[Fix] nvm_get_make_jobs: count cores on platforms the case does not name

`nvm_get_os` also returns `win` (Cygwin/MSYS/MinGW) and the empty string,
neither of which had an arm,
so `NVM_CPU_CORES` went unassigned
and nvm asked the user to report a gap it already knew about.
On an unrecognized `uname` that also meant a single-threaded source build;
`win` refuses source builds a few lines later either way.

`NUMBER_OF_PROCESSORS` comes last because Windows scopes it to the calling process' processor group.

Assigning `NVM_CPU_CORES` in every arm also keeps the
`nvm_is_natural_num` check below from aborting dash and ksh under `set -u`.

.github/workflows/release.yml

@@ -35,5 +35,6 @@ jobs:
         run: echo proceed | make TAG=99.99.99 release
         env:
           GIT_EDITOR: "sed -i '1 s/^/99.99.99 make release test/'"
+          GH_TOKEN: ${{ github.token }}
       - name: Ensure tag is created
         run: git tag | grep v99.99.99

.github/workflows/windows-npm.yml

@@ -107,10 +107,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # each line gets a pin, plus the newest setup-wsl offers for it; the
+        # newest only moves when the action's major does, so bumping the `uses:`
+        # ref below is what keeps this current
         wsl-distrib:
-          - Debian
-        # - Alpine # fails
+          - Debian-12
+          - Debian-13
+        # - Alpine-3.17 # fails
           - Ubuntu-20.04
+          - Ubuntu-24.04
           - Ubuntu-18.04
         npm-node-version:
           - '--lts'
@@ -128,31 +133,57 @@ jobs:
           - wsl-distrib: Ubuntu-18.04
             npm-node-version: '18'
           # node v24+ doesn't work on WSL1 (exec format error)
-          - wsl-distrib: Debian
+          - wsl-distrib: Debian-12
+            npm-node-version: '--lts'
+          - wsl-distrib: Debian-13
             npm-node-version: '--lts'
           - wsl-distrib: Ubuntu-20.04
             npm-node-version: '--lts'
+          - wsl-distrib: Ubuntu-24.04
+            npm-node-version: '--lts'
         method:
           - ''
           - 'script'
     steps:
       # For Ubuntu: install with packages directly
-      - if: matrix.wsl-distrib != 'Debian'
-        uses: Vampire/setup-wsl@v6
+      - if: ${{ !startsWith(matrix.wsl-distrib, 'Debian') }}
+        uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
           additional-packages: bash git curl ca-certificates wget
 
-      # For Debian: install without packages first (apt-get update fails due to stale sources.list)
+      # For Debian, install without packages: `additional-packages` would run
+      # `apt-get update` before we get to fix up sources.list
       # see https://github.com/Vampire/setup-wsl/issues/76
-      - if: matrix.wsl-distrib == 'Debian'
-        uses: Vampire/setup-wsl@v6
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
+        uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
-      - if: matrix.wsl-distrib == 'Debian'
+      # Debian's mirror layout shifts as a release ages out of LTS: main moves to
+      # archive.debian.org, and the security suite is both renamed and moved, on
+      # its own schedule. Offer every layout and let `apt-get update` discard the
+      # ones that 404, so this needs no edits as the image's release ages.
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
+        name: 'Point apt at whichever mirrors still carry this release'
         shell: 'wsl-bash {0}'
-        run: 'sed -i s/ftp.debian.org/archive.debian.org/ /etc/apt/sources.list'
-      - if: matrix.wsl-distrib == 'Debian'
+        run: |
+          codename="$(. /etc/os-release && printf '%s' "${VERSION_CODENAME-}")"
+          if [ -z "${codename}" ]; then
+            echo 'no VERSION_CODENAME in /etc/os-release' >&2
+            exit 1
+          fi
+          # Debian 13 moved to deb822; drop both formats so what we write is the
+          # only thing apt reads, whichever release is pinned
+          rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+          {
+            echo "deb http://deb.debian.org/debian ${codename} main"
+            echo "deb http://archive.debian.org/debian ${codename} main"
+            echo "deb http://security.debian.org/debian-security ${codename}-security main"
+            echo "deb http://archive.debian.org/debian-security ${codename}-security main"
+            echo "deb http://archive.debian.org/debian-security ${codename}/updates main"
+          } >/etc/apt/sources.list
+          cat /etc/apt/sources.list
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
         name: 'Install packages with retries'
         shell: 'wsl-bash {0}'
         run: |
@@ -173,9 +204,15 @@ jobs:
               }
             done
           }
-          retry apt-get update
-          retry apt-get upgrade --yes
-          retry apt-get install --yes bash git curl ca-certificates wget
+          packages=(bash git curl ca-certificates wget)
+          retry apt-get update || true
+          if ! retry apt-get install --yes "${packages[@]}"; then
+            # a security index can outlive the pool objects it advertises, which
+            # no retry resolves; main is complete once a release is archived
+            sed -i '/debian-security/d' /etc/apt/sources.list
+            retry apt-get update || true
+            retry apt-get install --yes "${packages[@]}"
+          fi
 
       - name: Retrieve nvm on WSL
         run: |
@@ -204,7 +241,8 @@ jobs:
       fail-fast: false
       matrix:
         wsl-distrib:
-          - Alpine
+          - Alpine-3.17
+          - Alpine-3.23
         npm-node-version:
           - '--lts'
           - '21'
@@ -218,7 +256,7 @@ jobs:
           - ''
           - 'script'
     steps:
-      - uses: Vampire/setup-wsl@v6
+      - uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
           additional-packages: bash git curl ca-certificates wget

README.md

@@ -44,6 +44,7 @@
   - [Set default node version](#set-default-node-version)
   - [Use a mirror of node binaries](#use-a-mirror-of-node-binaries)
     - [Pass Authorization header to mirror](#pass-authorization-header-to-mirror)
+  - [Platforms without official binaries](#platforms-without-official-binaries)
   - [.nvmrc](#nvmrc)
   - [Deeper Shell Integration](#deeper-shell-integration)
     - [Calling `nvm use` automatically in a directory with a `.nvmrc` file](#calling-nvm-use-automatically-in-a-directory-with-a-nvmrc-file)
@@ -122,7 +123,7 @@ export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || pr
 
 #### Additional Notes
 
-- If the environment variable `$XDG_CONFIG_HOME` is present, it will place the `nvm` files there.</sub>
+- If the environment variable `$XDG_CONFIG_HOME` is present, it will place the `nvm` files there.
 
 - You can add `--no-use` to the end of the above script to postpone using `nvm` until you manually [`use`](#usage) it:
 
@@ -646,6 +647,8 @@ nvm install iojs-v1.0.3
 NVM_IOJS_ORG_MIRROR=https://iojs.org/dist nvm install iojs-v1.0.3
 ```
 
+Some platforms and architectures have no binary on the default host at all; see [Platforms without official binaries](#platforms-without-official-binaries).
+
 `nvm use` will not, by default, create a "current" symlink. Set `$NVM_SYMLINK_CURRENT` to "true" to enable this behavior, which is sometimes useful for IDEs. Note that using `nvm` in multiple shell tabs with this environment variable enabled can cause race conditions.
 
 #### Pass Authorization header to mirror
@@ -655,6 +658,31 @@ To pass an Authorization header through to the mirror url, set `$NVM_AUTH_HEADER
 NVM_AUTH_HEADER="Bearer secret-token" nvm install node
 ```
 
