1100 Commits

Author	SHA1	Message	Date
Jordan Harband	6d870d182c	[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands ... `nvm_download` built a curl/wget command string and ran it with `eval`. The download URLs embed the version string taken from the mirror's `index.tab`, which is untrusted. Wrapping each argument in double quotes inside the `eval` does not prevent command substitution, so a version field such as `v1$(touch /tmp/proof)` was executed by the shell. This bypassed the earlier quoting hardening in 0ce8f5a. Pass every argument as a literal argv element instead of constructing a string for `eval`, on both the curl and wget paths, so URL arguments are never re-parsed by the shell. The wget flag translation is now done per-argument with a POSIX `set --` loop rather than `sed` over the joined string. The auth header is sanitized and added once, before invoking the downloader.	2026-06-02 17:41:44 -07:00
Jordan Harband	d264b796a3	[Fix] nvm_download: send a well-formed Authorization header on the wget path ... The wget path passed `NVM_AUTH_HEADER` as the raw header line (e.g. `--header "Bearer secret-token"`), omitting the `Authorization:` header name that the curl path includes. Per the documented usage (`NVM_AUTH_HEADER="Bearer secret-token"`) the value is the credential, so wget was sending a malformed header. Prefix it with `Authorization: ` to match the curl path.	2026-06-02 17:40:50 -07:00
Jordan Harband	53855417eb	[Fix] avoid an unbound variable ... Fixes #3820	2026-05-15 23:08:37 -07:00
Jordan Harband	1f70aea0b0	[Docs] fix --offline help line alignment	2026-05-05 17:16:31 -07:00
Elan Ruusamäe	083bb94f25	[Fix] Add local for sanitized_header	2026-05-03 21:16:14 +03:00
Dick Marinus	790ffd2682	[Fix] fix same owner for root when install from binary ... GNU Tar has `--preserve-permissions` as a default enabled when executed as the superuser (root). This will cause the binaries to be installed using the permissions (owner and group) as defined in the tarball. The argument `--no-same-owner` prevents this and will install the binaries as the effective owner/group just like when nvm is executed as a non superuser. Updated the install from binary test from the installation_node test suite because this test is run in a docker container as root. Without --no-same-owner this test will fail beause the binaries of node v0.10.7 are owned by isaacs/admin in the tarball.	2026-05-05 15:40:32 -07:00
Jordan Harband	d200a21559	[Fix] nvm_normalize_lts: only reject uppercase for LTS names, not regular aliases ... The lowercase check was in the `*` catch-all branch of the `case` statement, rejecting any alias name with uppercase characters. This prevented creating or reading uppercase aliases like `TESTY`. The check should only apply to `lts/*` patterns, since LTS codenames are always lowercase. Fixes #3764. Bug introduced in 9fb9dec710 as part of fixing #3417.	2026-03-26 10:18:40 -07:00
Peter Dave Hello	59d4ea8f3e	[Docs] Clean up wording in docs and shell comments ... Adjust a few spelling, grammar, and naming inconsistencies in the docs and related shell comments without changing behavior.	2026-03-23 23:48:23 +08:00
Jordan Harband	018958cc47	[Fix] nvm which: show alias name in infinite loop error message ... `${2}` was empty because positional parameters had been consumed by `shift` in the argument parsing loop. Use `${provided_version}` which holds the resolved alias name. Bug introduced in 1c00753fd9.	2026-03-14 14:37:57 -07:00
Jordan Harband	33fda56d2a	[Fix] nvm uninstall: fix alias cleanup glob expansion ... The `*` glob was inside double quotes, preventing shell expansion. `nvm_grep -l` received a literal `*` filename instead of the list of alias files, so aliases pointing to uninstalled versions were never cleaned up. Bug introduced in 7807a9f09e.	2026-03-14 14:34:06 -07:00
