578 Commits

Include renames

Author	SHA1	Message	Date
Jordan Harband	aeace4606f	[Fix] nvm_hash_reset: only run hash -r where the shell supports it ... Under bash's `set +h`, `hash -r` errors with "hash: hashing disabled", which is then printed on every `nvm use`, including the one at shell startup. Guarding on `$-` alone would be wrong: `zsh` never puts `h` in `$-` - there `h` is `HIST_IGNORE_DUPS` - and `dash` has no `h` flag at all, so it would skip the call in 3 of the 4 shells the fast suite runs. Gate on the shell instead, and skip only where the call fails: bash under `set +h`, and `ksh93`, whose `hash` takes no `-r` and whose usage error aborts `nvm use` before it can export `NVM_BIN`. `ksh` is detected by probing rather than by version, so `mksh` and `pdksh`, which do accept `-r`, keep getting the call. The `${-#*h}` test is from #3910. Refs #2065 Refs #3247	2026-09-04 09:16:10 -07:00
debadityaandJordan Harband	80e700ec21	[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file ... `#` is a repetition operator under `extendedglob`, so `${VAR%%#*}` is an invalid pattern: zsh aborts the expansion and `nvm_alias` silently prints nothing, leaving the `default` alias unresolved when nvm.sh is sourced. The read loop moves into `nvm_print_alias_file` so that `local_options` scopes the option change to that section alone, rather than to everything `nvm_alias` does, and restores whatever the caller had set. Fixes #3885 Co-authored-by: debaditya <debaditya2005hait@gmail.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-03 20:54:28 -07:00
Jordan Harband	25b378323c	[Fix] zsh: restore nomatch and markdirs rather than clobbering them ... `unsetopt local_options nomatch` unsets both named options, so LOCAL_OPTIONS is off by the time the function returns and the `nomatch` change escapes into the caller's shell: one `nvm ls` or `nvm alias` leaves NO_MATCH off for the rest of the session, after which an unmatched glob is silently passed through as a literal. `setopt local_options nonomatch`, already used in `nvm_check_file_permissions`, restores on return. The `markdirs` line also cancelled the snapshot taken for `shwordsplit` on the line above it; that one is latent, as `nvm_ls` is only ever called inside a command substitution.	2026-09-03 20:44:59 -07:00
CJstate	3a72926f4a	[Fix] nvm --help: render the set-colors legend in color ... Every legend line is built inside a command substitution, where `nvm_has_colors` can never succeed, because `[ -t 1 ]` sees the capture pipe rather than the terminal. The legend has therefore always printed plain, on every terminal and in every shell. Resolve color support once and pass it in, the way `nvm_print_alias_path` already accepts the same flag. A command-prefix assignment cannot carry it: POSIX expands a command's arguments before applying its assignments, so the substitutions would still see it unset, and in sh and ksh it would outlive the call and override `--no-colors` for everything after. The test needs no tty, and fails against an unfixed `nvm.sh` in sh, bash, dash, and zsh. Fixes #3896	2026-09-03 12:10:19 -07:00
Jordan Harband	38f0f2cfdf	[Tests] nvm_print_color_legend: look up the function with PATH emptied ... The presence checks were still satisfiable by this test file itself, which is an executable named `nvm_print_color_legend`. Filtering `command -v` output on a `/` was not enough: dash and zsh report a bare name, not a path, for a current-directory match reached through an empty `PATH` component, and that is indistinguishable from a function. So `nvm unload` looked as though it had left the function behind in exactly the shells CI runs as `sh`, `dash`, and `zsh`, while bash, which reports `./name`, passed. Emptying `PATH` for the lookup asks about the function alone, and is immune to whatever `PATH` happens to hold. Reproduced first, then fixed: with `PATH=":${PATH}"` the previous check fails under dash and zsh and passes under bash, matching CI exactly. The assertions now hold in sh, bash, dash, and zsh with the directory absent from `PATH`, present on it, and via an empty entry, and both dropping `nvm_print_color_legend` from `nvm unload` and renaming the function out from under the guard are still caught in all twelve combinations.	2026-09-03 15:12:34 -07:00