+### Platforms without official binaries
+
+nodejs.org does not publish a binary for every platform and architecture nvm can detect. Where it does not, `nvm install` falls back by default to compiling from source, which is slow and needs a C++ toolchain (see [Important Notes](#important-notes)); set `$NVM_NO_SOURCE_FALLBACK` to `1` to make a missing binary an error instead.
+
+[unofficial-builds.nodejs.org](https://unofficial-builds.nodejs.org/download/release/) ([nodejs/unofficial-builds](https://github.com/nodejs/unofficial-builds)) publishes binaries for platforms the Node.js project does not officially support. To use them, point [`$NVM_NODEJS_ORG_MIRROR`](#use-a-mirror-of-node-binaries) at it:
+
+```sh
+export NVM_NODEJS_ORG_MIRROR=https://unofficial-builds.nodejs.org/download/release
+```
+
+| platform | binaries on nodejs.org | binaries on unofficial-builds |
+| --- | --- | --- |
+| `freebsd`, `openbsd` (any arch) | none | none |
+| `sunos` (Solaris, illumos) | v13.x and earlier | none |
+| `linux-x86` (32-bit) | v9.x and earlier | v8.16.0 through v21.x |
+| `linux-armv6l` | v11.x and earlier | v8.16.0 through v22.x |
+| `linux-armv7l` | v23.x and earlier | none |
+| `linux-x64-musl` (Alpine) | v24.20.0+ and v26.8.0+ only | v8.16.0 and later |
+| `linux-arm64-musl` (Alpine) | none | v20.20.1 and later |
+| `linux-loong64` | none | v18.18.0 and later |
+| `linux-riscv64` | none | v17.7.1 through v26.0.0 |
+| `win-x86` (32-bit) | v22.x and earlier | none |
+
+Neither host is gapless, and both change over time; the `index.tab` at the root of each is authoritative. Where neither has a binary, `nvm install` compiles from source, except on non-WSL Windows, which nvm cannot build on; on FreeBSD and OpenBSD it skips the download and goes straight to source. Alpine has its own section: [Installing nvm on Alpine Linux](#installing-nvm-on-alpine-linux).
+
 ### .nvmrc
 
 You can create a `.nvmrc` file containing a node version number (or any other string that `nvm` understands; see `nvm --help` for details) in the project root directory (or any parent directory).
@@ -870,7 +898,7 @@ nvm exposes the following environment variables:
 - `NVM_CD_FLAGS` - used to maintain compatibility with zsh.
 - `NVM_RC_VERSION` - version from .nvmrc file if being used.
 
-Additionally, nvm modifies `PATH`, and, if present, `MANPATH` and `NODE_PATH` when changing versions.
+Additionally, nvm modifies `PATH` when changing versions, along with `MANPATH` wherever a `manpath` command exists, and `NODE_PATH`, if present.
 
 The following environment variables can be set to configure `nvm install`:
 
@@ -957,7 +985,7 @@ set -e
 
 In order to provide the best performance (and other optimizations), nvm will download and install pre-compiled binaries for Node (and npm) when you run `nvm install X`. The Node project compiles, tests and hosts/provides these pre-compiled binaries which are built for mainstream/traditional Linux distributions (such as Debian, Ubuntu, [CentOS](https://www.centos.org), [RedHat](https://www.redhat.com) et al).
 
-[Alpine Linux](https://www.alpinelinux.org), unlike mainstream/traditional Linux distributions, is based on [BusyBox](https://www.busybox.net/), a very compact (~5MB) Linux distribution. BusyBox (and thus Alpine Linux) uses a different C/C++ stack to most mainstream/traditional Linux distributions - [musl](https://www.musl-libc.org/). This makes binary programs built for such mainstream/traditional incompatible with Alpine Linux, thus we cannot simply `nvm install X` on Alpine Linux and expect the downloaded binary to run correctly - you'll likely see "...does not exist" errors if you try that.
+[Alpine Linux](https://www.alpinelinux.org), unlike mainstream/traditional Linux distributions, is based on [BusyBox](https://www.busybox.net/), a very compact (~5MB) Linux distribution. BusyBox (and thus Alpine Linux) uses a different C/C++ stack to most mainstream/traditional Linux distributions - [musl](https://www.musl-libc.org/). This makes binary programs built for such mainstream/traditional distributions incompatible with Alpine Linux, so on `x64` and `arm64` nvm requests a `musl` build instead. nodejs.org publishes those only for some recent `x64` releases, so for anything else the download 404s and `nvm install X` falls back to compiling from source, unless you point it at a mirror that has one (see [Platforms without official binaries](#platforms-without-official-binaries)).
 
 There is a `-s` flag for `nvm install` which requests nvm download Node source and compile it locally.
 
@@ -977,7 +1005,7 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.7/install.sh | bash
 
 _Note: Alpine 3.5 can only install NodeJS versions up to v6.9.5, Alpine 3.6 can only install versions up to v6.10.3, Alpine 3.7 installs versions up to v8.9.3, Alpine 3.8 installs versions up to v8.14.0, Alpine 3.9 installs versions up to v10.19.0, Alpine 3.10 installs versions up to v10.24.1, Alpine 3.11 installs versions up to v12.22.6, Alpine 3.12 installs versions up to v12.22.12, Alpine 3.13 & 3.14 install versions up to v14.20.0, Alpine 3.15 & 3.16 install versions up to v16.16.0 (**These are all versions on the main branch**). Alpine 3.5 - 3.12 required the package [`python2`](https://www.python.org/) to build NodeJS, as they are older versions to build. Alpine 3.13+ requires `python3` to successfully build newer NodeJS versions, but you can use `python2` with Alpine 3.13+ if you need to build versions of node supported in Alpine 3.5 - 3.15, you just need to specify what version of NodeJS you need to install in the package install script._
 
-The Node project has some desire but no concrete plans (due to the overheads of building, testing and support) to offer Alpine-compatible binaries.
+The Node project now publishes an official `linux-x64-musl` binary for some recent releases (v24.20.0+ and v26.8.0+; no v25 release has one). There is no official `arm64` musl binary.
 
 As a potential alternative, [@mhart](https://github.com/mhart) (a Node contributor) has some [Docker images for Alpine Linux with Node and optionally, npm, pre-installed](https://github.com/mhart/alpine-node).
 

install.sh

@@ -496,7 +496,7 @@ nvm_do_install() {
     fi
   fi
   if ${BASH_OR_ZSH} && [ -z "${NVM_PROFILE-}" ] ; then
-    nvm_echo "=> Please also append the following lines to the if you are using bash/zsh shell:"
+    nvm_echo "=> Please also append the following lines to the correct file if you are using bash/zsh shell:"
     command printf "${COMPLETION_STR}"
   fi
 

nvm-exec

@@ -12,7 +12,9 @@ if [ -n "$NODE_VERSION" ]; then
 else
   { NVM_RC_VERSION="$(nvm_rc_version 3>&1 1>&4)"; } 4>&1 && nvm_ensure_version_installed "$NVM_RC_VERSION";
   if ! nvm use >/dev/null 2>&1; then
-    echo "No NODE_VERSION provided; no .nvmrc file found" >&2
+    nvm_err 'nvm-exec: unable to select a node version'
+    # shellcheck disable=SC2016
+    nvm_err '  Set `NODE_VERSION` (e.g. `NODE_VERSION=default`), or add an `.nvmrc` file.'
     exit 127
   fi
 fi

nvm.sh

@@ -33,12 +33,15 @@ nvm_cd() {
   \cd "$@"
 }
 
+# a caller that closed stderr, rather than redirecting it to /dev/null, makes
+# the `>&2` fail; zsh cannot report that, so it aborts the script, which only a
+# subshell contains, and `|| return 0` keeps the status from the caller
 nvm_err() {
-  >&2 nvm_echo "$@"
+  (>&2 nvm_echo "$@") || return 0
 }
 
 nvm_err_with_colors() {
-  >&2 nvm_echo_with_colors "$@"
+  (>&2 nvm_echo_with_colors "$@") || return 0
 }
 
 nvm_grep() {
@@ -190,9 +193,10 @@ nvm_sanitize_auth_header() {
     # and base64url (A-Za-z0-9-_=) charsets, plus the space, colon, dot, and
     # underscore the previous allowlist already permitted, so that values like
     # `Basic <base64>` and `Bearer <token>` survive intact.
-    # token68's '~' is still stripped.
+    # '~' is also allowed, completing RFC 7235 `token68` (and thus RFC 6750
+    # `b64token`), so opaque Bearer tokens containing it are not corrupted.
     # Note: '-' must be at the end of the bracket expression to be treated as a literal.
-    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9 :_.+/=-]//g'
+    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9 :_.+/=~-]//g'
 }
 
 nvm_has_system_node() {
@@ -543,6 +547,9 @@ else
 fi
 unset NVM_SCRIPT_SOURCE 2>/dev/null
 
+# Performs pure in-memory POSIX path containment checking without subshell process forks.
+# Uses case-guarded ${pathdir%/*} for parent-walk and exact string equality (=) to ensure literal matching
+# for directory names containing glob metacharacters (*, ?, []) across all shells including zsh.
 nvm_tree_contains_path() {
   local tree
   tree="${1-}"
@@ -554,16 +561,36 @@ nvm_tree_contains_path() {
     return 2
   fi
 
