226 Commits

Include renames

Author	SHA1	Message	Date
Jordan Harband	903e349369	[Fix] nvm_download: pass $NVM_AUTH_HEADER to curl and GNU Wget in a config file, not as an argument ... The header was passed as a `--header` argument, so it was readable by anyone who could see the downloader's command line. curl now reads it as `header = "…"` from a config on stdin (`--config -`); the sanitized value can contain neither `"` nor `\` nor a line break, so it cannot escape the quoted string or add another option. GNU Wget only reads a config file that is a regular file, so a subshell writes the header to a `mktemp` file in `$TMPDIR` (mode 0600), after a copy of the user's `$WGETRC` or `~/.wgetrc`, which that file replaces, and points `WGETRC` at it; traps on EXIT, HUP, INT, and TERM remove it, and `WGETRC` never reaches the user's shell. BusyBox wget reads no config file and has no option for one, so it still gets the header as an argument; the README recommends curl on shared machines. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-540RL2U6.	2026-10-17 22:28:01 -07:00
Jordan Harband	1f99e4c20b	[Fix] nvm_download_artifact: only put an archive in the cache once its checksum has passed ... `nvm install --offline` installs whatever archive sits at the cache path without checking it again, which is only safe if everything nvm writes there has been verified. When a download failed its checksum, `nvm_download_artifact` removed only the empty `files` directory and left the rejected archive in `$NVM_DIR/.cache`, so a later `nvm install --offline` would install the very tarball the online install had just refused. An interrupted download was also left at the final cache name. Download to a temporary `.unverified` name instead, run the 404 and checksum checks on that file, and move it to the cache path only once the checksum has passed. Every failure path, including a checksum mismatch or a missing expected checksum, now removes the temporary file and the version's cache directory, so `--offline` no longer finds the version at all. The README's offline section now says that only verified downloads are cached and that `--offline` trusts the cache as-is. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-7NCT51FE.	2026-10-16 22:02:45 -07:00
Jordan Harband	3fda4d5542	[New] select versions by category: alpha, lts, non-lts, iojs; exclude alphas by default ... Node 27 and later publish Alpha prereleases, like `v27.0.0-alpha.1.0.0`, in the main `index.tab`, so `nvm install node` or `nvm install 27` would otherwise pick one. Every version is in exactly one category: `alpha` and `lts` or `non-lts` (by index.tab's LTS column) on the node mirror, and `iojs` on the io.js mirror. Commands select from every category but `alpha`, unless `$NVM_ONLY` lists others, and every command that selects or lists versions takes `--only=<categories>` to override both; an exact alpha needs `alpha` selected, like any other. An LTS selection, like `--lts` or an `lts/` version, can't combine with an `--only=` that excludes `lts`. Telling installed `lts` and `non-lts` versions apart uses the recorded LTS status, and fails rather than guess without it. `nvm alias` also stores `--only=`, so `nvm alias default --only=alpha node` makes the latest installed alpha the default, including in a new shell.	2026-10-21 14:09:18 -07:00
Jordan Harband	fe2900d176	[New] nvm alias: store --lts and --lts=<name> ... `nvm alias default --lts node` writes `--lts node` to the alias file, so it resolves to the latest installed LTS version, using each version's recorded LTS status; `--lts=<name>` limits it to one LTS line. The flags of the outermost alias apply when one alias points at another, an alias with a flag this version of nvm doesn't recognize resolves to nothing, rather than ignoring the flag, and `nvm uninstall` also removes aliases with flags that point at the uninstalled version. A new shell never downloads index.tab, so it explains a default alias that needs LTS status that isn't recorded yet.	2026-10-21 12:57:19 -07:00