Jordan Harband	26fef4fe1a	[Tests] nvm_print_color_legend: check for the function, not a same-named file ... The presence checks used `command -v`, which finds executables as readily as functions, and this test file is itself an executable named `nvm_print_color_legend`. Whenever its own directory is on `PATH`, as it is under CI, `command -v` kept resolving to the file long after `nvm unload` had removed the function, so the unload assertion could never pass there and the "is it defined" guard could never fail. `command -v` prints a bare name for a function and a path for an executable, in sh, bash, dash, zsh, and ksh alike, so requiring the result to contain no slash distinguishes the two. Verified both ways round: with the test's directory on `PATH` the suite passes in all four shells, and removing `nvm_print_color_legend` from `nvm unload`'s list is still caught in all four.	2026-09-03 12:08:18 -07:00
Jordan Harband	17f12a1207	[Tests] nvm_print_color_legend: fix the fast suite on GNU userlands ... The `nvm unload` assertion failed every `fast` job on Linux while passing on macOS, and its shape made the cause impossible to read off the failure. `set -e` aborts the command substitution when `nvm unload` returns non-zero, which leaves an empty string that the assertion then reports as "unload left nvm_print_color_legend defined". Run the unload with `set +e` inside the subshell and report its exit status next to the lookup, so a failing unload can no longer be misread as a function that survived it. The accompanying `sed: couldn't flush stdout: Broken pipe` came from the `grep -q` pipelines: `grep -q` exits at its first match and hands SIGPIPE to the `sed` feeding it, which BSD sed swallows and GNU sed reports. Match whole lines with `case` against the already-captured string instead, which needs no pipe at all, and capture `nvm --help` before stripping it rather than piping it through two processes into `grep -q`. Test stderr is now empty in sh, bash, dash, and zsh.	2026-09-03 11:54:45 -07:00
Jordan Harband	ab83657ba6	[Refactor] nvm --help: extract the set-colors legend into nvm_print_color_legend	2026-09-03 10:17:16 -07:00
Jordan Harband	10a277ec47	[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding ... 3c480159 correctly made this validator actually enforce, instead of the no-op `awk '{ $0 ~ "..." }'` it had been, but its character class had never been audited against real mirror URLs: it has no `:`, so enabling enforcement silently rejected every mirror URL bearing a port. $ NVM_NODEJS_ORG_MIRROR=https://mirror.internal:8443/dist nvm_ls_remote $NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL No request is made at all, so an internal mirror on a non-default port has been unusable since v0.40.5. Allow RFC 3986 `unreserved` plus the authority and path punctuation a mirror URL legitimately needs: `:` for a port, `@` for userinfo, `[`/`]` for an IPv6 literal host, and `%` for percent-encoding. `sub-delims` and the query/fragment delimiters stay rejected: nvm appends a path to this value, so a query string could never have worked, and several of those characters are shell metacharacters.	2026-09-02 19:40:47 -07:00
Andres Mejia Sanchez	dd0f702fb1	[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68 ... `~` is a member of RFC 7235 §2.1 `token68`, and thus of RFC 6750 §2.1 `b64token`, but the allowlist stripped it, silently corrupting any opaque Bearer credential containing it: Bearer mF_9.B5f-4.1JqM~+/= -> Bearer mF_9.B5f-4.1JqM+/= `Basic` credentials were never affected, since RFC 4648 §4 base64 cannot emit `~`; `;` stays stripped, as it belongs to no auth-scheme production. Cover the charset in the unit test, and assert the credential reaches the downloader intact via the existing fake-`wget` harness, which needs no container.	2026-09-02 19:36:04 -07:00