-  local previous_pathdir
-  previous_pathdir="${node_path}"
-  local pathdir
-  pathdir=$(dirname "${previous_pathdir}")
-  while [ "${pathdir}" != '' ] && [ "${pathdir}" != '.' ] && [ "${pathdir}" != '/' ] &&
-      [ "${pathdir}" != "${tree}" ] && [ "${pathdir}" != "${previous_pathdir}" ]; do
-    previous_pathdir="${pathdir}"
-    pathdir=$(dirname "${previous_pathdir}")
+  local clean_tree
+  clean_tree="${tree}"
+
+  # Strip trailing slashes in shell memory (e.g., "dir//" -> "dir")
+  while [ "${clean_tree}" != "${clean_tree%/}" ]; do
+    clean_tree="${clean_tree%/}"
   done
-  [ "${pathdir}" = "${tree}" ]
+  if [ -z "${clean_tree}" ]; then
+    clean_tree='/'
+  fi
+
+  # Pure in-memory POSIX parent-walk using parameter expansion instead of subshell dirname forks.
+  # Uses literal string equality [ "${pathdir}" = "${clean_tree}" ] to prevent glob expansion bugs.
+  local pathdir
+  pathdir="${node_path}"
+  while [ "${pathdir}" != '' ] && [ "${pathdir}" != '.' ] && [ "${pathdir}" != '/' ] &&
+      [ "${pathdir}" != "${clean_tree}" ]; do
+    case "${pathdir}" in
+      */*)
+        pathdir="${pathdir%/*}"
+        if [ -z "${pathdir}" ]; then
+          pathdir='/'
+        fi
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
+  [ "${pathdir}" = "${clean_tree}" ]
 }
 
 nvm_find_project_dir() {
@@ -1116,6 +1143,19 @@ nvm_change_path() {
   fi
 }
 
+nvm_hash_reset() {
+  # under `set +h` there is no cache to clear, and `hash -r` errors
+  if [ -n "${BASH_VERSION-}" ] && [ "${-#*h}" = "$-" ]; then
+    return 0
+  fi
+  # `ksh93`'s `hash` takes no `-r` and its usage error is fatal; probing in a
+  # subshell contains it, and spares the `ksh` variants that do accept `-r`
+  if [ -n "${KSH_VERSION-}" ] && ! ( \hash -r ) >/dev/null 2>&1; then
+    return 0
+  fi
+  \hash -r
+}
+
 nvm_binary_available() {
   # binaries started with node 0.8.6
   nvm_version_greater_than_or_equal_to "$(nvm_strip_iojs_prefix "${1-}")" v0.8.6
@@ -1128,6 +1168,8 @@ nvm_set_colors() {
     local CURRENT_COLOR
     local NOT_INSTALLED_COLOR
     local DEFAULT_COLOR
+    local NVM_HAS_COLORS
+    NVM_HAS_COLORS=0
 
     INSTALLED_COLOR="$(echo "$1" | awk '{ print substr($0, 1, 1); }')"
     LTS_AND_SYSTEM_COLOR="$(echo "$1" | awk '{ print substr($0, 2, 1); }')"
@@ -1138,6 +1180,7 @@ nvm_set_colors() {
       nvm_echo "Setting colors to: ${INSTALLED_COLOR} ${LTS_AND_SYSTEM_COLOR} ${CURRENT_COLOR} ${NOT_INSTALLED_COLOR} ${DEFAULT_COLOR}"
       nvm_echo "WARNING: Colors may not display because they are not supported in this shell."
     else
+      NVM_HAS_COLORS=1
       nvm_echo_with_colors "Setting colors to: $(nvm_wrap_with_color_code "${INSTALLED_COLOR}" "${INSTALLED_COLOR}")$(nvm_wrap_with_color_code "${LTS_AND_SYSTEM_COLOR}" "${LTS_AND_SYSTEM_COLOR}")$(nvm_wrap_with_color_code "${CURRENT_COLOR}" "${CURRENT_COLOR}")$(nvm_wrap_with_color_code "${NOT_INSTALLED_COLOR}" "${NOT_INSTALLED_COLOR}")$(nvm_wrap_with_color_code "${DEFAULT_COLOR}" "${DEFAULT_COLOR}")"
     fi
     export NVM_COLORS="$1"
@@ -1175,13 +1218,38 @@ nvm_wrap_with_color_code() {
   CODE="$(nvm_print_color_code "${1}" 2>/dev/null ||:)"
   local TEXT
   TEXT="${2-}"
-  if nvm_has_colors && [ -n "${CODE}" ]; then
+  # `nvm_has_colors` cannot answer for itself inside a command substitution,
+  # where `[ -t 1 ]` sees the capture pipe: callers that already checked pass
+  # the answer in, as `nvm_print_alias_path` also accepts it.
+  if { [ "${NVM_HAS_COLORS-}" = 1 ] || nvm_has_colors; } && [ -n "${CODE}" ]; then
     nvm_echo_with_colors "\033[${CODE}${TEXT}\033[0m"
   else
     nvm_echo "${TEXT}"
   fi
 }
 
+nvm_print_color_legend() {
+  # Every line below builds its text in a command substitution, which cannot
+  # detect color support itself, so resolve it once here. `local` matters:
+  # leaking the flag would override `--no-colors` for every later call.
+  local NVM_HAS_COLORS
+  NVM_HAS_COLORS=0
+  if nvm_has_colors; then
+    NVM_HAS_COLORS=1
+  fi
+  nvm_echo '                                               Initial colors are:'
+  nvm_echo_with_colors "                                                  $(nvm_wrap_with_color_code 'b' 'b')$(nvm_wrap_with_color_code 'y' 'y')$(nvm_wrap_with_color_code 'g' 'g')$(nvm_wrap_with_color_code 'r' 'r')$(nvm_wrap_with_color_code 'e' 'e')"
+  nvm_echo '                                               Color codes:'
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'r' 'r')/$(nvm_wrap_with_color_code 'R' 'R') = $(nvm_wrap_with_color_code 'r' 'red') / $(nvm_wrap_with_color_code 'R' 'bold red')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'g' 'g')/$(nvm_wrap_with_color_code 'G' 'G') = $(nvm_wrap_with_color_code 'g' 'green') / $(nvm_wrap_with_color_code 'G' 'bold green')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'b' 'b')/$(nvm_wrap_with_color_code 'B' 'B') = $(nvm_wrap_with_color_code 'b' 'blue') / $(nvm_wrap_with_color_code 'B' 'bold blue')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'c' 'c')/$(nvm_wrap_with_color_code 'C' 'C') = $(nvm_wrap_with_color_code 'c' 'cyan') / $(nvm_wrap_with_color_code 'C' 'bold cyan')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'm' 'm')/$(nvm_wrap_with_color_code 'M' 'M') = $(nvm_wrap_with_color_code 'm' 'magenta') / $(nvm_wrap_with_color_code 'M' 'bold magenta')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'y' 'y')/$(nvm_wrap_with_color_code 'Y' 'Y') = $(nvm_wrap_with_color_code 'y' 'yellow') / $(nvm_wrap_with_color_code 'Y' 'bold yellow')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'k' 'k')/$(nvm_wrap_with_color_code 'K' 'K') = $(nvm_wrap_with_color_code 'k' 'black') / $(nvm_wrap_with_color_code 'K' 'bold black')"
+  nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'e' 'e')/$(nvm_wrap_with_color_code 'W' 'W') = $(nvm_wrap_with_color_code 'e' 'light grey') / $(nvm_wrap_with_color_code 'W' 'white')"
+}
+
 nvm_print_color_code() {
   case "${1-}" in
     '0') return 0 ;;
@@ -1360,7 +1428,7 @@ nvm_list_aliases() {
     NVM_HAS_COLORS=1
   fi
 
-  nvm_is_zsh && unsetopt local_options nomatch
+  nvm_is_zsh && setopt local_options nonomatch
   (
     local ALIAS_PATH
     for ALIAS_PATH in "${NVM_ALIAS_DIR}/${ALIAS}"*; do
@@ -1398,6 +1466,23 @@ nvm_list_aliases() {
   return
 }
 
