302 Commits

Include renames

Author	SHA1	Message	Date
Jordan Harband	c07e8722a1	[Tests] nvm_get_arch_unofficial: set NVM_DIR when sourcing nvm.sh in the chroots ... The chroot checks source `nvm.sh` from `/bin/sh` without `NVM_DIR`, so nvm has to guess it: today from `dirname "$0"`, which is `/bin` here. That guess is incidental to what the test checks (architecture detection), so set `NVM_DIR` explicitly to the directory the chroot's `nvm.sh` lives in, as the README instructs Discovered by Anthropic's OSS Scanner, as ANT-2026-8RIT0MGO; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	8610e1578d	[Fix] nvm_process_nvmrc_content: reject control characters ... An `.nvmrc` line containing a control character (eg, an escape, a bell, or a carriage return in the middle of the version) was accepted as-is, so the raw bytes were passed along as the version and printed verbatim in the "Found '…' with version <…>" and "N/A: version … is not yet installed" messages, garbling the terminal output. Any line that still contains a control character other than a tab, after comments and leading and trailing white space are removed, now makes the file invalid. CRLF line endings keep working, since the trailing carriage return is trimmed as white space before the check. The "non-commented content parsed" part of the invalid `.nvmrc` message now shows each control character (other than tabs and newlines) as `?`, so it prints as plain text Discovered by Anthropic's OSS Scanner, as ANT-2026-R3FR49Z7; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	4a1f7d2875	[Fix] nvm_download_artifact, nvm debug: mask credentials in mirror URLs when printing them ... `nvm_get_mirror` accepts `user:password@` in `$NVM_NODEJS_ORG_MIRROR` and `$NVM_IOJS_ORG_MIRROR`, but `nvm_download_artifact` printed the full tarball URL in its "Downloading", "download from ... failed", and "HTTP 404 at URL" messages, and `nvm debug` printed both mirror variables as-is, so the credentials showed up in terminal output and build logs. Add `nvm_sanitize_url`, which replaces the userinfo part of any URL with `***@`, and use it in those messages. The download itself still uses the full URL, so authenticating to the mirror keeps working. The README now notes that `$NVM_AUTH_HEADER` is the recommended way to authenticate to a mirror Discovered by Anthropic's OSS Scanner, as ANT-2026-X03SZ7C6; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	37c578d973	[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache ... `nvm_install_binary` and `nvm_install_source` took the tarball path from the last line of `nvm_download_artifact`'s output via `| tail -1`. That pipeline's exit status is `tail`'s, so a failed download went unnoticed, and the downloader's own stdout was not separated from the path: anything it printed (eg, from a curl `write-out` setting) could be the last line. If that line happened to name an existing file relative to the current directory, it was extracted and installed as if it were the downloaded tarball, instead of the install failing. `nvm_download_artifact` now sends the downloader's output to stderr, so its stdout is only ever the tarball path. Both install functions capture its output directly and honor its exit status, and accept the result only if it is an existing file inside nvm's cache directory, via a new `nvm_is_cached_artifact` helper Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:58 -07:00
Jordan Harband	c8a2a81f92	[Fix] nvm_download, nvm_get_latest, install.sh: pass -q to curl first, so .curlrc is ignored again ... curl only skips reading `.curlrc` when `-q` is its very first argument; anywhere else, the config file has already been read by the time `-q` is seen. a4f89c62 added `-q` to every curl call so that a user's `.curlrc` would not affect nvm, but 6a3b1dd2 (v0.33.2) put `--compressed` in front of it everywhere. bd090ef7 (v0.40.0) moved it back to the front in `nvm.sh`'s `nvm_download`, and then 6d870d18 (v0.40.5) began building those arguments with `set --`, prepending `--compressed` after `-q`, so whenever curl supports compression, `-q` was second again. `nvm_get_latest` and `install.sh`'s `nvm_download` have passed `--compressed` before `-q` since v0.33.2. Pass `-q` first in all three places. Settings in a user's `.curlrc` (such as a proxy, CA bundle, or `write-out`) no longer apply to nvm's own curl calls, as was intended, and as in v0.40.0 through v0.40.4 for `nvm_download`; the corresponding environment variables (eg, `https_proxy`, `CURL_CA_BUNDLE`) still apply. The existing `nvm_get_latest` test pinned the old argument order, so its expectation is updated Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:58 -07:00
