloader selection and execution agree.	2026-07-08 13:03:16 -07:00
Jordan Harband	04fef13bdc	[Fix] use command to bypass curl/wget shell functions and aliases ... zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time, and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads. Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`; the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit. The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead, via a shared `make_fake_curl` helper in `test/common.sh`, and a new test asserts the bypass. Refs #2923	2026-07-08 13:02:41 -07:00
Rahul BeniwalandJordan Harband	cb0e0ba8ed	[Fix] install: use darwin-x64 for all binary on mac for node < v16	2025-11-16 14:48:10 +05:30
Curt J. SampsonandJordan Harband	b16fb6ece9	[readme] Docker: build time is "several" minutes, not 8 ... On my system, even without using local mirrors, the build is only two minutes, even though I have only a 1 Gbps Internet connection and I'm half-way across the world in Tokyo. There probably are still users with much slower Internet connections where the build could take eight minutes or more, but "several" still covers that.	2025-09-15 18:06:37 +09:00
Curt J. SampsonandJordan Harband	190cb9458b	[readme] Docker: Just say "Ubuntu" (no version) for base image ... The base image is updated regularly (it's currently 22.04), and it's easy to forget to update this readme, so best we simply not repeat ourselves and instead let people look at `Dockerfile` to see exactly which version of Ubuntu it's using.	2025-09-15 08:20:51 +00:00
Jordan Harband	e2e612e722	[Tests] installation_node: only match top-level global packages	2026-07-02 15:49:01 -05:00
Jordan Harband	041a57747a	[Tests] installation_node: use a published is-nan version ... `is-nan@1.0.0` was published on 2014-07-05 and unpublished minutes later (the registry's `time` map still lists it, but `versions` jumps from `0.0.0` to `1.0.1`), so `npm install -g is-nan@1.0.0` fails with `ETARGET`, and the regression test added in ce157343 fails deterministically in every shell. See https://github.com/nvm-sh/nvm/actions/runs/28407118533	2026-07-02 14:35:57 -05:00
Jordan Harband	419ff4efec	[actions] update workflows	2026-06-29 17:33:31 -05:00
Jordan Harband	7a7908ffa1	[Dev Deps] update doctoc, semver	2026-06-29 16:43:55 -05:00
Jordan Harband	ce15734300	[Fix] nvm install: migrate packages/set alias when target is already installed ... When `nvm install <target>` found that `<target>` was already installed, the post-`nvm use` steps (`--reinstall-packages-from`, default packages, and `--alias`/`--default`) were gated on `[ $EXIT_CODE -ne 0 ]`. Since that branch is only entered when `nvm use` succeeded (EXIT_CODE == 0), those conditions were always false, so the steps were silently skipped. The fresh-install branch correctly uses `-eq 0`; mirror that here so `--reinstall-packages-from` actually migrates global packages (and the alias/default get set) when the target version already exists. Includes a regression test covering the already-installed path. Fixes #3858	2026-06-29 16:39:19 -05:00
Jordan Harband	ee4fa818d2	[Docs] document nvm reinstall-packages as a standalone command ... The standalone `nvm reinstall-packages <version>` command can migrate global npm packages between already-installed versions, but it was only mentioned in `nvm --help`, not in the README. Add a section covering it. Refs #3858	2026-06-29 14:51:15 -05:00
Jordan Harband	a6ec739430	[Docs] document current and clarify .nvmrc fallback in help/README ... - Help text for `nvm install`/`use`/`exec`/`run`/`which` now ends with "Uses .nvmrc if version is omitted; otherwise errors." so it's clear that omitting the version is not a free fallback. - Help signatures for `use`/`exec`/`run` now show `[current | <version>]` to mirror `nvm which` and document that `current` is accepted. - `nvm current` description now spells out that it resolves via `$PATH` and is not affected by `.nvmrc`. - README: add `current` to the list of special aliases, with the same caveat. The `.nvmrc` section now states that `nvm use`/`install`/`which` exit with status 127 when neither a version nor an `.nvmrc` resolves, notes the (current) `exec`/`run` fallback as undefined behavior, and points readers at `current` for the explicit "active node" use case. Refs #3755	2026-06-10 15:16:24 -07:00
Jordan Harband	718e880890	[Fix] focused error on missing/invalid args for several subcommands ... Previously a number of subcommands dumped the entire `nvm --help` output (~100 lines) when arguments were missing or invalid, drowning the real error. Replace each dump with a short, command-specific usage block that names the expected syntax and points to `nvm --help` for full help. The exit code (127) is unchanged. Affected subcommands: - `nvm install` (no version + no .nvmrc) - `nvm use` (version unresolvable) - `nvm run` (no version + no .nvmrc) - `nvm which` (no version + no .nvmrc) - `nvm cache` (unknown subcommand) - `nvm uninstall` (wrong arg count) - `nvm unalias` (wrong arg count) - `nvm install-latest-npm` (wrong arg count) - `nvm reinstall-packages` / `nvm copy-packages` (wrong arg count) The catch-all unknown-subcommand handler still dumps full help, since in that case the user has no narrower context to be reminded about. Refs #3755	2026-06-10 15:16:23 -07:00