+nvm_print_alias_file() {
+  # a `#` pattern is a repetition operator under zsh's `extendedglob`, so it is
+  # unset for the length of this function and restored by `local_options`
+  nvm_is_zsh && setopt local_options noextendedglob
+
+  local NVM_ALIAS_LINE
+  while IFS= read -r NVM_ALIAS_LINE || [ -n "${NVM_ALIAS_LINE}" ]; do
+    NVM_ALIAS_LINE="${NVM_ALIAS_LINE%%#*}"
+    case "${NVM_ALIAS_LINE}" in
+      *[![:space:]]*) ;;
+      *) continue ;;
+    esac
+    NVM_ALIAS_LINE="${NVM_ALIAS_LINE%"${NVM_ALIAS_LINE##*[![:space:]]}"}"
+    nvm_echo "${NVM_ALIAS_LINE}"
+  done < "$1"
+}
+
 nvm_alias() {
   local ALIAS
   ALIAS="${1-}"
@@ -1428,16 +1513,7 @@ nvm_alias() {
     return 0
   fi
 
-  local NVM_ALIAS_LINE
-  while IFS= read -r NVM_ALIAS_LINE || [ -n "${NVM_ALIAS_LINE}" ]; do
-    NVM_ALIAS_LINE="${NVM_ALIAS_LINE%%#*}"
-    case "${NVM_ALIAS_LINE}" in
-      *[![:space:]]*) ;;
-      *) continue ;;
-    esac
-    NVM_ALIAS_LINE="${NVM_ALIAS_LINE%"${NVM_ALIAS_LINE##*[![:space:]]}"}"
-    nvm_echo "${NVM_ALIAS_LINE}"
-  done < "${NVM_ALIAS_PATH}"
+  nvm_print_alias_file "${NVM_ALIAS_PATH}"
 }
 
 nvm_ls_current() {
@@ -1656,7 +1732,7 @@ nvm_ls() {
     esac
 
     nvm_is_zsh && setopt local_options shwordsplit
-    nvm_is_zsh && unsetopt local_options markdirs
+    nvm_is_zsh && setopt local_options nomarkdirs
 
     local NVM_DIRS_TO_SEARCH1
     NVM_DIRS_TO_SEARCH1=''
@@ -2387,7 +2463,14 @@ nvm_get_mirror() {
   esac
 
 
-  if ! nvm_echo "${NVM_MIRROR}" | command awk '{ if ($0 !~ /^https?:\/\/[a-zA-Z0-9.\/_-]+$/) exit 1 }'; then
+  # Allow RFC 3986 `unreserved` (A-Za-z0-9-._~) plus the authority and path
+  # punctuation a mirror URL legitimately needs: `:` for a port, `@` for
+  # userinfo, `[`/`]` for an IPv6 literal host, `%` for percent-encoding.
+  # `sub-delims` (!$&'()*+,;=) and the query/fragment delimiters (?#) stay out:
+  # nvm appends a path to this value, so a query string could never work anyway,
+  # and several of those characters are shell metacharacters.
+  # Note: in a bracket expression `]` must come first and `-` last to be literal.
+  if ! nvm_echo "${NVM_MIRROR}" | command awk '{ if ($0 !~ /^https?:\/\/[]a-zA-Z0-9._~:\/@%[-]+$/) exit 1 }'; then
       nvm_err '$NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL'
       return 2
   fi
@@ -2794,6 +2877,16 @@ nvm_get_make_jobs() {
     "_aix")
       NVM_CPU_CORES="$(pmcycles -m | wc -l)"
     ;;
+    *)
+      # `_NPROCESSORS_ONLN` is how glibc, FreeBSD, macOS, and Cygwin spell it;
+      # the unprefixed name is what POSIX.1-2024 standardizes, and what NetBSD
+      # and Solaris answer to. Windows shells inherit `NUMBER_OF_PROCESSORS`;
+      # the smallest ones ship neither `getconf` nor `nproc`.
+      NVM_CPU_CORES="$(command getconf _NPROCESSORS_ONLN 2>/dev/null \
+        || command getconf NPROCESSORS_ONLN 2>/dev/null \
+        || command nproc 2>/dev/null \
+        || nvm_echo "${NUMBER_OF_PROCESSORS-}")"
+    ;;
   esac
   if ! nvm_is_natural_num "${NVM_CPU_CORES}"; then
     nvm_err 'Can not determine how many core(s) are available, running in single-threaded mode.'
@@ -3492,17 +3585,7 @@ nvm() {
         nvm_echo '  nvm cache dir                               Display path to the cache directory for nvm'
         nvm_echo '  nvm cache clear                             Empty cache directory for nvm'
         nvm_echo '  nvm set-colors [<color codes>]              Set five text colors using format "yMeBg". Available when supported.'
-        nvm_echo '                                               Initial colors are:'
-        nvm_echo_with_colors "                                                  $(nvm_wrap_with_color_code 'b' 'b')$(nvm_wrap_with_color_code 'y' 'y')$(nvm_wrap_with_color_code 'g' 'g')$(nvm_wrap_with_color_code 'r' 'r')$(nvm_wrap_with_color_code 'e' 'e')"
-        nvm_echo '                                               Color codes:'
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'r' 'r')/$(nvm_wrap_with_color_code 'R' 'R') = $(nvm_wrap_with_color_code 'r' 'red') / $(nvm_wrap_with_color_code 'R' 'bold red')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'g' 'g')/$(nvm_wrap_with_color_code 'G' 'G') = $(nvm_wrap_with_color_code 'g' 'green') / $(nvm_wrap_with_color_code 'G' 'bold green')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'b' 'b')/$(nvm_wrap_with_color_code 'B' 'B') = $(nvm_wrap_with_color_code 'b' 'blue') / $(nvm_wrap_with_color_code 'B' 'bold blue')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'c' 'c')/$(nvm_wrap_with_color_code 'C' 'C') = $(nvm_wrap_with_color_code 'c' 'cyan') / $(nvm_wrap_with_color_code 'C' 'bold cyan')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'm' 'm')/$(nvm_wrap_with_color_code 'M' 'M') = $(nvm_wrap_with_color_code 'm' 'magenta') / $(nvm_wrap_with_color_code 'M' 'bold magenta')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'y' 'y')/$(nvm_wrap_with_color_code 'Y' 'Y') = $(nvm_wrap_with_color_code 'y' 'yellow') / $(nvm_wrap_with_color_code 'Y' 'bold yellow')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'k' 'k')/$(nvm_wrap_with_color_code 'K' 'K') = $(nvm_wrap_with_color_code 'k' 'black') / $(nvm_wrap_with_color_code 'K' 'bold black')"
-        nvm_echo_with_colors "                                                $(nvm_wrap_with_color_code 'e' 'e')/$(nvm_wrap_with_color_code 'W' 'W') = $(nvm_wrap_with_color_code 'e' 'light grey') / $(nvm_wrap_with_color_code 'W' 'white')"
+        nvm_print_color_legend
         nvm_echo 'Example:'
         nvm_echo '  nvm install 8.0.0                     Install a specific version number'
         nvm_echo '  nvm use 8.0                           Use the latest available 8.0.x release'
@@ -4194,7 +4277,7 @@ nvm() {
         fi
       else
         export PATH="${NEWPATH}"
-        \hash -r
+        nvm_hash_reset
         if [ "${NVM_SILENT:-0}" -ne 1 ]; then
           nvm_echo "${NVM_DIR}/*/bin removed from \${PATH}"
         fi
@@ -4207,7 +4290,11 @@ nvm() {
             nvm_err "Could not find ${NVM_DIR}/*/share/man in \${MANPATH}"
           fi
         else
-          export MANPATH="${NEWPATH}"
+          # `man` treats both of these as unset anyway, so leave nothing behind
+          case "${NEWPATH}" in
+            '' | ':') unset MANPATH ;;
+            *) export MANPATH="${NEWPATH}" ;;
+          esac
           if [ "${NVM_SILENT:-0}" -ne 1 ]; then
             nvm_echo "${NVM_DIR}/*/share/man removed from \${MANPATH}"
           fi
@@ -4330,16 +4417,17 @@ nvm() {
       # Change current version
       PATH="$(nvm_change_path "${PATH}" "/bin" "${NVM_VERSION_DIR}")"
       if nvm_has manpath; then
-        if [ -z "${MANPATH-}" ]; then
-          local MANPATH
-          MANPATH=$(manpath)
-        fi
-        # Change current version
-        MANPATH="$(nvm_change_path "${MANPATH}" "/share/man" "${NVM_VERSION_DIR}")"
+        MANPATH="$(nvm_change_path "${MANPATH-}" "/share/man" "${NVM_VERSION_DIR}")"
+        # `man` consults its configured default path only where the list has an
+        # empty entry; a trailing one keeps nvm's directory ahead of it
+        case "${MANPATH}" in
+          :* | *::* | *:) ;;
+          *) MANPATH="${MANPATH}:" ;;
+        esac
         export MANPATH
       fi
       export PATH
-      \hash -r
+      nvm_hash_reset
       export NVM_BIN="${NVM_VERSION_DIR}/bin"
       export NVM_INC="${NVM_VERSION_DIR}/include/node"
       if [ "${NVM_SYMLINK_CURRENT-}" = true ]; then
@@ -4935,17 +5023,18 @@ nvm() {
         nvm_has_solaris_binary nvm_is_merged_node_version \
         nvm_is_natural_num nvm_is_version_installed nvm_validate_install \
         nvm_install_lock_name nvm_acquire_install_lock nvm_release_install_lock \
-        nvm_list_aliases nvm_make_alias nvm_print_alias_path \
+        nvm_list_aliases nvm_make_alias nvm_print_alias_file nvm_print_alias_path \
         nvm_print_default_alias nvm_print_formatted_alias nvm_resolve_local_alias \
         nvm_sanitize_path nvm_has_colors nvm_process_parameters \
         nvm_node_version_has_solaris_binary nvm_iojs_version_has_solaris_binary \
         nvm_curl_libz_support nvm_command_info nvm_is_zsh nvm_stdout_is_terminal \
         nvm_npmrc_bad_news_bears nvm_sanitize_auth_header \
-        nvm_get_colors nvm_set_colors nvm_print_color_code nvm_wrap_with_color_code nvm_format_help_message_colors \
+        nvm_get_colors nvm_set_colors nvm_print_color_code nvm_wrap_with_color_code \
+        nvm_print_color_legend \
         nvm_echo_with_colors nvm_err_with_colors \
         nvm_get_artifact_compression nvm_install_binary_extract nvm_extract_tarball \
         nvm_process_nvmrc nvm_process_nvmrc_content nvm_nvmrc_invalid_msg \
-        nvm_write_nvmrc \
+        nvm_write_nvmrc nvm_hash_reset \
         >/dev/null 2>&1
       unset NVM_NODEJS_ORG_MIRROR NVM_IOJS_ORG_MIRROR NVM_DIR \
         NVM_CD_FLAGS NVM_BIN NVM_INC NVM_MAKE_JOBS NVM_INSTALL_LOCK \