Jordan Harband	e780535240	[Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER ... curl 7.58.0 and later drop a custom Authorization header when a redirect leads to another host, but wget sends `--header` along to every redirect target, so on a machine without curl, a mirror that redirected elsewhere handed the credential to that other host. When a header is sent with GNU Wget, run it with `--max-redirect=0`. When it then exits with 8 (an HTTP error, which includes a redirect it did not follow), read the `Location` with one more request, and re-request it only if it keeps the same scheme, host, and port, up to 20 times. A redirect to another origin, including a downgrade to `http`, fails with exit code 8 and an error that names the URL nvm requested and suggests curl. `--max-redirect` is not a BusyBox wget option, so other wgets are invoked as before; the README says so Discovered by Anthropic's OSS Scanner, as ANT-2026-PKUZHTT3; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	e3aa232901	[Fix] nvm_download: only send $NVM_AUTH_HEADER to URLs under a mirror it applies to ... The header was added to every download, whatever the host. With only `$NVM_NODEJS_ORG_MIRROR` set, a private mirror's credential therefore also went to the default `https://iojs.org/dist` (eg, from `nvm ls-remote`), and with only `$NVM_IOJS_ORG_MIRROR` set, to `https://nodejs.org/dist`; it also went to `npmjs.org` when installing an old npm. Add `nvm_auth_header_applies_to`, which uses `nvm_get_mirror` and accepts a URL only when it is under a mirror, compared literally, with a `/` after the mirror's prefix. When exactly one of the two mirror variables is set, the header belongs to that mirror alone; when both or neither are set, both mirrors (including the defaults, when neither is) still receive it, so the documented example keeps working. An invalid mirror matches nothing, and no empty `Authorization:` header is sent when sanitizing leaves nothing Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	35d6e5a000	[Fix] nvm.sh: detect NVM_DIR without $0/$_; fall back to the default install location instead of the working directory ... When `nvm.sh` is sourced with `NVM_DIR` unset, it derived `NVM_DIR` from the sourced file in bash (via `BASH_SOURCE`), and otherwise from `dirname "${_:-$0}"`. In shells that do not set `BASH_SOURCE` (dash, sh, ksh, and zsh under `emulate sh` or without `FUNCTION_ARGZERO`), `$0` is the shell's or the calling script's name and `$_` is whatever was inherited, so `NVM_DIR` became an unrelated directory: for `sh -c '. ~/.nvm/nvm.sh'`, as run by `system(3)` or `popen(3)`, that is the working directory, whose `alias/default` and `versions/` nvm then used, and from which `nvm cache clear` and friends would operate. Detection now uses only reliable sources: `BASH_SOURCE` in bash, `${(%):-%x}` in zsh (which names the sourced file regardless of options), and `${.sh.file}` in ksh93 (probed in a subshell first, since other shells with `KSH_VERSION` reject the syntax) A detected source that is not a regular file (eg, `/dev/fd/63` from `. <(…)`) is ignored. Otherwise, nvm uses the default install location that `install.sh` uses (`$XDG_CONFIG_HOME/nvm`, else `~/.nvm`) when it contains `nvm.sh`, and if not, it prints an error asking for `NVM_DIR` to be set and returns 1, instead of guessing. Setups that export `NVM_DIR` before sourcing `nvm.sh`, as `install.sh` and the README do, are unaffected Discovered by Anthropic's OSS Scanner, as ANT-2026-8RIT0MGO; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	8610e1578d	[Fix] nvm_process_nvmrc_content: reject control characters ... An `.nvmrc` line containing a control character (eg, an escape, a bell, or a carriage return in the middle of the version) was accepted as-is, so the raw bytes were passed along as the version and printed verbatim in the "Found '…' with version <…>" and "N/A: version … is not yet installed" messages, garbling the terminal output. Any line that still contains a control character other than a tab, after comments and leading and trailing white space are removed, now makes the file invalid. CRLF line endings keep working, since the trailing carriage return is trimmed as white space before the check. The "non-commented content parsed" part of the invalid `.nvmrc` message now shows each control character (other than tabs and newlines) as `?`, so it prints as plain text Discovered by Anthropic's OSS Scanner, as ANT-2026-R3FR49Z7; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
