Since 072622c7, `nvm_version_path` rejects a version with a `..` path component, printing nothing and returning 3.
`nvm_is_version_installed` ignored that status and appended `/bin/node` to the empty output,
so for such a version (eg, `v/../x` in an `.nvmrc`)
it checked `/bin/node`,
and reported the version as installed whenever a system node lived there.
`nvm use` then put `/bin` in place of the active version on `PATH`,
and `nvm which` printed `/bin/node`.
Propagate `nvm_version_path`'s failure,
so such a version is never installed
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-O1QONH45; the scanner correctly classified it as not a vulnerability.
nvm.sh uses `NVM_SCRIPT_SOURCE="$_"` to detect its source location.
Adding `: nvm.sh` before each source line ensures `$_` is set correctly, preventing breakage when the previous command (e.g., `set -ex`) overwrites it.
Jordan Harband
Cassidy Marble
Noritaka Kobayashi
nmarghetti