release-notes.sh

@@ -0,0 +1,153 @@
+#!/bin/sh
+
+# Generates release notes for an nvm release, in the format used in the
+# annotated release tags and version bump commits.
+#
+# Usage: ./release-notes.sh <new-version> [<prev-ref>] [<end-ref>]
+#   <new-version>  the version being released, e.g. `v0.40.7` (the leading `v` is optional)
+#   <prev-ref>     list commits since this ref; defaults to the most recent `vX.Y.Z` tag
+#   <end-ref>      list commits up to this ref; defaults to HEAD
+#
+# Commits from <prev-ref> to <end-ref> are grouped into sections by the leading
+# `[bracket]` tag of their subject line, in `git log` order (newest first).
+# Category tags ([New], [Fix], ...) are stripped from the bullet text;
+# context tags ([readme], [actions], [meta], ...) are kept.
+# Commits without a recognized tag land under "Misc", with a warning on stderr.
+#
+# Each bullet gets a ` (#123)` reference to the pull request that introduced
+# the commit, looked up via `gh` from GitHub's commit->PR association, unless
+# the subject already ends with one. Set NVM_RELEASE_NOTES_SKIP_PRS to a
+# nonempty value to skip the lookup (references will be omitted).
+
+NEW_VERSION="${1-}"
+PREV_REF="${2-}"
+END_REF="${3:-HEAD}"
+
+if [ -z "${NEW_VERSION}" ]; then
+  printf >&2 'Usage: %s <new-version> [<prev-ref>] [<end-ref>]\n' "$0"
+  exit 2
+fi
+case "${NEW_VERSION}" in
+  v*) ;;
+  *) NEW_VERSION="v${NEW_VERSION}" ;;
+esac
+
+if [ -z "${PREV_REF}" ]; then
+  PREV_REF="$(git describe --abbrev=0 --tags --match 'v[0-9]*.[0-9]*.[0-9]*')" || {
+    printf >&2 'release-notes: failed to determine the previous version tag.\n'
+    exit 1
+  }
+fi
+for REF in "${PREV_REF}" "${END_REF}"; do
+  git rev-parse --quiet --verify "${REF}^{commit}" >/dev/null || {
+    # shellcheck disable=SC2016
+    printf >&2 'release-notes: `%s` is not a valid ref.\n' "${REF}"
+    exit 1
+  }
+done
+
+LOOKUP_PRS=1
+if [ -n "${NVM_RELEASE_NOTES_SKIP_PRS-}" ]; then
+  LOOKUP_PRS=0
+elif ! command -v gh >/dev/null 2>&1; then
+  # shellcheck disable=SC2016
+  printf >&2 'release-notes: `gh` is not available; PR references will be omitted.\n'
+  LOOKUP_PRS=0
+fi
+
+# the repo to look up commit->PR associations in, e.g. `nvm-sh/nvm`
+REPO_SLUG="${GH_REPO-}"
+if [ -z "${REPO_SLUG}" ]; then
+  ORIGIN_URL="$(git remote get-url origin 2>/dev/null)" || ORIGIN_URL=''
+  case "${ORIGIN_URL}" in
+    *github.com[:/]*) REPO_SLUG="$(printf '%s' "${ORIGIN_URL}" | sed 's#^.*github\.com[:/]##;s#\.git$##')" ;;
+  esac
+fi
+: "${REPO_SLUG:=nvm-sh/nvm}"
+
+TAB="$(printf '\t')"
+
+COMMITS_FILE="$(mktemp)" || exit 1
+GH_ERR_FILE="$(mktemp)" || exit 1
+trap 'rm -f "${COMMITS_FILE}" "${GH_ERR_FILE}"' EXIT
+
+# each line: <section key> TAB <sha> TAB <bullet text>, in git log order
+git log --no-merges --format='%H %s' "${PREV_REF}..${END_REF}" | while IFS=' ' read -r SHA SUBJECT; do
+  LOWERED="$(printf '%s' "${SUBJECT}" | tr '[:upper:]' '[:lower:]')"
+  STRIPPED="${SUBJECT#\[*\] }"
+  case "${LOWERED}" in
+    v[0-9]*.[0-9]*.[0-9]*)
+      case "${SUBJECT}" in
+        *' '*) # not a bump commit, just a subject that starts with a version
+          printf >&2 'release-notes: no category prefix, filing under Misc: %s\n' "${SUBJECT}"
+          KEY='misc' TEXT="${SUBJECT}"
+        ;;
+        *) continue ;; # a version bump commit
+      esac
+    ;;
+    '[new] '*)                          KEY='new'        TEXT="${STRIPPED}" ;;
+    '[fix] '* | '[patch] '*)            KEY='fix'        TEXT="${STRIPPED}" ;;
+    '[refactor] '*)                     KEY='refactor'   TEXT="${STRIPPED}" ;;
+    '[shellcheck] '*)                   KEY='refactor'   TEXT="${SUBJECT}" ;;
+    '[robustness] '*)                   KEY='robustness' TEXT="${STRIPPED}" ;;
+    '[perf] '* | '[performance] '*)     KEY='perf'       TEXT="${STRIPPED}" ;;
+    '[dockerfile] '*)                   KEY='dockerfile' TEXT="${STRIPPED}" ;;
+    '[docs] '* | '[doc] '*)             KEY='docs'       TEXT="${STRIPPED}" ;;
+    '[readme] '*)                       KEY='docs'       TEXT="${SUBJECT}" ;;
+    '[meta] '* | '[security] '* | '[dev deps] '*)
+                                        KEY='misc'       TEXT="${SUBJECT}" ;;
+    '[tests] '* | '[test] '*)           KEY='tests'      TEXT="${STRIPPED}" ;;
+    '[actions] '* | '[debug] '*)        KEY='tests'      TEXT="${SUBJECT}" ;;
+    *)
+      printf >&2 'release-notes: no category prefix, filing under Misc: %s\n' "${SUBJECT}"
+      KEY='misc' TEXT="${SUBJECT}"
+    ;;
+  esac
+  printf '%s\t%s\t%s\n' "${KEY}" "${SHA}" "${TEXT}"
+done > "${COMMITS_FILE}"
+
+if ! [ -s "${COMMITS_FILE}" ]; then
+  printf >&2 'release-notes: no commits found in %s..HEAD.\n' "${PREV_REF}"
+fi
+
+print_section() {
+  if ! grep -q "^$1${TAB}" "${COMMITS_FILE}"; then
+    return 0
+  fi
+  printf '\n%s\n\n' "$2"
+  grep "^$1${TAB}" "${COMMITS_FILE}" | while IFS="${TAB}" read -r _KEY SHA TEXT; do
+    REF=''
+    case "${TEXT}" in
+      *'(#'[0-9]*')') ;; # the subject already carries a reference
+      *)
+        if [ "${LOOKUP_PRS}" = 1 ]; then
+          PR="$(gh api "repos/${REPO_SLUG}/commits/${SHA}/pulls" --jq '.[0].number // empty' 2>"${GH_ERR_FILE}")" || {
+            if grep -q 'No commit found' "${GH_ERR_FILE}"; then
+              PR='' # not pushed to GitHub yet, so it can not have come from a PR
+            else
+              printf >&2 'release-notes: failed to look up the PR for commit %s:\n' "${SHA}"
+              cat >&2 "${GH_ERR_FILE}"
+              exit 1
+            fi
+          }
+          case "${PR}" in
+            '' | *[!0-9]*) ;;
+            *) REF=" (#${PR})" ;;
+          esac
+        fi
+      ;;
+    esac
+    printf ' - %s%s\n' "${TEXT}" "${REF}"
+  done || exit 1
+}
+
+printf '%s\n' "${NEW_VERSION}"
+print_section 'new' 'New Stuff' &&
+print_section 'fix' 'Bug Fixes' &&
+print_section 'refactor' 'Refactors' &&
+print_section 'robustness' 'Robustness' &&
+print_section 'perf' 'Performance' &&
+print_section 'dockerfile' 'Dockerfile' &&
+print_section 'docs' 'Docs' &&
+print_section 'misc' 'Misc' &&
+print_section 'tests' 'Tests'