Jordan Harband	013b291d36	[meta] release-notes.sh: replace control characters in commit subjects ... Commit subjects were printed as-is, so escape sequences, carriage returns, and other control characters in a subject reached the terminal during `make release-notes` and `make release`, where they could hide or rewrite lines of the notes being reviewed, and were then written verbatim into the bump commit and the release tag. A tab in a subject also corrupted the tab-separated intermediate file. Subjects are now filtered as they are read from `git log`, replacing C0 controls, DEL, and UTF-8-encoded C1 controls with `?`. They are replaced rather than removed so that the bytes on either side cannot join into a new control character, and so the change stays visible in the notes. The section `grep` now matches bytes, because in a UTF-8 locale GNU grep stops printing matches at a line that is not valid UTF-8, which silently dropped bullets. Lowercasing a subject to find its category now works on bytes too, because in a UTF-8 locale BSD `tr` stops at a byte that is not valid UTF-8. Discovered by Anthropic's OSS Scanner, as bug ANT-2026-INF3JLG6; the scanner correctly classified it as not a vulnerability.	2026-10-23 08:53:58 -07:00
Jordan Harband	d639676bb0	[Fix] nvm_is_version_installed: fail when nvm_version_path fails ... Since 072622c7, `nvm_version_path` rejects a version with a `..` path component, printing nothing and returning 3. `nvm_is_version_installed` ignored that status and appended `/bin/node` to the empty output, so for such a version (eg, `v/../x` in an `.nvmrc`) it checked `/bin/node`, and reported the version as installed whenever a system node lived there. `nvm use` then put `/bin` in place of the active version on `PATH`, and `nvm which` printed `/bin/node`. Propagate `nvm_version_path`'s failure, so such a version is never installed Discovered by Anthropic's OSS Scanner, as bug ANT-2026-O1QONH45; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan Harband	020503b536	[Fix] nvm install: validate an inherited NVM_MAKE_JOBS like -j ... A job count given with `-j` is checked by `nvm_get_make_jobs`, which rejects anything but a natural number and falls back to the detected core count. A non-empty `NVM_MAKE_JOBS` already in the environment skipped that check entirely, and was passed as-is to `make -j`, where a value like `V=1` or `-f/dev/null` is taken as a separate `make` argument. Now an inherited value that is not a natural number gets the same error and fallback as an invalid `-j`; a valid one is still used, and an empty one still triggers detection silently Discovered by Anthropic's OSS Scanner, as bug ANT-2026-SYLQD6PZ; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan Harband	813b5f6dcc	[Fix] nvm_is_natural_num: reject anything but digits ... `[ "$1" -eq "$1" ]` accepts more than a natural number: a leading `+`, and leading or trailing whitespace, and in ksh it evaluates its operands as arithmetic expressions, so words like `install` and expressions like `1+1` or `V=1` pass too. Values with any non-digit character are now rejected before that test. The sunos and aix branches of `nvm_get_make_jobs` count cores with `wc -l`, which on those platforms pads the count with whitespace, so that count is now stripped of whitespace before it is checked Discovered by Anthropic's OSS Scanner, as bug ANT-2026-SYLQD6PZ; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan Harband	8df635740e	[Fix] nvm_remote_version: match the requested version as a whole version component ... The check that the resolved version actually matches the request used an unanchored substring match on the raw pattern, so `nvm install 20` could accept `v10.20.0` when a remote list's row was selected by a `v20` in its LTS column and no 20.x rows were present. Match the `v`-prefixed pattern followed by a non-digit against the version instead, the same way `nvm_ls_remote_index_tab` normalizes it, so `20` no longer matches `v10.20.0` or `v200.0.0`, while regex-style requests like `4.*` and `v[68]`, and a trailing dot like `8.