Jordan Harband	809f3ee5ab	[New] nvm install: serialize concurrent installs of the same version ... Two `nvm install <same version>` runs could race on the version directory - one removing or replacing it while the other reads or writes it. Take a per-version advisory lock (an atomically-created directory under $NVM_DIR/.cache locks) around the binary/source install, so a second run of the same version waits for the first; installs of different versions never contend. NVM_INSTALL_LOCK_TIMEOUT (seconds, default 600) bounds the wait, after which nvm reports the lock path so a lock left by a killed install can be removed. NVM_INSTALL_LOCK_STALE (minutes, default 0 / off) opts into automatically stealing a lock older than that, for unattended or CI use.	2026-07-24 10:55:58 -07:00
Jordan Harband	9570a22bfe	[New] nvm install: add NVM_NO_SOURCE_FALLBACK to disable the source fallback ... By default a failed binary download falls back to compiling node from source, which is slow and pointless on platforms that always have prebuilt binaries. `-b` already disables the fallback per-invocation; `NVM_NO_SOURCE_FALLBACK=1` makes it the default for every `nvm install`, so CI images and dev setups need not thread `-b` through every callsite. It behaves exactly like `-b` - aborting with a non-zero exit on a failed binary download - and is mutually exclusive with `-s`, for the same reason `-b` is.	2026-07-24 10:54:17 -07:00
Jordan Harband	aee1f83f0f	[Robustness] nvm install: reject a structurally broken installed version ... `nvm_is_version_installed` only checks that `bin/node` has the execute bit, which a zero-byte binary and a dangling `npm` symlink both pass, so a partial install could be reported as a success — and a broken existing version could short-circuit `nvm install` as "already installed". Add `nvm_validate_install`, which requires a non-empty `bin/node` and an `npm` entry that resolves, and use it in two places: gate the "already installed" shortcut on it, so a broken version is reinstalled rather than reused, and re-check it after an install reports success, so a broken result fails loudly instead of being activated. It checks layout, not execution: a correctly installed binary can still fail to run on an incompatible host (e.g. a newer node on an older glibc), which is not a broken install, and a corrupt download is already rejected by the checksum check before extraction.	2026-07-24 10:51:53 -07:00
Jordan Harband	72a878447f	[Robustness] nvm_install_binary_extract: replace a broken version dir atomically ... A version directory left without a working `bin/node` - e.g. a partial or interrupted earlier install - wedged reinstallation: `nvm install` saw the version as not installed and re-extracted, but the per-entry `mv` refused to overwrite the leftover non-empty `bin/`, `lib/`, … subdirectories and left a half-updated tree behind (and, without `-b`, fell back to a from-source compile) Remove any pre-existing version directory and move the freshly extracted tree into place with a single rename, so a version is either fully installed or not present at all. The removal is safe: it runs only after the tarball has downloaded and extracted successfully into the cache. Fall back to the previous per-entry move when a single rename cannot cross filesystems.	2026-07-24 10:50:47 -07:00
Jordan Harband	b17550a0b9	[Robustness] install.sh: nvm_download: avoid eval so arguments aren't re-parsed by the shell ... `install.sh` has its own `nvm_download`, which joined `"$@"` into a single string with `nvm_echo` and rewrote the curl-style flags with `sed`, then ran the result through `eval command wget $ARGS`. Flattening argv into a string is the root cause: every argument was re-parsed by the shell, so any shell metacharacter in a legitimate value was interpreted rather than passed through. An `$NVM_DIR` containing a space silently word-split and wrote to the wrong path, an apostrophe or parentheses were a syntax error, a glob character expanded against the cwd, and an `$NVM_SOURCE` mirror URL with an `&` in its query string backgrounded `wget` and ran the remainder as a bogus command. The `sed` rewrites were also unanchored substring replacements that would mangle a URL legitimately containing `-o `, and `ARGS` was an undeclared global that `nvm_reset` never unset. Translate the flags per-argument with a POSIX `set --` loop and invoke `command wget "$@"` instead, so each argument stays a literal argv element. This is the same shape `nvm.sh`'s `nvm_download` has used since 6d870d18, and it stops the two implementations from diverging. Unlike `nvm.sh`, no mirror-supplied data reaches this function: its arguments come only from `$NVM_SOURCE`, `$NVM_INSTALL_GITHUB_REPO`, `$NVM_INSTALL_VERSION`, `$NVM_DIR`, `$XDG_CONFIG_HOME`, and `$HOME`, and `install.sh`'s `nvm_latest_version` is a hardcoded string rather than `nvm.sh`'s `nvm_get_latest`. This is therefore a robustness fix and not a security one, since the only party who can influence these arguments is the one already running the installer.	2026-07-15 15:55:21 -07:00
