2344 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Jordan Harband	7079a5d61c	[actions] nodejs.org PR: sync the fork before branching, and surface create-ref errors	2026-06-04 14:52:41 -07:00
Jordan Harband	306f04a90a	[actions] nodejs.org PR: fix force boolean and grab the latest tag on dispatch ... The branch-reset step sent `force` as a string via `gh api -f "force=true"`, which the Git refs API rejects ("not a boolean", HTTP 422), failing the release run. Use `-F` so it is sent as a boolean. Also resolve the version from the latest `vX.Y.Z` tag (via the tags API) rather than `releases/latest`, so a manual `workflow_dispatch` with no input works even before the GitHub release object for a freshly pushed tag is published.	2026-06-04 09:54:01 -07:00
Jordan Harband	77fca77ddd	[actions] fall back to the canonical nvmrc submodule when a fork lacks its own ... Upstream's `.gitmodules` uses a relative submodule url (`../nvmrc.git`), which resolves against the superproject's origin: on a fork without its own `nvmrc` fork that is `<owner>/nvmrc`, which 404s and fails `actions/checkout` with `submodules: true`. Keep `submodules: true` (so a fork's own `nvmrc` is used when present), but mark checkout `continue-on-error` and, only when it failed, re-point the submodule at `nvm-sh/nvmrc` and update.	2026-06-04 09:22:04 -07:00
Jordan Harband	1889911f08	v0.40.5 v0.40.5	2026-06-04 09:33:05 -07:00
Jordan Harband	70fb4ede6b	[Fix] nvm_download_artifact: reject version strings with disallowed characters ... The mirror-supplied (untrusted) version flows into download URLs, filesystem paths, and the checksum awk match. Reject any version outside the node/io.js grammar (`[0-9A-Za-z._+-]`) before it is used. A blocklist of metacharacters is used rather than a strict semver allowlist so RCs, nightlies, v8-canary, and io.js versions still install. Completes the remediation of GHSA-3c52-35h2-gfmm.	2026-06-03 13:09:07 -07:00
Jordan Harband	90bb88748b	[Fix] nvm_get_checksum: pass the tarball name to awk as data, not program text ... The awk program string-interpolated the slug (which embeds the untrusted, mirror-supplied version) into its source, so a crafted version such as `v1"==$2){system("touch${IFS}/tmp/x")}#` was executed by awk's `system()`. Pass the value via `-v tarball=...` so awk treats it as data and never as code. See GHSA-3c52-35h2-gfmm (a second injection sink fed by the same untrusted version field that `nvm_download`'s eval was; the source-install path reaches this during a normal `nvm install <version>`).	2026-06-03 13:11:26 -07:00
Jordan Harband	6d870d182c	[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands ... `nvm_download` built a curl/wget command string and ran it with `eval`. The download URLs embed the version string taken from the mirror's `index.tab`, which is untrusted. Wrapping each argument in double quotes inside the `eval` does not prevent command substitution, so a version field such as `v1$(touch /tmp/proof)` was executed by the shell. This bypassed the earlier quoting hardening in 0ce8f5a. Pass every argument as a literal argv element instead of constructing a string for `eval`, on both the curl and wget paths, so URL arguments are never re-parsed by the shell. The wget flag translation is now done per-argument with a POSIX `set --` loop rather than `sed` over the joined string. The auth header is sanitized and added once, before invoking the downloader.	2026-06-02 17:41:44 -07:00
Jordan Harband	d264b796a3	[Fix] nvm_download: send a well-formed Authorization header on the wget path ... The wget path passed `NVM_AUTH_HEADER` as the raw header line (e.g. `--header "Bearer secret-token"`), omitting the `Authorization:` header name that the curl path includes. Per the documented usage (`NVM_AUTH_HEADER="Bearer secret-token"`) the value is the credential, so wget was sending a malformed header. Prefix it with `Authorization: ` to match the curl path.	2026-06-02 17:40:50 -07:00
Jordan Harband	84079dbff3	[Tests] install_nvm_from_git: stop git background gc/maintenance racing with cleanup ... The test's `rm -rf "$NVM_DIR"` intermittently failed with `rm: cannot remove...: Directory not empty` and aborted under `set -e`. Cause: after the clone/fetch, git can spawn a detached background gc/maintenance process that keeps writing into the clone dir while `rm -rf` runs (a concurrent writer makes the final rmdir fail). It is not egress- or version-related (it reproduces with all endpoints allowed), and it is environment-timing dependent (recently became consistent on the GitHub runners). Disable git's background work for the test (gc.autoDetach / maintenance.auto) so all git operations finish synchronously, and retry the rm once as a safety net.	2026-06-03 20:12:26 -07:00