`, keep working. This also fixes `iojs-1` and `iojs-3`, which previously resolved to N/A because `iojs-3` is not a substring of `iojs-v3.3.1`. Discovered by Anthropic's OSS Scanner, as bug ANT-2026-7GFFYVJP; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan Harband	66228bd1fa	[Fix] nvm_ls: match the version pattern literally ... nvm_ls escaped only `.` and `#` before using the pattern (which may come from a `.nvmrc`) as a sed address, so any other regex characters in it were interpreted: `v2[0-9]` matched installed versions, `[` made sed fail with an error, and nested bounded repetitions like `\(v\{1,300\}\)\{1,300\}` made sed take a very long time and a lot of memory to compile, stalling `nvm use` and shell startup. Escape every BRE metacharacter, including the backslash, so the pattern is always matched as literal text Discovered by Anthropic's OSS Scanner, as bug ANT-2026-HZAFTTUK; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan Harband	6b9650c47f	[Fix] bash_completion: list alias and version names without expanding them ... `__nvm_generate_completion` passed its word list to `compgen -W`, which runs every word through shell expansion. Since that list includes alias file names and installed version directory names, pressing Tab after `nvm use`, `nvm alias`, etc, ran any command substitution in those names, expanded variables in them, and globbed `*` against the current directory. Now the list is split with globbing disabled, and each word is matched against the current word as a literal prefix, so names are offered exactly as written Discovered by Anthropic's OSS Scanner, as bug ANT-2026-QDARMGPO; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan Harband	d8b39c746e	[Fix] nvm_sanitize_auth_header: strip newlines, so wrapped base64 credentials work ... `sed` works one line at a time, so the allowlist never removed newlines inside `NVM_AUTH_HEADER`. A `Basic` credential built with GNU `base64`, which wraps its output at 76 columns, therefore reached the downloader split across several lines, and authentication failed (wget rejects such a header outright). Filter with `tr -cd` instead, using the same set of allowed characters, so CR and LF are deleted like any other disallowed character and a wrapped credential is joined back into one line Discovered by Anthropic's OSS Scanner, as bug ANT-2026-W1E9TAK3; the scanner correctly classified it as not a vulnerability.	2026-10-22 20:10:42 -07:00
Jordan HarbandandElan Ruusamäe	b1b3a0038c	[Fix] nvm_cd: bypass a user-defined cd function ... `\cd` only bypasses aliases, so a user-defined `cd` function (eg, cdhist's) still ran, and broke `NVM_DIR` auto-detection when it rejected zsh's `-q`. Use `command cd`, which skips functions in POSIX shells. zsh's `command` runs `/usr/bin/cd` instead of the builtin, so use `builtin cd` there, as `nvm_echo` does for `printf`. `nvm_die_on_prefix` also now uses `nvm_cd` instead of a bare `cd`. Fixes #3835. See #3836. Co-authored-by: Elan Ruusamäe <glen@delfi.ee>	2026-10-09 21:16:17 -07:00
Saadanjum0	906fb605bc	[Fix] nvm use: handle regex-special characters in $NVM_DIR ... nvm_change_path interpolated `$NVM_DIR` and the new version dir unescaped into grep and sed expressions, so a path containing `&`, `#`, `[`, `*`, etc. corrupted `$PATH` (or made sed fail) when switching versions. Escape them before use.	2026-10-01 16:35:00 +05:00
Cassidy Marble	d55a55c387	[Perf] nvm_version_greater, nvm_version_greater_than_or_equal_to: avoid awk where possible	2026-10-07 15:30:01 -03:00
Cassidy Marble	9c8cac4a2e	[Perf] nvm_is_valid_version, nvm_validate_implicit_alias: avoid forks	2026-10-06 18:01:38 -03:00
Cassidy Marble	66640e6000	[Perf] nvm_echo: use the printf shell builtin under zsh ... In zsh, `command printf` skips the builtin and forks `/usr/bin/printf`.	2026-10-06 17:54:48 -03:00
Cassidy Marble	1dd1d8c82e	[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a ... The file is read, not sourced. An `ID` with no OS of its own is only taken as Linux when the kernel's `ostype` says so; otherwise `uname -a` decides.	2026-10-06 14:23:02 -03:00
Cassidy Marble	c28f2b70db	[Perf] nvm_npmrc_bad_news_bears: scan npmrc files without forking grep	2026-10-06 14:01:11 -03:00
Cassidy Marble	f296b8d210	[Perf] nvm_die_on_prefix: detect the OS only when it is needed	2026-10-06 14:00:46 -03:00
Cassidy Marble	c7ba8d2106	[Perf] nvm_version: resolve an exact, installed version without nvm_ls ... An alias of the same name still takes precedence, as it does in `nvm_ls`.	2026-10-06 12:43:22 -03:00