Jordan Harband	52047edfb1	[Tests] install_nvm_from_git: don't fail when master is at the latest release tag ... The avoid_ref check read HEAD's tags via `git for-each-ref` with no --git-dir, so it inspected the caller's checkout instead of the installed clone. Whether it passed then depended on which ref triggered the workflow (the same commit passed when built as the v0.40.6 tag but failed when built as master, since only the former had the tag present), not on the install result. Query the installed clone and compare commits, so a HEAD that is legitimately the latest release commit (eg master right after a release) is exempted deterministically.	2026-07-15 15:02:22 -07:00
Jordan Harband	9275c5badd	[Robustness] reject unsafe LTS alias names from a mirror's index.tab ... A mirror-supplied LTS codename (field 10 of index.tab) was used verbatim as an alias filename, so a hostile codename such as `../../../.bashrc` could make nvm_make_alias write outside $NVM_DIR/alias - with the default layout, into shell startup files. Constrain remote codenames to safe filename characters at ingestion in nvm_ls_remote_index_tab, and reject any `..` path component in nvm_make_alias as a backstop for every caller.	2026-07-15 13:46:52 -07:00
Jordan Harband	438009f54e	[Tests] make the fast suite pass on Alpine ... `nvm_get_arch`: skip the smartos arm64/armv8l cases, which have no uname mock and fall through to the real host (adding a musl suffix on Alpine). `nvm_get_arch_unofficial`: skip the glibc chroot (fixed /lib64 loader, sudo); the musl mapping is already covered by the `nvm_get_arch alpine` test. `nvm_install_no_progress_bar`: skip below the musl floor, since v0.12.18 has no musl binary and hardcodes the glibc tarball URL.	2026-07-14 23:17:01 -07:00
Jesse ZhuandJordan Harband	ce157c1171	[Fix] support arm64-musl on Alpine Linux ... Node.js unofficial-builds publishes linux-arm64-musl binaries since v20.20.1 / v22.21.1 / v24+. Map NVM_ARCH=arm64 to arm64-musl on Alpine so `nvm install` resolves to the correct tarball instead of the glibc-linked arm64 build that won't run against musl. [Tests] `nvm_get_arch`: expect arm64-musl on Alpine Co-authored-by: Jesse Zhu <jesse@itjesse.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-05-23 01:35:12 +09:00
Jordan Harband	c7d5d7748b	[Tests] run every remaining test file: exec bits, fixes; add check-exec to CI ... urchin only executes test files that have the executable bit, silently skipping the rest, and `npm run test:check-exec` would catch non-executable ones, but no workflow ran it - so several test files have never actually run. Make all of them executable, and fix the ones that were broken: - the io.js source-install tests, skipped since 2016: io.js requires python 2 and gcc <= 5, so they now skip on toolchains that can not compile it, and a new gcc:4.9-container CI job runs them unmodified - resolving, downloading, checksumming, and compiling io.js for real. New `fake source` variants exercise nvm's source pipeline everywhere - cache lookup, offline resolution, extraction, configure, make, make install, activation - via a tiny fake source tree seeded into the download cache and installed with `--offline`. Also strengthen the `nvm run | grep` assertions with `--silent`, since the version banner used to satisfy the grep even when the built binary could not run, and give the final assertions the `die` they always meant to call. - `nvm uninstall ... incorrect file permissions fails nicely`, parked in 2025 as failing: `sudo npm` resets PATH, so node 5's npm crashed under the system node. The permissions check only trips on files that are neither writable nor self-owned, and that precondition only needs `sudo touch` - not npm, jspm, or the network - so