Jordan Harband	61c9ff7371	[Tests] install_nvm_from_git: fix malformed test command (missing space before ]) ... `[ "${head_ref}" != "${avoid_ref}"]` is missing the space before the closing bracket, so the shell prints `[: missing ']'` and the avoid_ref assertion never actually runs (it is inside an `if` condition, so the error was non-fatal and silently disabled the check)	2026-06-03 14:53:48 -07:00
Jordan Harband	16f6ddc3d5	[actions] set per-job permissions in the nvm install workflow ... CodeQL (actions/missing-workflow-permissions) flagged the matrix, test, and finisher jobs of nvm-install-test.yml for not declaring permissions. Every other test workflow already sets least-privilege permissions per job; add them here to match: `contents: read` for the matrix and test jobs, `contents: none` for the no-op finisher.	2026-06-03 14:09:02 -07:00
Jordan Harband	c4d9239cbb	[actions] allow DockerHub's CloudFront CDN so image pulls aren't blocked ... harden-runner runs with `egress-policy: block`, and the allow-list only included `production.cloudflare.docker.com`. DockerHub serves image blobs from either its Cloudflare or its CloudFront CDN; when a pull was routed to CloudFront (`production.cloudfront.docker.com`) the connection was dropped, causing `error pulling image configuration: ... connect: connection refused` and exit 125 in the xenial, installation_node, and fast (httpbin) suites. Allow both CDNs.	2026-06-03 13:29:38 -07:00
Jordan Harband	dd13968c1e	[Tests] reduce CI flakiness from transient Docker registry failures ... Container-based suites and the `nvm_download` httpbin check hard-fail whenever DockerHub is briefly unreachable (observed: `dial tcp ...:443: connect: connection refused` while pulling images), even though the change under test is fine. This is unrelated to any test logic. - tests-xenial / tests-installation-node: retry the `docker pull` up to 5 times before `docker run`, mirroring the existing apt-get retry - `nvm_download` test: retry the httpbin pull and skip the auth-header checks (rather than fail) when the image cannot be pulled or run, and make cleanup tolerant of a missing container.	2026-06-03 13:12:31 -07:00
Jordan Harband	53855417eb	[Fix] avoid an unbound variable ... Fixes #3820	2026-05-15 23:08:37 -07:00
Jordan Harband	1f70aea0b0	[Docs] fix --offline help line alignment	2026-05-05 17:16:31 -07:00
Teodoro P.	f695512c80	[meta] Update .gitmodules with relative submodule path	2026-05-07 07:30:08 +02:00
Teodoro P.	388912c6a7	Fix formatting in .gitmodules file	2026-05-06 20:57:27 +02:00
Teodoro PICCINNI	4a9155979d	Submodule nvmrc update protocol from git to https	2026-05-06 20:45:50 +02:00
Elan Ruusamäe	083bb94f25	[Fix] Add local for sanitized_header	2026-05-03 21:16:14 +03:00
Dick Marinus	790ffd2682	[Fix] fix same owner for root when install from binary ... GNU Tar has `--preserve-permissions` as a default enabled when executed as the superuser (root). This will cause the binaries to be installed using the permissions (owner and group) as defined in the tarball. The argument `--no-same-owner` prevents this and will install the binaries as the effective owner/group just like when nvm is executed as a non superuser. Updated the install from binary test from the installation_node test suite because this test is run in a docker container as root. Without --no-same-owner this test will fail beause the binaries of node v0.10.7 are owned by isaacs/admin in the tarball.	2026-05-05 15:40:32 -07:00
Mozi	3e4b0f05b7	[readme] do not use tilde expansion in ENV of Dockerfile ... It won't expand. my bad.	2026-04-11 00:34:20 -04:00
Андрій Шовкошитний	20d52b6419	[tests] remove double-substitution in assert_ok and assert_not_ok ... Co-authored-by: Андрій Шовкошитний <198119344+enlightened88@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-04-23 17:16:32 +03:00
Jordan Harband	d200a21559	[Fix] nvm_normalize_lts: only reject uppercase for LTS names, not regular aliases ... The lowercase check was in the `*` catch-all branch of the `case` statement, rejecting any alias name with uppercase characters. This prevented creating or reading uppercase aliases like `TESTY`. The check should only apply to `lts/*` patterns, since LTS codenames are always lowercase. Fixes #3764. Bug introduced in 9fb9dec710 as part of fixing #3417.	2026-03-26 10:18:40 -07:00