Cassidy Marble	d211d5fdb8	[Perf] nvm_is_version_installed: check the modern layout's path before the full lookup	2026-10-06 12:43:22 -03:00
Hridhin Varkey Joseph	f1f3d463ab	[Perf] nvm use: skip re-resolving an exact, installed version ... When `nvm use` is given an exact `vX.Y.Z` that is already installed, and no alias with that exact name exists, use it directly instead of re-resolving it through `nvm_match_version` and `nvm_ensure_version_installed`, both of which call `nvm_version`. `nvm_auto` takes this path on every shell startup with an already-resolved version, so this removes ~95ms from each new shell (~330ms -> ~235ms in a clean environment on macOS/zsh). Fixes #3930	2026-10-01 09:51:16 +05:30
Shrikant	5326eaab9d	[Tests] add unit coverage for nvm_version_greater_than_or_equal_to	2026-10-03 12:49:00 +05:30
Hridhin Varkey Joseph	a27fb0bd78	[Tests] add unit tests for nvm_version_greater_than_or_equal_to	2026-10-03 11:51:31 +05:30
Mingyang Wu	cb96d2a56a	[Fix] Handle filesystem identity when checking path containment ... Fixes #1049. Assisted-by: OpenAI GPT-6 <noreply@openai.com>	2026-09-11 16:49:46 +08:00
Jordan Harband	79bc9b90dd	[Tests] make the fast suite pass on macOS ... - `nvm_get_arch`: the unmocked smartos cases fall through to the host, so only run them on x86_64 - `nvm_get_arch_unofficial`: the chroot checks need x86_64 glibc Linux - `nvm_install_no_progress_bar`: derive the tarball slug and checksum tool instead of assuming linux-x64 and `sha256sum`	2026-09-30 16:09:09 +09:00
Jordan Harband	04ac3f2a83	[Fix] nvm install: do not remove the caller's TMPDIR after a failed download ... `nvm_install_binary` and `nvm_install_source` declared `local TMPDIR` without initializing it, and remove it with `rm -rf` on failure. dash's `local` keeps the caller's value, as does bash's when `TMPDIR` is passed as a prefix assignment (`TMPDIR=… nvm install`), so a failed download removed the caller's temp directory; on macOS, `tar` instead blocked reading the archive from the terminal.	2026-10-05 10:02:48 -07:00
Ben YounesandJordan Harband	a8bb497400	[New] nvm ls-remote: annotate versions with the node alias and local aliases ... Fixes #2786. Ben Younes added the alias annotations to bare `nvm ls-remote`, with their regression tests; Jordan Harband moved `(Latest: node)` onto the newest node release, gave each kind of annotation a fixed column so the output can be sliced with `cut`, matched aliases to versions in one pass, and kept local aliases out of the mocks and tests. Co-authored-by: Ben Younes <2910651+ousamabenyounes@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-23 21:35:43 +00:00
Jordan Harband	04fbd9570c	[New] add nvm_has_italics, to detect terminal italics support via terminfo	2026-09-29 17:08:36 +09:00
Jordan Harband	09822033d2	[Fix] nvm exec/nvm run: do not treat filenames with digits as versions ... `nvm_is_valid_version` accepted strings like `123.js`, `v1.js`, and `1.2.3.4.5.6.js`, because `nvm_version_greater_than_or_equal_to` exits as soon as the first number is greater than zero, without looking at the rest. So `nvm run 123.js` failed with `N/A: version "v123.js" is not yet installed` instead of running the file. It now checks the shape first: one to three dot-separated numbers, optionally with a trailing dot, and a prerelease suffix (rc, nightly, v8-canary, test builds) only after a full `x.y.z`. A suffix with a dot followed by a non-digit, like a file extension, is rejected, so names like `1.2.3-foo.js` are treated as files too. Every version listed in the nodejs.org and iojs.org `index.tab` files is still accepted, so shell startup keeps using a `default` alias that resolves to an installed prerelease. Names that are also valid versions, like `123` or `v1`, are still treated as versions; `nvm run current 123` runs such a file. Refs #1166. See #3931.	2026-09-28 15:05:28 +09:00
Jordan Harband	072622c748	[Fix] nvm_alias, nvm_version_path: reject .. path components ... `nvm_alias` concatenated the requested name onto `$NVM_DIR/alias` and read whatever that resolved to, so a name with a `..` component escaped the alias dir - under the default layout, `../../.npmrc` reaches `$HOME/.npmrc`. `nvm_print_alias_file` echoes every non-comment line of what it opens, and `nvm use` reports the first one in its "is not yet installed" error, so an untrusted `.nvmrc` could disclose any file the invoking user can read. The write side already rejected `..` in an alias name (9275c5ba); apply the same check on the read side, and to `nvm_version_path`, which composes a version into a path with no check of its own. Slashes stay legal, since `lts/iron` and the `lts/*` alias file depend on them.	2026-09-21 10:01:34 +08:00