Jordan Harband	4a1f7d2875	[Fix] nvm_download_artifact, nvm debug: mask credentials in mirror URLs when printing them ... `nvm_get_mirror` accepts `user:password@` in `$NVM_NODEJS_ORG_MIRROR` and `$NVM_IOJS_ORG_MIRROR`, but `nvm_download_artifact` printed the full tarball URL in its "Downloading", "download from ... failed", and "HTTP 404 at URL" messages, and `nvm debug` printed both mirror variables as-is, so the credentials showed up in terminal output and build logs. Add `nvm_sanitize_url`, which replaces the userinfo part of any URL with `***@`, and use it in those messages. The download itself still uses the full URL, so authenticating to the mirror keeps working. The README now notes that `$NVM_AUTH_HEADER` is the recommended way to authenticate to a mirror Discovered by Anthropic's OSS Scanner, as ANT-2026-X03SZ7C6; the scanner reported it as a vulnerability, but it is not one.	2026-10-23 08:53:59 -07:00
clifennelandJordan Harband	6dc3765f6b	[readme] Fix a Docker warning from using Docker installation instructions ... Fix a LegacyKeyValueFormat warning when building a Docker image using the 'Installing In Docker' instructions. The warning fixed is: `LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format` See: [LegacyKeyValueFormat](https://docs.docker.com/reference/build-checks/legacy-key-value-format/) Co-authored-by: clifennel <li.chr+github@northeastern.edu> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-15 21:28:51 -07:00
Hridhin Varkey Joseph	ed1b96f5db	[readme] explain the misleading npm install error from npm run test/fast	2026-10-04 00:49:18 +05:30
Ben YounesandJordan Harband	a8bb497400	[New] nvm ls-remote: annotate versions with the node alias and local aliases ... Fixes #2786. Ben Younes added the alias annotations to bare `nvm ls-remote`, with their regression tests; Jordan Harband moved `(Latest: node)` onto the newest node release, gave each kind of annotation a fixed column so the output can be sliced with `cut`, matched aliases to versions in one pass, and kept local aliases out of the mocks and tests. Co-authored-by: Ben Younes <2910651+ousamabenyounes@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-23 21:35:43 +00:00
Jordan Harband	a885b885fe	v0.40.8 ... Bug Fixes - `nvm_alias`, `nvm_version_path`: reject `..` path components - `nvm_get_make_jobs`: count cores on platforms the `case` does not name - `nvm-exec`: improve the no-version failure message - `nvm use`: do not clobber `man`'s default search path (#3890) - `nvm_err`, `nvm_err_with_colors`: do not fail when stderr is closed (#3907) - `nvm_hash_reset`: only run `hash -r` where the shell supports it - `nvm_alias`: unset zsh's `extendedglob` while reading an alias file (#3891) - zsh: restore `nomatch` and `markdirs` rather than clobbering them - `nvm --help`: render the set-colors legend in color (#3915) - `nvm unload`: drop the undefined `nvm_format_help_message_colors` - `nvm_get_mirror`: allow ports, userinfo, IPv6 hosts, and percent-encoding - `nvm_sanitize_auth_header`: allow `~`, completing RFC 7235 `token68` (#3751) Refactors - `nvm --help`: extract the set-colors legend into `nvm_print_color_legend` Performance - Optimize nvm_tree_contains_path with in-memory POSIX parent-walk (#3912) Docs - [readme] document platforms with no official node binaries - `install.sh`: Fix missing words in bash/zsh completion message (#3887) - Remove stray closing HTML tag (#3919) Misc - [meta] remove CLAUDE.md symlink in favor of AGENTS.md (#3928) - [meta] add `release-notes.sh`, the release notes generator Tests - homebrew/actions changed their default branch - [actions] WSL: pin every distribution, and test the newest of each line - `nvm_print_color_legend`: look up the function with `PATH` emptied - `nvm_print_color_legend`: check for the function, not a same-named file - `nvm_print_color_legend`: fix the `fast` suite on GNU userlands - [actions] `release.yml`: provide `GH_TOKEN` so release-notes PR lookup can run	2026-09-21 10:23:47 +08:00