Mozi	001ea8cac1	[readme] use tilde expansion instead of "$HOME" for consistency ... at least in this code block.	2026-03-05 15:06:38 -05:00
Mozi	b0f82ac1b2	[readme] use "$HOME" instead of hardcoded "/home/user" ... For now, only "test/fast/Unit tests/nvm_change_path" uses "/home/user".	2026-03-05 05:42:57 -05:00
Peter Dave Hello	b4e70cdc2a	[meta] Align and enhance AGENTS.md instructions ... References: - https://agents.md - https://github.com/agentsmd/agents.md - https://github.blog/ai-and-ml/github-copilot/how-to-write-a-great-agents-md-lessons-from-over-2500-repositories/	2026-02-04 00:04:09 +08:00
Salman Muin Kayser Chishti	e11221d0d9	[actions] upgrade vampire/setup-wsl ... Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>	2026-02-05 09:21:01 +00:00
Peter Dave Hello	59d4ea8f3e	[Docs] Clean up wording in docs and shell comments ... Adjust a few spelling, grammar, and naming inconsistencies in the docs and related shell comments without changing behavior.	2026-03-23 23:48:23 +08:00
rohan436	6a16398269	[Docs] fix CONTRIBUTING grammar	2026-03-19 09:41:50 +08:00
Hemant Mann	82e3803e93	[readme] Revise Node.js version usage examples	2026-03-14 18:08:20 +05:30
Jordan Harband	3e37cfb9c4	[Tests] fix 4 test failures ... - `nvm-exec` test: expect "Found .nvmrc" message in output, since `nvm_rc_version` now outputs it to stdout via fd 3 redirection (ef162036) - `nvm_install_binary_nosource`: fix exit code capture by running the command directly instead of inside a subshell with `echo $?` (05d78477) - `nvm_iojs_version_has_solaris_binary`: bare versions like `v3.3.1` (without `iojs-` prefix) are node versions and should be rejected. The old tests relied on the buggy comparison that let them through (53e6244a) - `nvm_get_arch_unofficial`: copy `uname` into the chroot. The old test passed only because the unconditional `NVM_ARCH=x64-musl` masked the missing binary, but the `case` fix now requires a real arch to match (39e71eab)	2026-03-24 12:44:21 -07:00
Jordan Harband	ae31eceecc	[meta] run npm run doctoc	2026-03-24 11:50:40 -07:00
Jordan Harband	25f836f81b	[Fix] install.sh: check mkdir return codes ... If directory creation fails (e.g., permissions), the script would continue and fail with confusing errors later. Fail early with a clear error message instead. Bugs introduced in 68bf93514b, 6cee20a071, and 703babe60a.	2026-03-14 14:44:24 -07:00
Jordan Harband	581317d05c	[Fix] install.sh: fix POSIX compliance, printf format strings, and profile detection ... - Use `=` instead of `==` for string comparison (POSIX compliance) - Use `printf '%b'` instead of variable as format string (prevents `%` characters in paths from being interpreted as format specifiers) - Fix `TRIED_PROFILE` to reference `PROFILE` instead of `NVM_PROFILE` which is known to be empty at that point Bugs introduced in a24ff3e605, b6f1c156da, and a461a0fffc (PR https://github.com/nvm-sh/nvm/pull/1605).	2026-03-14 14:41:11 -07:00
Jordan Harband	018958cc47	[Fix] nvm which: show alias name in infinite loop error message ... `${2}` was empty because positional parameters had been consumed by `shift` in the argument parsing loop. Use `${provided_version}` which holds the resolved alias name. Bug introduced in 1c00753fd9.	2026-03-14 14:37:57 -07:00
Jordan Harband	33fda56d2a	[Fix] nvm uninstall: fix alias cleanup glob expansion ... The `*` glob was inside double quotes, preventing shell expansion. `nvm_grep -l` received a literal `*` filename instead of the list of alias files, so aliases pointing to uninstalled versions were never cleaned up. Bug introduced in 7807a9f09e.	2026-03-14 14:34:06 -07:00
Jordan Harband	32863e1052	[Fix] nvm debug: use default empty values for potentially unset variables ... These variables may be unset, which would cause errors in shells with `set -u` (nounset) enabled. Bugs introduced in b805de80cb and 49e446dac1.	2026-03-14 14:33:35 -07:00
Jordan Harband	53e6244aa6	[Fix] nvm_iojs_version_has_solaris_binary: fix comparison to detect non-iojs versions ... Missing `_` prefix on the right side of the comparison meant the guard clause that rejects non-iojs versions almost never matched, allowing non-iojs versions to fall through. Bug introduced in 2d692d9d78 / #854.	2026-03-14 14:30:54 -07:00