Jordan Harband	32863e1052	[Fix] nvm debug: use default empty values for potentially unset variables ... These variables may be unset, which would cause errors in shells with `set -u` (nounset) enabled. Bugs introduced in b805de80cb and 49e446dac1.	2026-03-14 14:33:35 -07:00
Jordan Harband	53e6244aa6	[Fix] nvm_iojs_version_has_solaris_binary: fix comparison to detect non-iojs versions ... Missing `_` prefix on the right side of the comparison meant the guard clause that rejects non-iojs versions almost never matched, allowing non-iojs versions to fall through. Bug introduced in 2d692d9d78 / #854.	2026-03-14 14:30:54 -07:00
Jordan Harband	bda39c7c04	[Fix] nvm_download_artifact: fix error propagation from subshells ... `return` inside `(...)` subshells only exits the subshell, not the calling function. Errors in mkdir, download, and checksum verification were silently ignored. Use `{ ...; }` brace groups instead. Bug introduced in ba3ad8e460.	2026-03-14 14:30:31 -07:00
Jordan Harband	05d784772c	[Fix] nvm_install_binary: return failure when binary download fails with -b ... When `nosource=1` (the `-b` flag) and binary download fails, the function returned 0 (success) instead of a non-zero exit code, masking the installation failure. Bug introduced in 4fdef427e4 / #2439.	2026-03-14 14:29:56 -07:00
Jordan Harband	39e71eab49	[Fix] nvm_get_arch: only apply musl suffix on x64 Alpine ... Alpine detection unconditionally set `x64-musl` regardless of actual architecture, which would be incorrect on ARM-based Alpine containers. Bug introduced in ef7fc2f2c0 / #3212. Fixes #3616.	2026-03-14 12:53:14 -07:00
Jordan Harband	a5de7236d6	[Fix] nvm_get_arch: add command prefix to uname call ... Other `uname` calls in the file use `command uname` to bypass any user aliases or functions. This one was missing it. Bug introduced in 779a34e6a9 / #2469.	2026-03-14 10:16:48 -07:00
Jordan Harband	d2fca5f0ec	[Fix] nvm_resolve_local_alias: avoid using variable as printf format string ... Using a variable as the format string means `%` characters in alias names would be interpreted as format specifiers. Use `%b` format with the variable as an argument to safely interpret `\n` escapes. Bug introduced in 9b91734f0b.	2026-03-14 10:16:25 -07:00
Jordan Harband	3c48015986	[Fix] nvm_get_mirror: fix awk URL validation to actually reject invalid URLs ... The awk expression `$0 ~ "regex"` as a bare statement in the action block evaluates the match but doesn't affect the exit code. awk always prints the line and exits 0, making the validation a no-op. Bug introduced in b1fa143dd8.	2026-03-14 09:40:43 -07:00
Jordan Harband	a937cb595e	[Fix] nvm_ls_remote_combined: propagate iojs remote listing failures ... `return $A || $B` only evaluates the first argument, since `return` always succeeds. The io.js exit code was never checked, silently swallowing remote listing failures. Bug introduced in ea12784629 / #616.	2026-03-14 09:39:20 -07:00
Jordan Harband	6f428a10bb	[Fix] nvm install: fix nvm err typo to nvm_err for -s/-b conflict ... The error message for using `-s` and `-b` together was calling `nvm err` (invoking nvm with subcommand "err") instead of the `nvm_err` helper function, causing the error message to never be displayed and instead showing the help text with exit code 127. Bug introduced in 4fdef427e4 / #2439	2026-03-14 09:38:04 -07:00
Jordan Harband	ef1620361a	[Refactor] nvm_rc_version: use fd 3 instead of exported env var for multiple return	2026-03-12 15:32:17 -04:00