Jordan Harband	a4f801ed72	[Fix] nvm_get_make_jobs: count cores on platforms the case does not name ... `nvm_get_os` also returns `win` (Cygwin/MSYS/MinGW) and the empty string, neither of which had an arm, so `NVM_CPU_CORES` went unassigned and nvm asked the user to report a gap it already knew about. On an unrecognized `uname` that also meant a single-threaded source build; `win` refuses source builds a few lines later either way. `NUMBER_OF_PROCESSORS` comes last because Windows scopes it to the calling process' processor group. Assigning `NVM_CPU_CORES` in every arm also keeps the `nvm_is_natural_num` check below from aborting dash and ksh under `set -u`.	2026-09-10 17:08:50 -07:00
Thanniru Sai Teja	cd84623ab2	[Perf] Optimize nvm_tree_contains_path with in-memory POSIX parent-walk ... Replace looping subshell process forks (dirname) in nvm_tree_contains_path with case-guarded in-memory POSIX parameter expansion () and exact string equality comparisons. Ensures literal string matching for glob metacharacters (*, ?, []) and full zsh compatibility across all platforms.	2026-09-03 12:24:16 +05:30
Jordan Harband	e361b93e4b	[Fix] nvm use: do not clobber man's default search path ... `man` consults its own configured search path only when MANPATH holds an empty entry; a list without one replaces the default outright. `nvm use` produced exactly that, so activating a version could hide every system man page. Contribute the empty entry as a trailing one, so that nvm's directory keeps precedence over the system's, and only when the list has none already, so that repeated `nvm use` calls are idempotent and an empty entry the user placed stays where they put it. The `$(manpath)` snapshot this replaces went stale the moment man's configuration changed, and cost a subprocess per `nvm use`. It was also dead: `local MANPATH` scoped the assignment to `nvm()`, so `export` did not outlive the call and MANPATH went untouched whenever it started out unset. Only ksh, where `local` is not a builtin, ever ran it. `nvm deactivate` now unsets MANPATH where nvm's was the only real entry, rather than leaving a bare `:` behind. Reported and diagnosed by @al0ksar in #3890, which used a leading empty entry instead. That one accrues one more colon on every `nvm use`, which `nvm deactivate` then leaves behind, and it loses to the system's man pages wherever nvm's bin directory is not first on PATH. Supersedes #2077. Refs #3890 Refs #2077	2026-09-08 11:01:03 -07:00
Lazizbek Ergashev	ccb49e5cd0	[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed ... Fixes #3906	2026-09-04 14:08:01 -07:00
Jordan Harband	aeace4606f	[Fix] nvm_hash_reset: only run hash -r where the shell supports it ... Under bash's `set +h`, `hash -r` errors with "hash: hashing disabled", which is then printed on every `nvm use`, including the one at shell startup. Guarding on `$-` alone would be wrong: `zsh` never puts `h` in `$-` - there `h` is `HIST_IGNORE_DUPS` - and `dash` has no `h` flag at all, so it would skip the call in 3 of the 4 shells the fast suite runs. Gate on the shell instead, and skip only where the call fails: bash under `set +h`, and `ksh93`, whose `hash` takes no `-r` and whose usage error aborts `nvm use` before it can export `NVM_BIN`. `ksh` is detected by probing rather than by version, so `mksh` and `pdksh`, which do accept `-r`, keep getting the call. The `${-#*h}` test is from #3910. Refs #2065 Refs #3247	2026-09-04 09:16:10 -07:00
debadityaandJordan Harband	80e700ec21	[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file ... `#` is a repetition operator under `extendedglob`, so `${VAR%%#*}` is an invalid pattern: zsh aborts the expansion and `nvm_alias` silently prints nothing, leaving the `default` alias unresolved when nvm.sh is sourced. The read loop moves into `nvm_print_alias_file` so that `local_options` scopes the option change to that section alone, rather than to everything `nvm_alias` does, and restores whatever the caller had set. Fixes #3885 Co-authored-by: debaditya <debaditya2005hait@gmail.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-03 20:54:28 -07:00