Jordan Harband	bda39c7c04	[Fix] nvm_download_artifact: fix error propagation from subshells ... `return` inside `(...)` subshells only exits the subshell, not the calling function. Errors in mkdir, download, and checksum verification were silently ignored. Use `{ ...; }` brace groups instead. Bug introduced in ba3ad8e460.	2026-03-14 14:30:31 -07:00
Jordan Harband	05d784772c	[Fix] nvm_install_binary: return failure when binary download fails with -b ... When `nosource=1` (the `-b` flag) and binary download fails, the function returned 0 (success) instead of a non-zero exit code, masking the installation failure. Bug introduced in 4fdef427e4 / #2439.	2026-03-14 14:29:56 -07:00
Jordan Harband	39e71eab49	[Fix] nvm_get_arch: only apply musl suffix on x64 Alpine ... Alpine detection unconditionally set `x64-musl` regardless of actual architecture, which would be incorrect on ARM-based Alpine containers. Bug introduced in ef7fc2f2c0 / #3212. Fixes #3616.	2026-03-14 12:53:14 -07:00
Jordan Harband	a5de7236d6	[Fix] nvm_get_arch: add command prefix to uname call ... Other `uname` calls in the file use `command uname` to bypass any user aliases or functions. This one was missing it. Bug introduced in 779a34e6a9 / #2469.	2026-03-14 10:16:48 -07:00
Jordan Harband	d2fca5f0ec	[Fix] nvm_resolve_local_alias: avoid using variable as printf format string ... Using a variable as the format string means `%` characters in alias names would be interpreted as format specifiers. Use `%b` format with the variable as an argument to safely interpret `\n` escapes. Bug introduced in 9b91734f0b.	2026-03-14 10:16:25 -07:00
Jordan Harband	3c48015986	[Fix] nvm_get_mirror: fix awk URL validation to actually reject invalid URLs ... The awk expression `$0 ~ "regex"` as a bare statement in the action block evaluates the match but doesn't affect the exit code. awk always prints the line and exits 0, making the validation a no-op. Bug introduced in b1fa143dd8.	2026-03-14 09:40:43 -07:00
Jordan Harband	a937cb595e	[Fix] nvm_ls_remote_combined: propagate iojs remote listing failures ... `return $A || $B` only evaluates the first argument, since `return` always succeeds. The io.js exit code was never checked, silently swallowing remote listing failures. Bug introduced in ea12784629 / #616.	2026-03-14 09:39:20 -07:00
Jordan Harband	6f428a10bb	[Fix] nvm install: fix nvm err typo to nvm_err for -s/-b conflict ... The error message for using `-s` and `-b` together was calling `nvm err` (invoking nvm with subcommand "err") instead of the `nvm_err` helper function, causing the error message to never be displayed and instead showing the help text with exit code 127. Bug introduced in 4fdef427e4 / #2439	2026-03-14 09:38:04 -07:00
Jordan Harband	ef1620361a	[Refactor] nvm_rc_version: use fd 3 instead of exported env var for multiple return	2026-03-12 15:32:17 -04:00
Jordan Harband	a27a8b7da8	[Fix] nvm alias: fix colors not showing by default ... Colors were lost because `nvm_has_colors` checks `[ -t 1 ]`, which is false inside the `(...) | sort` pipeline in `nvm_list_aliases`. Evaluate `nvm_has_colors` before the pipe and propagate via `NVM_HAS_COLORS`, matching the approach used by `nvm_print_versions`. Bug introduced in 35212c1346.	2026-03-13 16:13:41 -04:00
Jordan Harband	59bd32be6b	[New] nvm install --offline: install from cache without network access ... Add `--offline` flag to `nvm install` that resolves versions using only locally installed versions and cached downloads. No network calls are made. New helper functions `nvm_ls_cached` and `nvm_offline_version` scan `$NVM_DIR/.cache/bin/` for previously downloaded tarballs. In offline mode, `nvm_download_artifact` returns cached tarballs directly without checksum verification or download attempts. The curl/wget requirement is skipped when `--offline` is set. Supports `--lts` via locally stored LTS alias files.	2026-03-13 16:13:19 -04:00
Jordan Harband	14d01c6877	[Tests] add try/try_err helpers; convert tests to use them ... Add `try` and `try_err` helper functions to `test/common.sh` that capture stdout/stderr and exit code from a single invocation, eliminating duplicate command executions in tests. Convert all existing tests that used the `OUTPUT`/`EXIT_CODE` double-invocation pattern to use the new helpers. Also fixes a pre-existing bug in the `nvm_die_on_prefix` test where ASCII apostrophes were used instead of U+2019 to match nvm.sh output.	2026-03-13 15:26:07 -04:00