Jordan Harband	a27a8b7da8	[Fix] nvm alias: fix colors not showing by default ... Colors were lost because `nvm_has_colors` checks `[ -t 1 ]`, which is false inside the `(...) | sort` pipeline in `nvm_list_aliases`. Evaluate `nvm_has_colors` before the pipe and propagate via `NVM_HAS_COLORS`, matching the approach used by `nvm_print_versions`. Bug introduced in 35212c1346.	2026-03-13 16:13:41 -04:00
Jordan Harband	59bd32be6b	[New] nvm install --offline: install from cache without network access ... Add `--offline` flag to `nvm install` that resolves versions using only locally installed versions and cached downloads. No network calls are made. New helper functions `nvm_ls_cached` and `nvm_offline_version` scan `$NVM_DIR/.cache/bin/` for previously downloaded tarballs. In offline mode, `nvm_download_artifact` returns cached tarballs directly without checksum verification or download attempts. The curl/wget requirement is skipped when `--offline` is set. Supports `--lts` via locally stored LTS alias files.	2026-03-13 16:13:19 -04:00
Jordan Harband	62387b8f92	v0.40.4	2026-01-29 14:12:03 -08:00
Sy2n0	44e2590cdf	[Fix] sanitize NVM_AUTH_HEADER in wget path	2026-01-09 11:30:14 +09:00
Peter Dave Hello	5533699ec5	Improve uninstall error message for missing versions ... Include the requested version in the uninstall error output when the target is not installed. Add a fast test to lock the behavior. Close #3767	2026-01-30 00:04:01 +08:00
Peter Dave Hello	29a652f90f	[patch] show system Node.js version in nvm ls ... Normalize `nvm_version` output when `nvm_ls` returns "system vX" so alias and .nvmrc resolutions treat system correctly. Add fast tests for system alias behavior in `nvm ls`, `nvm use`, and `nvm which`.	2026-01-25 18:19:50 +08:00
Jordan Harband	35212c1346	[Fix] nvm_has_colors: also check if stdout is a terminal	2026-01-27 10:31:07 -08:00
Jordan Harband	9ba422e561	[Fix] nvm_strip_path: avoid gawk-specific RT variable for mawk compatibility	2026-01-26 22:33:58 -08:00
Jordan Harband	38ffc713a7	[Fix] nvm_get_default_packages: use portable awk patterns ... Replace POSIX `[[:space:]]` character class with `[ \t]` for mawk compatibility on Ubuntu 16.04.	2026-01-26 16:59:11 -08:00
Jordan Harband	aa1d829102	[Fix] nvm_install_source: explicitly set SHELL=/bin/sh for make ... Old Node.js versions have Makefiles with unquoted glob patterns like `rm -f *.o` that fail in zsh's strict glob mode. By passing SHELL=/bin/sh to make, we ensure POSIX-compliant shell behavior regardless of what shell nvm is running in.	2026-01-26 15:07:01 -08:00
Rahul Beniwal	81f13638d7	[Fix] Reject bare LTS codenames in nvm install ... Previously, `nvm install Argon` would succeed by matching the LTS name in the version description (e.g., "v4.9.1 (Latest LTS: Argon)"), but `nvm uninstall Argon` would fail because "Argon" is not a valid alias or not a valid version. Changes: - Added pattern matching check in nvm_remote_version (nvm.sh:785-791) - Skips check for implicit aliases (node, stable, etc.) to preserve existing functionality - Added unit tests to verify LTS names are rejected while version numbers still work After this fix: - `nvm install Argon` → fails (use `nvm install lts/argon` instead) - `nvm install 4` → still works - `nvm install node` → still works - `nvm install lts/argon` → still works This makes install and uninstall behavior consistent. Fixes #3474.	2025-11-24 21:57:39 +05:30
Jordan Harband	26066c10f4	[Fix] prevent sed errors when pattern contains # ... When `.nvmrc` or alias files contained comments (lines with `#`), the `#` character could end up in the search pattern passed to sed, causing "unterminated regular expression" errors because `#` is used as the sed address delimiter. This commit fixes the issue in two places: 1. `nvm_alias`: Strip comments from alias file contents before returning them, and trim trailing whitespace 2. `nvm_ls`: Escape `#` characters in SEARCH_PATTERN so they're treated as literal characters in the sed address Fixes #3761	2026-01-19 22:58:43 -08:00