Jordan Harband	25b378323c	[Fix] zsh: restore nomatch and markdirs rather than clobbering them ... `unsetopt local_options nomatch` unsets both named options, so LOCAL_OPTIONS is off by the time the function returns and the `nomatch` change escapes into the caller's shell: one `nvm ls` or `nvm alias` leaves NO_MATCH off for the rest of the session, after which an unmatched glob is silently passed through as a literal. `setopt local_options nonomatch`, already used in `nvm_check_file_permissions`, restores on return. The `markdirs` line also cancelled the snapshot taken for `shwordsplit` on the line above it; that one is latent, as `nvm_ls` is only ever called inside a command substitution.	2026-09-03 20:44:59 -07:00
CJstate	3a72926f4a	[Fix] nvm --help: render the set-colors legend in color ... Every legend line is built inside a command substitution, where `nvm_has_colors` can never succeed, because `[ -t 1 ]` sees the capture pipe rather than the terminal. The legend has therefore always printed plain, on every terminal and in every shell. Resolve color support once and pass it in, the way `nvm_print_alias_path` already accepts the same flag. A command-prefix assignment cannot carry it: POSIX expands a command's arguments before applying its assignments, so the substitutions would still see it unset, and in sh and ksh it would outlive the call and override `--no-colors` for everything after. The test needs no tty, and fails against an unfixed `nvm.sh` in sh, bash, dash, and zsh. Fixes #3896	2026-09-03 12:10:19 -07:00
Jordan Harband	38f0f2cfdf	[Tests] nvm_print_color_legend: look up the function with PATH emptied ... The presence checks were still satisfiable by this test file itself, which is an executable named `nvm_print_color_legend`. Filtering `command -v` output on a `/` was not enough: dash and zsh report a bare name, not a path, for a current-directory match reached through an empty `PATH` component, and that is indistinguishable from a function. So `nvm unload` looked as though it had left the function behind in exactly the shells CI runs as `sh`, `dash`, and `zsh`, while bash, which reports `./name`, passed. Emptying `PATH` for the lookup asks about the function alone, and is immune to whatever `PATH` happens to hold. Reproduced first, then fixed: with `PATH=":${PATH}"` the previous check fails under dash and zsh and passes under bash, matching CI exactly. The assertions now hold in sh, bash, dash, and zsh with the directory absent from `PATH`, present on it, and via an empty entry, and both dropping `nvm_print_color_legend` from `nvm unload` and renaming the function out from under the guard are still caught in all twelve combinations.	2026-09-03 15:12:34 -07:00
Jordan Harband	26fef4fe1a	[Tests] nvm_print_color_legend: check for the function, not a same-named file ... The presence checks used `command -v`, which finds executables as readily as functions, and this test file is itself an executable named `nvm_print_color_legend`. Whenever its own directory is on `PATH`, as it is under CI, `command -v` kept resolving to the file long after `nvm unload` had removed the function, so the unload assertion could never pass there and the "is it defined" guard could never fail. `command -v` prints a bare name for a function and a path for an executable, in sh, bash, dash, zsh, and ksh alike, so requiring the result to contain no slash distinguishes the two. Verified both ways round: with the test's directory on `PATH` the suite passes in all four shells, and removing `nvm_print_color_legend` from `nvm unload`'s list is still caught in all four.	2026-09-03 12:08:18 -07:00
Jordan Harband	17f12a1207	[Tests] nvm_print_color_legend: fix the fast suite on GNU userlands ... The `nvm unload` assertion failed every `fast` job on Linux while passing on macOS, and its shape made the cause impossible to read off the failure. `set -e` aborts the command substitution when `nvm unload` returns non-zero, which leaves an empty string that the assertion then reports as "unload left nvm_print_color_legend defined". Run the unload with `set +e` inside the subshell and report its exit status next to the lookup, so a failing unload can no longer be misread as a function that survived it. The accompanying `sed: couldn't flush stdout: Broken pipe` came from the `grep -q` pipelines: `grep -q` exits at its first match and hands SIGPIPE to the `sed` feeding it, which BSD sed swallows and GNU sed reports. Match whole lines with `case` against the already-captured string instead, which needs no pipe at all, and capture `nvm --help` before stripping it rather than piping it through two processes into `grep -q`. Test stderr is now empty in sh, bash, dash, and zsh.	2026-09-03 11:54:45 -07:00