Jordan Harband	ed4dbdfdd5	[Fix] nvm_rc_version: clarify error when no version and no .nvmrc ... Previously the message read "No .nvmrc file found", which obscured the fact that the user also did not pass a version. The new wording names both halves of the actual problem. Refs #3755	2026-06-10 15:16:23 -07:00
Jordan Harband	a9933f77a6	[Fix] nvm exec/nvm run: warn when no version and no .nvmrc ... Currently these commands silently fall back to the active node version when neither a version argument nor an `.nvmrc` resolves, making them invisibly dependent on shell state and impossible to script predictably (see #3755). Print a stderr deprecation warning in this case (suppressed by `--silent`) and continue with the active node version, so existing callers keep working. The follow-up change will turn this into a hard error; pass `current` explicitly (e.g. `nvm exec current node ...`) to silence the warning and lock in the new behavior now. Refs #3755	2026-06-10 15:16:23 -07:00
Jordan Harband	7079a5d61c	[actions] nodejs.org PR: sync the fork before branching, and surface create-ref errors	2026-06-04 14:52:41 -07:00
Jordan Harband	306f04a90a	[actions] nodejs.org PR: fix force boolean and grab the latest tag on dispatch ... The branch-reset step sent `force` as a string via `gh api -f "force=true"`, which the Git refs API rejects ("not a boolean", HTTP 422), failing the release run. Use `-F` so it is sent as a boolean. Also resolve the version from the latest `vX.Y.Z` tag (via the tags API) rather than `releases/latest`, so a manual `workflow_dispatch` with no input works even before the GitHub release object for a freshly pushed tag is published.	2026-06-04 09:54:01 -07:00
Jordan Harband	77fca77ddd	[actions] fall back to the canonical nvmrc submodule when a fork lacks its own ... Upstream's `.gitmodules` uses a relative submodule url (`../nvmrc.git`), which resolves against the superproject's origin: on a fork without its own `nvmrc` fork that is `<owner>/nvmrc`, which 404s and fails `actions/checkout` with `submodules: true`. Keep `submodules: true` (so a fork's own `nvmrc` is used when present), but mark checkout `continue-on-error` and, only when it failed, re-point the submodule at `nvm-sh/nvmrc` and update.	2026-06-04 09:22:04 -07:00
Jordan Harband	1889911f08	v0.40.5 v0.40.5	2026-06-04 09:33:05 -07:00
Jordan Harband	70fb4ede6b	[Fix] nvm_download_artifact: reject version strings with disallowed characters ... The mirror-supplied (untrusted) version flows into download URLs, filesystem paths, and the checksum awk match. Reject any version outside the node/io.js grammar (`[0-9A-Za-z._+-]`) before it is used. A blocklist of metacharacters is used rather than a strict semver allowlist so RCs, nightlies, v8-canary, and io.js versions still install. Completes the remediation of GHSA-3c52-35h2-gfmm.	2026-06-03 13:09:07 -07:00
Jordan Harband	90bb88748b	[Fix] nvm_get_checksum: pass the tarball name to awk as data, not program text ... The awk program string-interpolated the slug (which embeds the untrusted, mirror-supplied version) into its source, so a crafted version such as `v1"==$2){system("touch${IFS}/tmp/x")}#` was executed by awk's `system()`. Pass the value via `-v tarball=...` so awk treats it as data and never as code. See GHSA-3c52-35h2-gfmm (a second injection sink fed by the same untrusted version field that `nvm_download`'s eval was; the source-install path reaches this during a normal `nvm install <version>`).	2026-06-03 13:11:26 -07:00
Jordan Harband	6d870d182c	[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands ... `nvm_download` built a curl/wget command string and ran it with `eval`. The download URLs embed the version string taken from the mirror's `index.tab`, which is untrusted. Wrapping each argument in double quotes inside the `eval` does not prevent command substitution, so a version field such as `v1$(touch /tmp/proof)` was executed by the shell. This bypassed the earlier quoting hardening in 0ce8f5a. Pass every argument as a literal argv element instead of constructing a string for `eval`, on both the curl and wget paths, so URL arguments are never re-parsed by the shell. The wget flag translation is now done per-argument with a POSIX `set --` loop rather than `sed` over the joined string. The auth header is sanitized and added once, before invoking the downloader.	2026-06-02 17:41:44 -07:00
Jordan Harband	d264b796a3	[Fix] nvm_download: send a well-formed Authorization header on the wget path ... The wget path passed `NVM_AUTH_HEADER` as the raw header line (e.g. `--header "Bearer secret-token"`), omitting the `Authorization:` header name that the curl path includes. Per the documented usage (`NVM_AUTH_HEADER="Bearer secret-token"`) the value is the credential, so wget was sending a malformed header. Prefix it with `Authorization: ` to match the curl path.	2026-06-02 17:40:50 -07:00