Jordan Harband	18e638e42b	[Fix] sh lacks -O; thanks shellcheck	2025-09-05 13:19:27 -07:00
Jordan Harband	977563e97d	v0.40.3	2025-04-23 16:34:31 -07:00
Toni Viemerö	99352a64d2	[Fix] nvm_install_latest_npm: fix node version detection	2025-04-09 08:16:05 +03:00
Jordan Harband	ffec9fec72	v0.40.2 ... New Stuff - `install.sh`: add `$ZDOTDIR` to zsh search (#3458) Fixes - `reinstall-packages`: do not reinstall corepack (#3544) - avoid bash-specific syntax (#3499) - `install-latest-npm`: npm v11 is out - `nvm_install_latest_npm`: avoid unbound variable (#3447) - give a more helpful message when `lts` alias is mistakenly used (#3441) - `nvm ls`, `nvm alias`, `nvm install`: error when an LTS name is invalid - `nvm_normalize_lts`: error when an LTS name is not lowercase (#3417) Documentation - [readme] update link - [readme] fix `--no-use` example (#3479) - [readme] update copyright notice (#3507) - [readme] note zsh-nvm's AUTO_USE option (#2670) - [readme] add note about reloading zshrc after editing (#3052) - [readme] Update shell profile file install notes (#2241) - [readme] add docker tips (#2318) - [readme] remove `avn` from readme (#3469) - [readme] fnm -> nvm.fish (#2541) Refactors - prefer `case` over if/else chains - combine `sed -e` invocations/arguments Tests - `nvm exec`/`nvm run`: add `--silent` tests (#1259) - [actions] release test needs git tags - migrate `installation_iojs` test suite to GitHub Actions (#3476) - Migrate slow test suite from Travis CI (#3470) - temporarily skip this failing travis test to unblock progress - [actions] TOC: use latest LTS node - `install.sh`: clean up `nvm_detect_profile` tests - `nvm_detect_profile`: refactor (#3467) - run urchin tests on pull requests (#3466) - update mocks - ensure that unit tests use only mocked LTS names - [actions] use `node/install` instead of `node/run` Meta - disable blank issues - update issue template - add DCO (#3456) - Rename .github/ISSUE_TEMPLATE.md to .github/ISSUE_TEMPLATE/ISSUE_TEMPLATE.md (#3454)	2025-03-11 13:39:40 -07:00
Jordan Harband	df9ac58f8b	[Fix] reinstall-packages: do not reinstall corepack ... Fixes #3544	2025-03-11 13:16:58 -07:00
Jordan Harband	759f70f196	[Refactor] prefer case over if/else chains	2025-02-04 22:45:35 -08:00
Jordan Harband	06a9179309	[Refactor] combine sed -e invocations/arguments	2025-02-04 15:55:10 -08:00
Jordan Harband	19f452ba0f	[Fix] avoid bash-specific syntax ... Fixes #3499	2024-12-19 22:21:09 -08:00
Jordan Harband	b9b0ea8020	[Fix] install-latest-npm: npm v11 is out	2024-12-16 10:03:18 -08:00
Jordan Harband	6b70c40f15	[Fix] nvm_install_latest_npm: avoid unbound variable ... Fixes #3447	2024-10-22 22:02:01 -07:00
Reetik Rajan	5dc31ac51b	[patch] give a more helpful message when lts alias is mistakenly used	2024-10-05 09:21:42 +05:30
Jordan Harband	da2720a429	[Fix] nvm ls, nvm alias, nvm install: error when an LTS name is invalid	2024-09-04 13:55:11 -07:00
Jordan Harband	9fb9dec710	[Fix] nvm_normalize_lts: error when an LTS name is not lowercase ... Fixes #3417	2024-09-04 13:54:41 -07:00
Jordan Harband	179d45050b	v0.40.1	2024-08-27 13:44:15 -07:00
Jordan Harband	ff7634577b	[Tests] fix broken tests exposed by 863bd63 ... Leaves 2 non-executable, + some TODOs	2024-08-27 12:46:40 -07:00
Jordan Harband	0ce8f5a52f	[Fix] nvm_download: ensure all args are quoted ... Fixes #3411.	2024-08-20 22:33:38 -07:00
Jordan Harband	df70535248	[Fix] nvm_auto: Fix bug introduced in c31a867	2024-08-21 10:54:19 -07:00