Jordan Harband	ab83657ba6	[Refactor] nvm --help: extract the set-colors legend into nvm_print_color_legend	2026-09-03 10:17:16 -07:00
Jordan Harband	10a277ec47	[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding ... 3c480159 correctly made this validator actually enforce, instead of the no-op `awk '{ $0 ~ "..." }'` it had been, but its character class had never been audited against real mirror URLs: it has no `:`, so enabling enforcement silently rejected every mirror URL bearing a port. $ NVM_NODEJS_ORG_MIRROR=https://mirror.internal:8443/dist nvm_ls_remote $NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL No request is made at all, so an internal mirror on a non-default port has been unusable since v0.40.5. Allow RFC 3986 `unreserved` plus the authority and path punctuation a mirror URL legitimately needs: `:` for a port, `@` for userinfo, `[`/`]` for an IPv6 literal host, and `%` for percent-encoding. `sub-delims` and the query/fragment delimiters stay rejected: nvm appends a path to this value, so a query string could never have worked, and several of those characters are shell metacharacters.	2026-09-02 19:40:47 -07:00
Andres Mejia Sanchez	dd0f702fb1	[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68 ... `~` is a member of RFC 7235 §2.1 `token68`, and thus of RFC 6750 §2.1 `b64token`, but the allowlist stripped it, silently corrupting any opaque Bearer credential containing it: Bearer mF_9.B5f-4.1JqM~+/= -> Bearer mF_9.B5f-4.1JqM+/= `Basic` credentials were never affected, since RFC 4648 §4 base64 cannot emit `~`; `;` stays stripped, as it belongs to no auth-scheme production. Cover the charset in the unit test, and assert the credential reaches the downloader intact via the existing fake-`wget` harness, which needs no container.	2026-09-02 19:36:04 -07:00
Jordan Harband	809f3ee5ab	[New] nvm install: serialize concurrent installs of the same version ... Two `nvm install <same version>` runs could race on the version directory - one removing or replacing it while the other reads or writes it. Take a per-version advisory lock (an atomically-created directory under $NVM_DIR/.cache locks) around the binary/source install, so a second run of the same version waits for the first; installs of different versions never contend. NVM_INSTALL_LOCK_TIMEOUT (seconds, default 600) bounds the wait, after which nvm reports the lock path so a lock left by a killed install can be removed. NVM_INSTALL_LOCK_STALE (minutes, default 0 / off) opts into automatically stealing a lock older than that, for unattended or CI use.	2026-07-24 10:55:58 -07:00
Jordan Harband	9570a22bfe	[New] nvm install: add NVM_NO_SOURCE_FALLBACK to disable the source fallback ... By default a failed binary download falls back to compiling node from source, which is slow and pointless on platforms that always have prebuilt binaries. `-b` already disables the fallback per-invocation; `NVM_NO_SOURCE_FALLBACK=1` makes it the default for every `nvm install`, so CI images and dev setups need not thread `-b` through every callsite. It behaves exactly like `-b` - aborting with a non-zero exit on a failed binary download - and is mutually exclusive with `-s`, for the same reason `-b` is.	2026-07-24 10:54:17 -07:00
Jordan Harband	aee1f83f0f	[Robustness] nvm install: reject a structurally broken installed version ... `nvm_is_version_installed` only checks that `bin/node` has the execute bit, which a zero-byte binary and a dangling `npm` symlink both pass, so a partial install could be reported as a success — and a broken existing version could short-circuit `nvm install` as "already installed". Add `nvm_validate_install`, which requires a non-empty `bin/node` and an `npm` entry that resolves, and use it in two places: gate the "already installed" shortcut on it, so a broken version is reinstalled rather than reused, and re-check it after an install reports success, so a broken result fails loudly instead of being activated. It checks layout, not execution: a correctly installed binary can still fail to run on an incompatible host (e.g. a newer node on an older glibc), which is not a broken install, and a corrupt download is already rejected by the checksum check before extraction.	2026-07-24 10:51:53 -07:00