Jordan Harband	7fc22fc9c7	[readme] document platforms with no official node binaries ... The README never said which platforms nvm can detect but nodejs.org does not build for, so a user on one of them only finds out from a slow, silent, source-build fallback. Also corrects the Alpine section: nvm remaps Alpine to a musl arch itself now, and nodejs.org has published `linux-x64-musl` since v24.20.0, so both the "no concrete plans" and the "does not exist errors" claims are out of date. Coverage bounds are stated per release line rather than per patch, since the newest of them are still shipping.	2026-09-10 17:11:20 -07:00
dajiaohuang	3fb99c652b	[Docs] Remove stray closing HTML tag	2026-09-10 03:58:50 +08:00
Jordan Harband	e361b93e4b	[Fix] nvm use: do not clobber man's default search path ... `man` consults its own configured search path only when MANPATH holds an empty entry; a list without one replaces the default outright. `nvm use` produced exactly that, so activating a version could hide every system man page. Contribute the empty entry as a trailing one, so that nvm's directory keeps precedence over the system's, and only when the list has none already, so that repeated `nvm use` calls are idempotent and an empty entry the user placed stays where they put it. The `$(manpath)` snapshot this replaces went stale the moment man's configuration changed, and cost a subprocess per `nvm use`. It was also dead: `local MANPATH` scoped the assignment to `nvm()`, so `export` did not outlive the call and MANPATH went untouched whenever it started out unset. Only ksh, where `local` is not a builtin, ever ran it. `nvm deactivate` now unsets MANPATH where nvm's was the only real entry, rather than leaving a bare `:` behind. Reported and diagnosed by @al0ksar in #3890, which used a leading empty entry instead. That one accrues one more colon on every `nvm use`, which `nvm deactivate` then leaves behind, and it loses to the system's man pages wherever nvm's bin directory is not first on PATH. Supersedes #2077. Refs #3890 Refs #2077	2026-09-08 11:01:03 -07:00
Jordan Harband	f0b0c6bb0b	v0.40.7 ... New Stuff - `nvm install`: serialize concurrent installs of the same version - `nvm install`: add `NVM_NO_SOURCE_FALLBACK` to disable the source fallback Robustness - `nvm install`: reject a structurally broken installed version - `nvm_install_binary_extract`: replace a broken version dir atomically - `install.sh`: `nvm_download`: avoid `eval` so arguments aren't re-parsed by the shell Docs - [readme] link every referenced person and project to its canonical page Misc - [Dev Deps] update `markdown-link-check` Tests - install_nvm_from_git: don't fail when master is at the latest release tag	2026-08-17 23:08:13 -07:00
Jordan Harband	0b8ed9fa7d	[Dev Deps] update markdown-link-check	2026-08-17 22:59:46 -07:00
Jordan Harband	65ded65d46	[readme] link every referenced person and project to its canonical page ... Link the first mention of each named person to their GitHub and each named project, tool, or OS to its official homepage or repo. Mentions that appear only inside a heading (Ansible), an HTML comment (doctoc), or a multi-word code span (grunt) are left unlinked, since a link there would break the generated table-of-contents anchors or fail to render.	2026-07-24 11:11:57 -07:00
Jordan Harband	809f3ee5ab	[New] nvm install: serialize concurrent installs of the same version ... Two `nvm install <same version>` runs could race on the version directory - one removing or replacing it while the other reads or writes it. Take a per-version advisory lock (an atomically-created directory under $NVM_DIR/.cache locks) around the binary/source install, so a second run of the same version waits for the first; installs of different versions never contend. NVM_INSTALL_LOCK_TIMEOUT (seconds, default 600) bounds the wait, after which nvm reports the lock path so a lock left by a killed install can be removed. NVM_INSTALL_LOCK_STALE (minutes, default 0 / off) opts into automatically stealing a lock older than that, for unattended or CI use.	2026-07-24 10:55:58 -07:00