Jordan Harband	84079dbff3	[Tests] install_nvm_from_git: stop git background gc/maintenance racing with cleanup ... The test's `rm -rf "$NVM_DIR"` intermittently failed with `rm: cannot remove...: Directory not empty` and aborted under `set -e`. Cause: after the clone/fetch, git can spawn a detached background gc/maintenance process that keeps writing into the clone dir while `rm -rf` runs (a concurrent writer makes the final rmdir fail). It is not egress- or version-related (it reproduces with all endpoints allowed), and it is environment-timing dependent (recently became consistent on the GitHub runners). Disable git's background work for the test (gc.autoDetach / maintenance.auto) so all git operations finish synchronously, and retry the rm once as a safety net.	2026-06-03 20:12:26 -07:00
Jordan Harband	61c9ff7371	[Tests] install_nvm_from_git: fix malformed test command (missing space before ]) ... `[ "${head_ref}" != "${avoid_ref}"]` is missing the space before the closing bracket, so the shell prints `[: missing ']'` and the avoid_ref assertion never actually runs (it is inside an `if` condition, so the error was non-fatal and silently disabled the check)	2026-06-03 14:53:48 -07:00
Jordan Harband	16f6ddc3d5	[actions] set per-job permissions in the nvm install workflow ... CodeQL (actions/missing-workflow-permissions) flagged the matrix, test, and finisher jobs of nvm-install-test.yml for not declaring permissions. Every other test workflow already sets least-privilege permissions per job; add them here to match: `contents: read` for the matrix and test jobs, `contents: none` for the no-op finisher.	2026-06-03 14:09:02 -07:00
Jordan Harband	c4d9239cbb	[actions] allow DockerHub's CloudFront CDN so image pulls aren't blocked ... harden-runner runs with `egress-policy: block`, and the allow-list only included `production.cloudflare.docker.com`. DockerHub serves image blobs from either its Cloudflare or its CloudFront CDN; when a pull was routed to CloudFront (`production.cloudfront.docker.com`) the connection was dropped, causing `error pulling image configuration: ... connect: connection refused` and exit 125 in the xenial, installation_node, and fast (httpbin) suites. Allow both CDNs.	2026-06-03 13:29:38 -07:00
Jordan Harband	dd13968c1e	[Tests] reduce CI flakiness from transient Docker registry failures ... Container-based suites and the `nvm_download` httpbin check hard-fail whenever DockerHub is briefly unreachable (observed: `dial tcp ...:443: connect: connection refused` while pulling images), even though the change under test is fine. This is unrelated to any test logic. - tests-xenial / tests-installation-node: retry the `docker pull` up to 5 times before `docker run`, mirroring the existing apt-get retry - `nvm_download` test: retry the httpbin pull and skip the auth-header checks (rather than fail) when the image cannot be pulled or run, and make cleanup tolerant of a missing container.	2026-06-03 13:12:31 -07:00
Jordan Harband	53855417eb	[Fix] avoid an unbound variable ... Fixes #3820	2026-05-15 23:08:37 -07:00
Jordan Harband	1f70aea0b0	[Docs] fix --offline help line alignment	2026-05-05 17:16:31 -07:00
Teodoro P.andJordan Harband	f695512c80	[meta] Update .gitmodules with relative submodule path	2026-05-07 07:30:08 +02:00
Teodoro P.andJordan Harband	388912c6a7	Fix formatting in .gitmodules file	2026-05-06 20:57:27 +02:00
Teodoro PICCINNIandJordan Harband	4a9155979d	Submodule nvmrc update protocol from git to https	2026-05-06 20:45:50 +02:00
Elan RuusamäeandJordan Harband	083bb94f25	[Fix] Add local for sanitized_header	2026-05-03 21:16:14 +03:00
Dick MarinusandJordan Harband	790ffd2682	[Fix] fix same owner for root when install from binary ... GNU Tar has `--preserve-permissions` as a default enabled when executed as the superuser (root). This will cause the binaries to be installed using the permissions (owner and group) as defined in the tarball. The argument `--no-same-owner` prevents this and will install the binaries as the effective owner/group just like when nvm is executed as a non superuser. Updated the install from binary test from the installation_node test suite because this test is run in a docker container as root. Without --no-same-owner this test will fail beause the binaries of node v0.10.7 are owned by isaacs/admin in the tarball.	2026-05-05 15:40:32 -07:00
MoziandJordan Harband	3e4b0f05b7	[readme] do not use tilde expansion in ENV of Dockerfile ... It won't expand. my bad.	2026-04-11 00:34:20 -04:00
Андрій ШовкошитнийandJordan Harband	20d52b6419	[tests] remove double-substitution in assert_ok and assert_not_ok ... Co-authored-by: Андрій Шовкошитний <198119344+enlightened88@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-04-23 17:16:32 +03:00