use that, against a fake installed version, and skip only where passwordless sudo does not exist. - `nvm install --offline`: `nvm ls | tail -1` always grabbed an alias line, never a version; use `nvm_ls` and skip its trailing `system <version>` line. - `nvm exec ... help should not parse`: in a BRE, `[options]` is a bracket expression, so the grep could never match node's literal `Usage: node [options]` output. - `nvm use ... nvmrc containing not installed version`: current output once again matches its expectations verbatim; no changes needed. Rewrite `test:check-exec` in POSIX sh - npm runs scripts with /bin/sh, which is dash on Ubuntu, where the previous `[[`/`$'\n'` bashisms would break; match by extension, so that filenames containing dots can not dodge the check; and disable git's `core.quotePath` mangling of the non-ASCII test filenames. Then wire it into the lint workflow.	2026-07-09 22:40:07 -07:00
Jordan Harband	4e48294bd6	[Fix] nvm_ls_cached: include source-cached and io.js artifacts ... `--offline` version resolution could only see cached node binaries: `nvm_ls_cached` listed `.cache/bin` with a `node-` prefix filter, so cached source tarballs, and everything io.js, could never resolve offline. List both cache kinds, for both flavors, and update the pinned test expectations to match.	2026-07-09 22:35:15 -07:00
Jordan Harband	1a39786c8a	[Tests] nvm_offline_version: make it executable; pin nvm_ls_cached cache visibility ... The test was born without its executable bit, and urchin silently skips non-executable files, so it has never run. Also pin what `nvm_ls_cached` can currently see: only bin-cached node artifacts - bin-cached io.js, and src-cached anything, are invisible to it, and thus to `--offline` version resolution.	2026-07-09 22:35:15 -07:00
Mathew Dodgson	3a8b51c46c	[Fix] auth header: Add all valid base64 chars to sanitize function	2026-05-25 11:14:39 +10:00
Jordan Harband	ebada63259	[Tests] aliases: cover the regex-metachar cycle fix; clean up fixtures in teardown ... The cycle scenarios all pass with the old grep-based detection too; the bug the `case`-based detection actually fixes is resolved names interpolated into the grep pattern as regexes, where resolving axb -> a.b falsely reported ∞ because the pattern `a.b` matches the seen name `axb`. Pin both directions: the fixed false positive, and a genuine cycle through a metachar name. Also correct the space-name scenario comment (the old anchored grep passed that scenario; only token-delimited seen-storage would not), and register every new fixture name in the suite teardown, so a mid-test failure can not leak aliases into later tests.	2026-07-09 15:58:41 -07:00
Jake Lodwick	304a22ad59	[Refactor] nvm_alias: use [[:space:]] instead of literal tab ... [Tests] `nvm_alias`: add edge-case tests for hostile file content	2026-02-18 14:29:52 -07:00
Jake Lodwick	d22bf7f538	[Refactor] nvm_alias, nvm_resolve_alias: use builtins ... [Tests] `nvm_alias`, `nvm_resolve_alias`: add edge-case tests nvm_alias() used a sed/awk pipeline to strip comments and blank lines from alias files that almost always contain a single word. A while-read loop with parameter expansion does the same filtering more directly. nvm_resolve_alias() piped nvm_alias through head and tail to extract one line, and used printf/grep for cycle detection. Parameter expansion and a case statement replace both without the extra plumbing. All replacements are POSIX (read -r, case, IFS=, parameter expansion). As a side effect, this also removes 4 external process invocations during shell init. [Fix] `nvm_resolve_alias`: detect cycles via newline-anchored `case` The original commit referenced above changed SEEN_ALIASES from `\n`-delimited storage (interpreted by `printf '%b' | nvm_grep -e "^${name}$"`) to space- delimited but left the line-anchored grep in place — without newlines in the haystack the anchored pattern can never match, so cycles never break. Switch to literal-newline storage and a `case` pattern anchored on those newlines. Newline anchoring also handles alias names containing spaces, which token-based patterns false-positive on (e.g. lookup of `bar` matches substring " bar " inside " foo bar midway " when the chain visits the multi-token alias `foo bar`). New test file covers self-loop, multi-hop loop, cycle through a space-bearing alias name, and a non-cycle through a space-bearing alias name. Existing `test/fast/Aliases/circular/` fixtures continue to pass.	2026-02-17 13:44:31 -07:00