test/fast/Running 'nvm use' and 'nvm deactivate' with hashing disabled

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# the `bash` shebang is deliberate: only bash can exhibit the bug, so pinning
+# it keeps this meaningful in every job of the shell matrix
+
+die () { echo "$@" ; cleanup ; exit 1; }
+cleanup () {
+  set -h
+  rm -f "${OUTPUT_FILE-}"
+}
+
+export NVM_DIR="$(cd ../.. && pwd)"
+
+: nvm.sh
+\. ../../nvm.sh
+\. ../common.sh
+
+make_fake_node v0.2.3 || die 'unable to make fake node'
+
+OUTPUT_FILE="$(mktemp)"
+
+set +h
+
+# not in a command substitution, so the `PATH` it sets survives to `nvm deactivate`
+nvm use --delete-prefix v0.2.3 > "${OUTPUT_FILE}" 2>&1
+OUTPUT="$(cat "${OUTPUT_FILE}")"
+case "${OUTPUT}" in
+  *'hash: '*) die "nvm use complained about hashing: ${OUTPUT}" ;;
+esac
+case "${OUTPUT}" in
+  *'Now using node v0.2.3'*) ;;
+  *) die "nvm use did not activate v0.2.3: ${OUTPUT}" ;;
+esac
+
+nvm deactivate > "${OUTPUT_FILE}" 2>&1
+OUTPUT="$(cat "${OUTPUT_FILE}")"
+case "${OUTPUT}" in
+  *'hash: '*) die "nvm deactivate complained about hashing: ${OUTPUT}" ;;
+esac
+case "${OUTPUT}" in
+  *'removed from ${PATH}'*) ;;
+  *) die "nvm deactivate did not strip the nvm bin dir: ${OUTPUT}" ;;
+esac
+
+cleanup

test/fast/Running 'nvm use' does not leave a stale hashed node

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+die () { echo "$@" ; exit 1; }
+
+export NVM_DIR="$(cd ../.. && pwd)"
+
+: nvm.sh
+\. ../../nvm.sh
+\. ../common.sh
+
+make_fake_node v0.2.3 || die 'unable to make fake node v0.2.3'
+make_fake_node v0.10.1 || die 'unable to make fake node v0.10.1'
+
+nvm use --delete-prefix v0.2.3 >/dev/null 2>&1 || die 'failed to activate v0.2.3'
+
+# run `node` from this shell, so that the shell caches where it found it
+node >/dev/null 2>&1 || die 'fake node v0.2.3 is not runnable'
+
+nvm use --delete-prefix v0.10.1 >/dev/null 2>&1 || die 'failed to activate v0.10.1'
+
+ACTUAL="$(node)"
+[ "${ACTUAL}" = 'v0.10.1' ] || die "expected node v0.10.1 after switching versions, got '${ACTUAL}'"
+
+nvm deactivate >/dev/null 2>&1 || die 'failed to deactivate'
+
+RESOLVED="$(command -v node || true)"
+case "${RESOLVED}" in
+  "${NVM_DIR}"/*) die "after deactivating, node still resolves inside \${NVM_DIR}: ${RESOLVED}" ;;
+esac

test/fast/Running 'nvm use' should not clobber the default MANPATH

@@ -0,0 +1,68 @@
+#!/bin/sh
+
+set -e
+
+die () { echo "$@" ; exit 1; }
+
+export NVM_DIR="$(cd ../.. && pwd)"
+
+# `--delete-prefix` covers only the npmrc files, so an inherited prefix in the
+# environment would still abort `nvm use`
+unset PREFIX npm_config_prefix NPM_CONFIG_PREFIX
+
+: nvm.sh
+\. ../../nvm.sh
+\. ../common.sh
+
+# the block under test is gated on `nvm_has manpath`, and the Alpine CI images
+# ship no `manpath`; the output is recognizable so that a reintroduced
+# `$(manpath)` call fails the assertions instead of passing vacuously
+manpath() {
+  echo '/usr/share/man'
+}
+
+make_fake_node v0.10.2
+make_fake_node v0.10.3
+
+MAN_2="$(nvm_version_path v0.10.2)/share/man"
+MAN_3="$(nvm_version_path v0.10.3)/share/man"
+
+# nvm has to contribute the empty entry itself when there is nothing to preserve
+unset MANPATH
+nvm use --delete-prefix v0.10.2 --silent || die "Failed to activate v0.10.2"
+[ "${MANPATH}" = "${MAN_2}:" ] || die "MANPATH should be '${MAN_2}:'; got '${MANPATH}'"
+
+nvm deactivate --silent || die "Failed to deactivate v0.10.2"
+[ -z "${MANPATH-}" ] || die "MANPATH should be unset again; got '${MANPATH}'"
+
+# nvm's entry first, the empty entry last: the reverse of what a leading empty
+# entry produces
+MANPATH='/opt/foo/man'
+nvm use --delete-prefix v0.10.2 --silent || die "Failed to activate v0.10.2"
+[ "${MANPATH}" = "${MAN_2}:/opt/foo/man:" ] || die "MANPATH should be '${MAN_2}:/opt/foo/man:'; got '${MANPATH}'"
+
+# switching versions replaces nvm's entry without accruing more empty ones
+nvm use --delete-prefix v0.10.3 --silent || die "Failed to activate v0.10.3"
+[ "${MANPATH}" = "${MAN_3}:/opt/foo/man:" ] || die "MANPATH should be '${MAN_3}:/opt/foo/man:'; got '${MANPATH}'"
+
+nvm use --delete-prefix v0.10.2 --silent || die "Failed to reactivate v0.10.2"
+[ "${MANPATH}" = "${MAN_2}:/opt/foo/man:" ] || die "MANPATH should be '${MAN_2}:/opt/foo/man:'; got '${MANPATH}'"
+
+nvm deactivate --silent || die "Failed to deactivate v0.10.2"
+[ "${MANPATH}" = '/opt/foo/man:' ] || die "MANPATH should be '/opt/foo/man:'; got '${MANPATH}'"
+
+# a value with no empty entry at all still deactivates to nothing
+MANPATH="${MAN_2}"
+nvm deactivate --silent || die "Failed to deactivate v0.10.2"
+[ -z "${MANPATH-}" ] || die "MANPATH should be unset again; got '${MANPATH}'"
+
+# an empty entry the user placed themselves stays where they put it
+for TEST_MANPATH in ':/opt/foo/man' '/opt/foo/man:' '/a/man::/b/man'; do
+  MANPATH="${TEST_MANPATH}"
+
+  nvm use --delete-prefix v0.10.2 --silent || die "Failed to activate v0.10.2 with MANPATH '${TEST_MANPATH}'"
+  [ "${MANPATH}" = "${MAN_2}:${TEST_MANPATH}" ] || die "MANPATH should be '${MAN_2}:${TEST_MANPATH}'; got '${MANPATH}'"
+
+  nvm deactivate --silent || die "Failed to deactivate v0.10.2 with MANPATH '${TEST_MANPATH}'"
+  [ "${MANPATH}" = "${TEST_MANPATH}" ] || die "MANPATH should be '${TEST_MANPATH}'; got '${MANPATH}'"
+done