Jordan Harband	9570a22bfe	[New] nvm install: add NVM_NO_SOURCE_FALLBACK to disable the source fallback ... By default a failed binary download falls back to compiling node from source, which is slow and pointless on platforms that always have prebuilt binaries. `-b` already disables the fallback per-invocation; `NVM_NO_SOURCE_FALLBACK=1` makes it the default for every `nvm install`, so CI images and dev setups need not thread `-b` through every callsite. It behaves exactly like `-b` - aborting with a non-zero exit on a failed binary download - and is mutually exclusive with `-s`, for the same reason `-b` is.	2026-07-24 10:54:17 -07:00
Jordan Harband	b6cf55f6ad	v0.40.6	2026-07-15 14:09:54 -07:00
Curt J. Sampson	b16fb6ece9	[readme] Docker: build time is "several" minutes, not 8 ... On my system, even without using local mirrors, the build is only two minutes, even though I have only a 1 Gbps Internet connection and I'm half-way across the world in Tokyo. There probably are still users with much slower Internet connections where the build could take eight minutes or more, but "several" still covers that.	2025-09-15 18:06:37 +09:00
Curt J. Sampson	190cb9458b	[readme] Docker: Just say "Ubuntu" (no version) for base image ... The base image is updated regularly (it's currently 22.04), and it's easy to forget to update this readme, so best we simply not repeat ourselves and instead let people look at `Dockerfile` to see exactly which version of Ubuntu it's using.	2025-09-15 08:20:51 +00:00
Jordan Harband	ee4fa818d2	[Docs] document nvm reinstall-packages as a standalone command ... The standalone `nvm reinstall-packages <version>` command can migrate global npm packages between already-installed versions, but it was only mentioned in `nvm --help`, not in the README. Add a section covering it. Refs #3858	2026-06-29 14:51:15 -05:00
Jordan Harband	a6ec739430	[Docs] document current and clarify .nvmrc fallback in help/README ... - Help text for `nvm install`/`use`/`exec`/`run`/`which` now ends with "Uses .nvmrc if version is omitted; otherwise errors." so it's clear that omitting the version is not a free fallback. - Help signatures for `use`/`exec`/`run` now show `[current | <version>]` to mirror `nvm which` and document that `current` is accepted. - `nvm current` description now spells out that it resolves via `$PATH` and is not affected by `.nvmrc`. - README: add `current` to the list of special aliases, with the same caveat. The `.nvmrc` section now states that `nvm use`/`install`/`which` exit with status 127 when neither a version nor an `.nvmrc` resolves, notes the (current) `exec`/`run` fallback as undefined behavior, and points readers at `current` for the explicit "active node" use case. Refs #3755	2026-06-10 15:16:24 -07:00
Jordan Harband	1889911f08	v0.40.5	2026-06-04 09:33:05 -07:00
Mozi	3e4b0f05b7	[readme] do not use tilde expansion in ENV of Dockerfile ... It won't expand. my bad.	2026-04-11 00:34:20 -04:00
Mozi	001ea8cac1	[readme] use tilde expansion instead of "$HOME" for consistency ... at least in this code block.	2026-03-05 15:06:38 -05:00
Mozi	b0f82ac1b2	[readme] use "$HOME" instead of hardcoded "/home/user" ... For now, only "test/fast/Unit tests/nvm_change_path" uses "/home/user".	2026-03-05 05:42:57 -05:00
Peter Dave Hello	59d4ea8f3e	[Docs] Clean up wording in docs and shell comments ... Adjust a few spelling, grammar, and naming inconsistencies in the docs and related shell comments without changing behavior.	2026-03-23 23:48:23 +08:00
Hemant Mann	82e3803e93	[readme] Revise Node.js version usage examples	2026-03-14 18:08:20 +05:30
Jordan Harband	ae31eceecc	[meta] run npm run doctoc	2026-03-24 11:50:40 -07:00