Jordan Harband	dd61ae4bc8	[Robustness] nvm_alias: explicitly succeed when the alias file is unreadable ... The sed/awk pipeline exits with awk's status, so an existing-but-unreadable alias file produces empty output with status 0 - but only by accident, alongside sed's read error on stderr. Make that contract explicit: a nonzero status here would flip `nvm_ensure_default_set` from "default is already set" to recreating it, silently overwriting a write-only default alias.	2026-07-09 15:43:56 -07:00
Jordan Harband	21d33ef04a	[Tests] nvm_ls handles hash in pattern: fix cleanup, isolate NVM_DIR, cover the sed path ... - `cleanup` unset TEST_DIR before `rm -rf "${TEST_DIR-}"`, so the temp dir (with an executable fake `node`) was never removed, and urchin executes any executable file it finds under the test dir on the next local run. - the preexisting `foo#bar` assertions ran against the ambient NVM_DIR; now that `#` patterns comment-strip to `foo`, a real local alias named `foo` would resolve and break them, so all assertions now run against an isolated NVM_DIR. - the multiline content used a full x.y.z version, which takes nvm_ls's explicit-version fast path and never reaches the find/sed pipeline where the newline actually broke sed; a partial version exercises that path, and matching on "unterminated" covers both the BSD and GNU sed error wordings.	2026-07-08 23:14:23 -07:00
jinhyuk9714	82315e2b18	[Fix] Parse commented nvmrc content in nvm_ls ... Fixes #3761 Signed-off-by: jinhyuk9714 <jinhyuk9714@gmail.com>	2026-06-09 00:21:55 +09:00
Yinan Qin	ab77712867	[New] install: add support for loongarch64 architecture	2025-10-25 19:19:05 +08:00
ryenus	0c1243a7ea	[Fix] bypass aliased curl ... Closes #2932	2023-01-10 15:32:47 +08:00
Jordan Harband	9142a92cdc	[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable ... `nvm_has` matches shell functions and aliases, but downloads now run via `command`, which skips them - a `curl` shell function with no curl binary on the PATH would select the curl path and fail with exit 127, instead of falling back to an available wget executable. The new `nvm_has_executable` helper resolves names the same way `command` does, so downloader selection and execution agree.	2026-07-08 13:03:16 -07:00
Jordan Harband	04fef13bdc	[Fix] use command to bypass curl/wget shell functions and aliases ... zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time, and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads. Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`; the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit. The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead, via a shared `make_fake_curl` helper in `test/common.sh`, and a new test asserts the bypass. Refs #2923	2026-07-08 13:02:41 -07:00
Rahul Beniwal	cb0e0ba8ed	[Fix] install: use darwin-x64 for all binary on mac for node < v16	2025-11-16 14:48:10 +05:30
Jordan Harband	e2e612e722	[Tests] installation_node: only match top-level global packages	2026-07-02 15:49:01 -05:00
Jordan Harband	041a57747a	[Tests] installation_node: use a published is-nan version ... `is-nan@1.0.0` was published on 2014-07-05 and unpublished minutes later (the registry's `time` map still lists it, but `versions` jumps from `0.0.0` to `1.0.1`), so `npm install -g is-nan@1.0.0` fails with `ETARGET`, and the regression test added in ce157343 fails deterministically in every shell. See https://github.com/nvm-sh/nvm/actions/runs/28407118533	2026-07-02 14:35:57 -05:00
Jordan Harband	ce15734300	[Fix] nvm install: migrate packages/set alias when target is already installed ... When `nvm install <target>` found that `<target>` was already installed, the post-`nvm use` steps (`--reinstall-packages-from`, default packages, and `--alias`/`--default`) were gated on `[ $EXIT_CODE -ne 0 ]`. Since that branch is only entered when `nvm use` succeeded (EXIT_CODE == 0), those conditions were always false, so the steps were silently skipped. The fresh-install branch correctly uses `-eq 0`; mirror that here so `--reinstall-packages-from` actually migrates global packages (and the alias/default get set) when the target version already exists. Includes a regression test covering the already-installed path. Fixes #3858	2026-06-29 16:39:19 -05:00