test/fast/Running 'nvm-exec' should display required node version

@@ -1,14 +1,28 @@
 #!/bin/bash
 
 set -x
+export NVM_DIR="$(cd ../.. && pwd)"
+
+# an ambient value would send nvm-exec down its `NODE_VERSION` branch
+unset NODE_VERSION
+
 : nvm.sh
 \. ../../nvm.sh
 
-cleanup() { rm -f .nvmrc; }
+ORIG_PWD="$(pwd)"
+
+cleanup() {
+  cd "${ORIG_PWD}" 2>/dev/null || true
+  rm -f .nvmrc
+  [ -n "${TMP_DIR-}" ] && rm -rf "${TMP_DIR}"
+}
 die () { echo "$@" ; cleanup ; exit 1; }
 
 NVM_TEST_VERSION=v0.42
 
+HINT="nvm-exec: unable to select a node version
+  Set \`NODE_VERSION\` (e.g. \`NODE_VERSION=default\`), or add an \`.nvmrc\` file."
+
 # Write it to nvmrc
 echo "$NVM_TEST_VERSION" > .nvmrc
 
@@ -17,9 +31,26 @@ EXPECTED="Found '$(pwd)/.nvmrc' with version <${NVM_TEST_VERSION}>
 N/A: version \"${NVM_TEST_VERSION}\" is not yet installed.
 
 You need to run \`nvm install ${NVM_TEST_VERSION}\` to install and use it.
-No NODE_VERSION provided; no .nvmrc file found";
+${HINT}";
 
 # Skip install, we want to test the error message
 [ "${EXPECTED}" = "${OUTPUT}" ] || die "expected >${EXPECTED}<, got >${OUTPUT}<"
 
+rm -f .nvmrc
+
+NVM_EXEC="$(cd ../.. && pwd)/nvm-exec"
+
+# Run from a fresh, empty directory so no ambient .nvmrc above the test dir
+# can satisfy the lookup and mask the hint.
+TMP_DIR="$(mktemp -d)"
+cd "${TMP_DIR}" || die "could not cd to temp dir"
+
+OUTPUT="$("${NVM_EXEC}" node </dev/null 2>&1)";
+EXIT_CODE=$?
+EXPECTED="No version provided and no .nvmrc file found
+${HINT}";
+
+[ "${EXPECTED}" = "${OUTPUT}" ] || die "expected >${EXPECTED}<, got >${OUTPUT}<"
+[ "${EXIT_CODE}" = 127 ] || die "expected exit code 127, got >${EXIT_CODE}<"
+
 cleanup

test/fast/Unit tests/nvm_change_path

@@ -44,6 +44,20 @@ NEW_PATH=`nvm_change_path "$EMPTY_PATH" "/bin" "$NVM_DIR/v0.1.2"`
 [ "$NEW_PATH" = "$NVM_DIR/v0.1.2/bin" ] || die "Not correctly prepended: $NEW_PATH "
 
 
+# empty entries select `man`'s own search path, so they have to survive intact
+MAN_PATH_WITH_EMPTY_ENTRIES=/opt/foo/man::/opt/bar/man:
+
+# New version dir
+NEW_PATH=`nvm_change_path "$MAN_PATH_WITH_EMPTY_ENTRIES" "/share/man" "$NVM_DIR/versions/node/v7.1.0"`
+
+[ "$NEW_PATH" = "$NVM_DIR/versions/node/v7.1.0/share/man:$MAN_PATH_WITH_EMPTY_ENTRIES" ] || die "Not correctly prepended: $NEW_PATH "
+
+# Replacing an existing version dir
+NEW_PATH=`nvm_change_path "$NVM_DIR/versions/node/v4.5.0/share/man::/opt/bar/man:" "/share/man" "$NVM_DIR/versions/node/v7.1.0"`
+
+[ "$NEW_PATH" = "$NVM_DIR/versions/node/v7.1.0/share/man::/opt/bar/man:" ] || die "Not correctly changed: $NEW_PATH "
+
+
 # https://github.com/nvm-sh/nvm/issues/1652#issuecomment-342571223
 MAC_OS_NESTED_SESSION_PATH=/usr/bin:/usr/local/bin:$NVM_DIR/versions/node/v4.5.0/bin
 

test/fast/Unit tests/nvm_compare_checksum

@@ -54,4 +54,6 @@ EXPECTED_OUTPUT='Checksums matched!'
 [ "${CAPTURED_STDERR}" = "${EXPECTED_OUTPUT}" ] || die "expected >${EXPECTED_OUTPUT}<, got >${CAPTURED_STDERR}<"
 [ "${CAPTURED_EXIT_CODE}" = 0 ] || die "expected to exit with code 0, got ${CAPTURED_EXIT_CODE}"
 
+(set +x; nvm_compare_checksum ../../../nvm.sh checksum 2>&-) || die "with stderr closed, expected to exit with code 0, got $?"
+
 cleanup

test/fast/Unit tests/nvm_download wget Authorization header

@@ -39,5 +39,11 @@ NVM_AUTH_HEADER='Bearer test-token' nvm_download "https://nodejs.org/dist/x" -o
 grep -Fxqe '--header' "$ARGV_LOG" || die "wget did not receive --header; got: $(cat "$ARGV_LOG")"
 grep -Fxq 'Authorization: Bearer test-token' "$ARGV_LOG" || die "wget did not receive a well-formed Authorization header; got: $(cat "$ARGV_LOG")"
 
+# given a credential using every character RFC 7235 token68 permits, including '~'
+# when nvm_download uses the wget path
+NVM_AUTH_HEADER='Bearer mF_9.B5f-4.1JqM~+/=' nvm_download "https://nodejs.org/dist/x" -o - || die 'nvm_download (wget) returned nonzero for a token68 credential'
+# then it reaches wget byte-for-byte, with no character silently dropped
+grep -Fxq 'Authorization: Bearer mF_9.B5f-4.1JqM~+/=' "$ARGV_LOG" || die "wget did not receive the token68 credential intact; got: $(cat "$ARGV_LOG")"
+
 cleanup
 echo "nvm_download wget Authorization header: passed"

test/fast/Unit tests/nvm_err

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+die () { echo "$@" ; exit 1; }
+
+: nvm.sh
+\. ../../../nvm.sh
+
+\. ../../common.sh
+
+try_err nvm_err 'an error'
+EXPECTED_OUTPUT='an error'
+[ "${CAPTURED_STDERR}" = "${EXPECTED_OUTPUT}" ] || die "expected >${EXPECTED_OUTPUT}<, got >${CAPTURED_STDERR}<"
+[ "${CAPTURED_EXIT_CODE}" = 0 ] || die "expected to exit with code 0, got ${CAPTURED_EXIT_CODE}"
+
+try_err nvm_err_with_colors 'an error'
+EXPECTED_OUTPUT='an error'
+[ "${CAPTURED_STDERR}" = "${EXPECTED_OUTPUT}" ] || die "expected >${EXPECTED_OUTPUT}<, got >${CAPTURED_STDERR}<"
+[ "${CAPTURED_EXIT_CODE}" = 0 ] || die "expected to exit with code 0, got ${CAPTURED_EXIT_CODE}"
+
+nvm_err 'an error' 2>&- || die "nvm_err with stderr closed exited with code $?"
+nvm_err_with_colors 'an error' 2>&- || die "nvm_err_with_colors with stderr closed exited with code $?"