Jordan Harband	59bd32be6b	[New] nvm install --offline: install from cache without network access ... Add `--offline` flag to `nvm install` that resolves versions using only locally installed versions and cached downloads. No network calls are made. New helper functions `nvm_ls_cached` and `nvm_offline_version` scan `$NVM_DIR/.cache/bin/` for previously downloaded tarballs. In offline mode, `nvm_download_artifact` returns cached tarballs directly without checksum verification or download attempts. The curl/wget requirement is skipped when `--offline` is set. Supports `--lts` via locally stored LTS alias files.	2026-03-13 16:13:19 -04:00
Jordan Harband	62387b8f92	v0.40.4	2026-01-29 14:12:03 -08:00
Jordan Harband	4c3edc5e56	[actions] migrate Travis CI tests to GitHub Actions	2026-01-27 10:31:07 -08:00
Shay Molcho	0509776196	[readme] add missing colon ... Inserted missing colons in specific parts of the text to maintain consistency with the existing format. This adjustment ensures a uniform writing style, improves readability, and aligns the text structure with the rest of the document.	2025-01-28 08:28:41 +02:00
Sylvain Lesage	0fbe3a6776	[readme] add background on io.js	2025-08-20 09:58:31 -04:00
Noritaka Kobayashi	4d364c2e7b	[readme] fix typo	2025-10-18 10:28:48 +09:00
Wei Zhang	c3d674f8f9	[readme] update installation by docker to v0.40.3	2025-06-06 17:13:54 +08:00
Jordan Harband	977563e97d	v0.40.3	2025-04-23 16:34:31 -07:00
Jordan Harband	ffec9fec72	v0.40.2 ... New Stuff - `install.sh`: add `$ZDOTDIR` to zsh search (#3458) Fixes - `reinstall-packages`: do not reinstall corepack (#3544) - avoid bash-specific syntax (#3499) - `install-latest-npm`: npm v11 is out - `nvm_install_latest_npm`: avoid unbound variable (#3447) - give a more helpful message when `lts` alias is mistakenly used (#3441) - `nvm ls`, `nvm alias`, `nvm install`: error when an LTS name is invalid - `nvm_normalize_lts`: error when an LTS name is not lowercase (#3417) Documentation - [readme] update link - [readme] fix `--no-use` example (#3479) - [readme] update copyright notice (#3507) - [readme] note zsh-nvm's AUTO_USE option (#2670) - [readme] add note about reloading zshrc after editing (#3052) - [readme] Update shell profile file install notes (#2241) - [readme] add docker tips (#2318) - [readme] remove `avn` from readme (#3469) - [readme] fnm -> nvm.fish (#2541) Refactors - prefer `case` over if/else chains - combine `sed -e` invocations/arguments Tests - `nvm exec`/`nvm run`: add `--silent` tests (#1259) - [actions] release test needs git tags - migrate `installation_iojs` test suite to GitHub Actions (#3476) - Migrate slow test suite from Travis CI (#3470) - temporarily skip this failing travis test to unblock progress - [actions] TOC: use latest LTS node - `install.sh`: clean up `nvm_detect_profile` tests - `nvm_detect_profile`: refactor (#3467) - run urchin tests on pull requests (#3466) - update mocks - ensure that unit tests use only mocked LTS names - [actions] use `node/install` instead of `node/run` Meta - disable blank issues - update issue template - add DCO (#3456) - Rename .github/ISSUE_TEMPLATE.md to .github/ISSUE_TEMPLATE/ISSUE_TEMPLATE.md (#3454)	2025-03-11 13:39:40 -07:00
Jordan Harband	8dbc22f0e9	[readme] update link	2025-03-11 12:46:19 -07:00
Jordan Harband	5c12680a62	[Dev Deps] update markdown-link-check	2025-03-11 12:43:42 -07:00
Jérémy GAU	247ed8a186	[readme] fix --no-use example	2024-11-28 20:33:25 +01:00
Chris de Almeida	d90a7910db	[readme] update copyright notice	2025-01-10 14:41:50 -06:00
Andy Gimblett	8c30ac633b	[readme] note zsh-nvm's AUTO_USE option	2021-12-01 14:55:38 +00:00
Nicola Lanzoni	ecdc865a5a	[readme] add note about reloading zshrc after editing	2023-03-09 09:39:55 -03:00
Asad Akbar	9bcbbef4eb	[readme] Update shell profile file install notes ... * Adds a note for how to fix the issue when the install script is not updating the correct profile file.	2020-06-19 16:36:09 -07:00
Björn HolmandChristopher Dieringer	b77fcec399	[readme] add docker tips ... - covers installation using BASH_ENV Co-authored-by: Christopher Dieringer <cdaringe@users.noreply.github.com> Co-authored-by: Björn Holm <blollle@gmail.com>	2022-11-14 00:16:13 +01:00