Jordan Harband	a6ec739430	[Docs] document current and clarify .nvmrc fallback in help/README ... - Help text for `nvm install`/`use`/`exec`/`run`/`which` now ends with "Uses .nvmrc if version is omitted; otherwise errors." so it's clear that omitting the version is not a free fallback. - Help signatures for `use`/`exec`/`run` now show `[current | <version>]` to mirror `nvm which` and document that `current` is accepted. - `nvm current` description now spells out that it resolves via `$PATH` and is not affected by `.nvmrc`. - README: add `current` to the list of special aliases, with the same caveat. The `.nvmrc` section now states that `nvm use`/`install`/`which` exit with status 127 when neither a version nor an `.nvmrc` resolves, notes the (current) `exec`/`run` fallback as undefined behavior, and points readers at `current` for the explicit "active node" use case. Refs #3755	2026-06-10 15:16:24 -07:00
Jordan Harband	718e880890	[Fix] focused error on missing/invalid args for several subcommands ... Previously a number of subcommands dumped the entire `nvm --help` output (~100 lines) when arguments were missing or invalid, drowning the real error. Replace each dump with a short, command-specific usage block that names the expected syntax and points to `nvm --help` for full help. The exit code (127) is unchanged. Affected subcommands: - `nvm install` (no version + no .nvmrc) - `nvm use` (version unresolvable) - `nvm run` (no version + no .nvmrc) - `nvm which` (no version + no .nvmrc) - `nvm cache` (unknown subcommand) - `nvm uninstall` (wrong arg count) - `nvm unalias` (wrong arg count) - `nvm install-latest-npm` (wrong arg count) - `nvm reinstall-packages` / `nvm copy-packages` (wrong arg count) The catch-all unknown-subcommand handler still dumps full help, since in that case the user has no narrower context to be reminded about. Refs #3755	2026-06-10 15:16:23 -07:00
Jordan Harband	ed4dbdfdd5	[Fix] nvm_rc_version: clarify error when no version and no .nvmrc ... Previously the message read "No .nvmrc file found", which obscured the fact that the user also did not pass a version. The new wording names both halves of the actual problem. Refs #3755	2026-06-10 15:16:23 -07:00
Jordan Harband	a9933f77a6	[Fix] nvm exec/nvm run: warn when no version and no .nvmrc ... Currently these commands silently fall back to the active node version when neither a version argument nor an `.nvmrc` resolves, making them invisibly dependent on shell state and impossible to script predictably (see #3755). Print a stderr deprecation warning in this case (suppressed by `--silent`) and continue with the active node version, so existing callers keep working. The follow-up change will turn this into a hard error; pass `current` explicitly (e.g. `nvm exec current node ...`) to silence the warning and lock in the new behavior now. Refs #3755	2026-06-10 15:16:23 -07:00
Jordan Harband	70fb4ede6b	[Fix] nvm_download_artifact: reject version strings with disallowed characters ... The mirror-supplied (untrusted) version flows into download URLs, filesystem paths, and the checksum awk match. Reject any version outside the node/io.js grammar (`[0-9A-Za-z._+-]`) before it is used. A blocklist of metacharacters is used rather than a strict semver allowlist so RCs, nightlies, v8-canary, and io.js versions still install. Completes the remediation of GHSA-3c52-35h2-gfmm.	2026-06-03 13:09:07 -07:00
Jordan Harband	90bb88748b	[Fix] nvm_get_checksum: pass the tarball name to awk as data, not program text ... The awk program string-interpolated the slug (which embeds the untrusted, mirror-supplied version) into its source, so a crafted version such as `v1"==$2){system("touch${IFS}/tmp/x")}#` was executed by awk's `system()`. Pass the value via `-v tarball=...` so awk treats it as data and never as code. See GHSA-3c52-35h2-gfmm (a second injection sink fed by the same untrusted version field that `nvm_download`'s eval was; the source-install path reaches this during a normal `nvm install <version>`).	2026-06-03 13:11:26 -07:00
