The test suites source `nvm.sh` without setting `NVM_DIR` unless the caller exports it, which locally
(where `NVM_*` variables are unset first)
and in the `urchin tests` workflow it is not.
bash and zsh then detect the checkout from the sourced file,
but sh and dash have no way to locate a sourced file,
so they fell back to `dirname "$0"`,
which happened to be the test's own directory.
The `test-<shell>` targets now export `NVM_DIR` as the checkout when it is still unset,
so every shell runs the suites against the same `NVM_DIR`,
and an explicitly provided `NVM_DIR` is kept
Discovered by Anthropic's OSS Scanner, as ANT-2026-8RIT0MGO; the scanner reported it as a vulnerability, but it is not one.
Conversely, a warning is issued if it is missing, because that implies that no actual cross-shell testing will take place.
Also, the shell command that determines the set of available test suites is now POSIX-compliant.
- Using `npm test` and `npm run …` scripts defined in package.json now invokes the makefile and runs the test with the same shell that npm was invoked from.
- The makefile can now be invoked directly - supporting utilities from locally installed npm packages are automatically discovered.
- Invoking the makefile without a target errors out with a hint.
- Shell-specific test targets are now named 'test-<shell>'.
- Both 'test-<shell>' targets and the all-shells 'test' target now run all test suites by default.
- On `make TAG=<new-version> release` there must be no uncommitted changes. '<new-version>' can now also be one of the following increment specifiers: 'patch', 'minor', 'major'.
- It is ensure that <new-version>, if not an increment specifier, is a valid semver version number that is higher than the previous release's.
- The previous release tag is now located with a pattern so as to exclude tags that aren't version numbers.
- Switched from lightweight to annotated tags for releases.
Jordan Harband
Andre Kradolfer
Peter Dave Hello
Piper Chester
Michael Klement
Koen Punt