Jordan Harband	6d870d182c	[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands ... `nvm_download` built a curl/wget command string and ran it with `eval`. The download URLs embed the version string taken from the mirror's `index.tab`, which is untrusted. Wrapping each argument in double quotes inside the `eval` does not prevent command substitution, so a version field such as `v1$(touch /tmp/proof)` was executed by the shell. This bypassed the earlier quoting hardening in 0ce8f5a. Pass every argument as a literal argv element instead of constructing a string for `eval`, on both the curl and wget paths, so URL arguments are never re-parsed by the shell. The wget flag translation is now done per-argument with a POSIX `set --` loop rather than `sed` over the joined string. The auth header is sanitized and added once, before invoking the downloader.	2026-06-02 17:41:44 -07:00
Jordan Harband	d264b796a3	[Fix] nvm_download: send a well-formed Authorization header on the wget path ... The wget path passed `NVM_AUTH_HEADER` as the raw header line (e.g. `--header "Bearer secret-token"`), omitting the `Authorization:` header name that the curl path includes. Per the documented usage (`NVM_AUTH_HEADER="Bearer secret-token"`) the value is the credential, so wget was sending a malformed header. Prefix it with `Authorization: ` to match the curl path.	2026-06-02 17:40:50 -07:00
Jordan Harband	84079dbff3	[Tests] install_nvm_from_git: stop git background gc/maintenance racing with cleanup ... The test's `rm -rf "$NVM_DIR"` intermittently failed with `rm: cannot remove...: Directory not empty` and aborted under `set -e`. Cause: after the clone/fetch, git can spawn a detached background gc/maintenance process that keeps writing into the clone dir while `rm -rf` runs (a concurrent writer makes the final rmdir fail). It is not egress- or version-related (it reproduces with all endpoints allowed), and it is environment-timing dependent (recently became consistent on the GitHub runners). Disable git's background work for the test (gc.autoDetach / maintenance.auto) so all git operations finish synchronously, and retry the rm once as a safety net.	2026-06-03 20:12:26 -07:00
Jordan Harband	61c9ff7371	[Tests] install_nvm_from_git: fix malformed test command (missing space before ]) ... `[ "${head_ref}" != "${avoid_ref}"]` is missing the space before the closing bracket, so the shell prints `[: missing ']'` and the avoid_ref assertion never actually runs (it is inside an `if` condition, so the error was non-fatal and silently disabled the check)	2026-06-03 14:53:48 -07:00
Jordan Harband	dd13968c1e	[Tests] reduce CI flakiness from transient Docker registry failures ... Container-based suites and the `nvm_download` httpbin check hard-fail whenever DockerHub is briefly unreachable (observed: `dial tcp ...:443: connect: connection refused` while pulling images), even though the change under test is fine. This is unrelated to any test logic. - tests-xenial / tests-installation-node: retry the `docker pull` up to 5 times before `docker run`, mirroring the existing apt-get retry - `nvm_download` test: retry the httpbin pull and skip the auth-header checks (rather than fail) when the image cannot be pulled or run, and make cleanup tolerant of a missing container.	2026-06-03 13:12:31 -07:00
Jordan Harband	53855417eb	[Fix] avoid an unbound variable ... Fixes #3820	2026-05-15 23:08:37 -07:00
Dick Marinus	790ffd2682	[Fix] fix same owner for root when install from binary ... GNU Tar has `--preserve-permissions` as a default enabled when executed as the superuser (root). This will cause the binaries to be installed using the permissions (owner and group) as defined in the tarball. The argument `--no-same-owner` prevents this and will install the binaries as the effective owner/group just like when nvm is executed as a non superuser. Updated the install from binary test from the installation_node test suite because this test is run in a docker container as root. Without --no-same-owner this test will fail beause the binaries of node v0.10.7 are owned by isaacs/admin in the tarball.	2026-05-05 15:40:32 -07:00