test/fast/Unit tests/nvm_get_make_jobs

@@ -0,0 +1,147 @@
+#!/bin/sh
+
+# `nvm_get_make_jobs` sets the global `NVM_MAKE_JOBS` instead of echoing it, so
+# every case runs it in this shell, with its output captured to files.
+
+ORIG_PATH="${PATH}"
+TMP_DIR="$(mktemp -d)"
+
+# the probe shims live under `mktemp -d` rather than `.`, because this directory
+# is shared with every other unit test and a leaked `getconf` would poison them
+SHIMS="${TMP_DIR}/bin"
+OUT="${TMP_DIR}/out"
+ERR="${TMP_DIR}/err"
+
+cleanup () {
+  export PATH="${ORIG_PATH}"
+  rm -rf "${TMP_DIR}"
+}
+
+die () { cleanup; echo "$@" ; exit 1; }
+
+: nvm.sh
+\. ../../../nvm.sh
+
+mkdir -p "${SHIMS}"
+
+shim () {
+  {
+    echo '#!/bin/sh'
+    echo "$2"
+  } > "${SHIMS}/$1"
+  chmod +x "${SHIMS}/$1"
+}
+
+# a probe that behaves as if it were not installed, and whose complaint must
+# never reach the user
+shim_absent () {
+  shim "$1" "echo 'PROBE_NOISE: $1' >&2; exit 127"
+}
+
+REAL_OS="$(nvm_get_os)"
+
+FAKE_OS=''
+nvm_get_os () {
+  nvm_echo "${FAKE_OS}"
+}
+
+run () {
+  FAKE_OS="$1"
+  shift
+  NVM_MAKE_JOBS=''
+  nvm_get_make_jobs "$@" >"${OUT}" 2>"${ERR}"
+}
+
+assert_jobs () {
+  [ "_${NVM_MAKE_JOBS}" = "_$1" ] \
+    || die "${2}: expected NVM_MAKE_JOBS ${1}, got '${NVM_MAKE_JOBS}'"
+}
+
+assert_stdout () {
+  ACTUAL="$(cat "${OUT}")"
+  [ "_${ACTUAL}" = "_$1" ] \
+    || die "${2}: expected stdout '${1}', got '${ACTUAL}'"
+}
+
+# deliberately narrower than "stderr is empty": ksh93 has no `local`, so every
+# nvm.sh function already sprays `local: not found` here (see #574)
+assert_no_probe_noise () {
+  ! nvm_grep -q 'PROBE_NOISE' "${ERR}" \
+    || die "${1}: a failed probe leaked to stderr: '$(cat "${ERR}")'"
+}
+
+assert_not_nagged () {
+  ! nvm_grep -q 'Please report an issue on GitHub' "${ERR}" \
+    || die "${1}: unexpected report-an-issue message"
+}
+
+assert_nagged () {
+  nvm_grep -q 'Please report an issue on GitHub' "${ERR}" \
+    || die "${1}: expected the report-an-issue message, got '$(cat "${ERR}")'"
+}
+
+export PATH="${SHIMS}:${ORIG_PATH}"
+
+# an OS the `case` does not name still gets a real core count
+shim getconf 'echo 4'
+shim_absent nproc
+
+run win
+assert_jobs 3 'win'
+assert_stdout 'Detected that you have 4 CPU core(s)
+Running with 3 threads to speed up the build' 'win'
+assert_not_nagged 'win'
+assert_no_probe_noise 'win'
+
+run ''
+assert_jobs 3 'unknown OS'
+assert_not_nagged 'unknown OS'
+
+# Solaris and NetBSD spell the `getconf` variable without the leading underscore
+shim getconf 'case "$1" in NPROCESSORS_ONLN) echo 4 ;; *) exit 1 ;; esac'
+run win
+assert_jobs 3 'unprefixed getconf name'
+assert_not_nagged 'unprefixed getconf name'
+
+# with no `getconf`, `nproc` answers
+shim_absent getconf
+shim nproc 'echo 4'
+run win
+assert_jobs 3 'nproc'
+assert_not_nagged 'nproc'
+assert_no_probe_noise 'nproc'
+
+# Cygwin/MSYS/MinGW inherit `NUMBER_OF_PROCESSORS` from Windows
+shim_absent nproc
+NUMBER_OF_PROCESSORS=4
+run win
+assert_jobs 3 'NUMBER_OF_PROCESSORS'
+assert_not_nagged 'NUMBER_OF_PROCESSORS'
+assert_no_probe_noise 'NUMBER_OF_PROCESSORS'
+
+# with nothing to probe, nvm still says so instead of guessing
+unset NUMBER_OF_PROCESSORS
+run win
+assert_jobs 1 'no probes'
+assert_nagged 'no probes'
+
+# the named arms keep priority: darwin asks `sysctl`, not `getconf`
+shim getconf 'echo 99'
+shim sysctl 'echo 4'
+run darwin
+assert_jobs 3 'darwin uses sysctl'
+assert_not_nagged 'darwin uses sysctl'
+
+export PATH="${ORIG_PATH}"
+
+# an explicit count short-circuits detection entirely
+run '' 7
+assert_jobs 7 'explicit jobs'
+assert_stdout 'number of `make` jobs: 7' 'explicit jobs'
+
+# on the real host, detected or not, the result is always usable
+run "${REAL_OS}"
+nvm_is_natural_num "${NVM_MAKE_JOBS}" \
+  || die "real host: expected a natural number, got '${NVM_MAKE_JOBS}'"
+
+cleanup

test/fast/Unit tests/nvm_get_mirror

@@ -52,3 +52,26 @@ testMirrors 'not a url'
 testMirrors 'ftp://wrong-scheme'
 testMirrors 'http://'
 testMirrors 'javascript:alert(1)'
+
+# a query string can never work, since nvm appends a path to the mirror
+testMirrors 'https://nodejs.org/dist?token=abc'
+testMirrors 'https://nodejs.org/dist#frag'
+
+testAcceptedMirrors() {
+  NVM_NODEJS_ORG_MIRROR="${1-}"
+  [ "$(nvm_get_mirror node std)" = "${1-}" ] || die "NVM_NODEJS_ORG_MIRROR should accept ${1-}"
+  unset NVM_NODEJS_ORG_MIRROR
+
+  NVM_IOJS_ORG_MIRROR="${1-}"
+  [ "$(nvm_get_mirror iojs std)" = "${1-}" ] || die "NVM_IOJS_ORG_MIRROR should accept ${1-}"
+  unset NVM_IOJS_ORG_MIRROR
+}
+
+# a private mirror on a non-default port is a URL, and must not be rejected
+testAcceptedMirrors 'https://mirror.internal:8443/dist'
+testAcceptedMirrors 'http://localhost:8080/dist'
+# an IPv6 literal host, userinfo, percent-encoding, and `~` are all legal too
+testAcceptedMirrors 'http://[::1]:8080/dist'
+testAcceptedMirrors 'https://user:pw@nexus.corp.example.com/repository/nodejs-dist'
+testAcceptedMirrors 'https://mirror.internal/a%20b/dist'
+testAcceptedMirrors 'https://mirror.internal/~dist'

test/fast/Unit tests/nvm_hash_reset

@@ -0,0 +1,27 @@
+#!/bin/sh
+
+die () { echo "$@" ; exit 1; }
+
+: nvm.sh
+\. ../../../nvm.sh
+
+# also covers #3247, where `command hash -r` found a `hash` binary, not the builtin
+OUTPUT="$(nvm_hash_reset 2>&1)"
+RC=$?
+[ ${RC} -eq 0 ] || die "nvm_hash_reset returned ${RC}: ${OUTPUT}"
+[ -z "${OUTPUT}" ] || die "nvm_hash_reset was not silent: ${OUTPUT}"
+
+# bash is the only supported shell that can turn hashing off
+if [ -n "${BASH_VERSION-}" ]; then
+  set +h
+  OUTPUT="$(nvm_hash_reset 2>&1)"
+  RC=$?
+  set -h
+  [ ${RC} -eq 0 ] || die "with hashing disabled, nvm_hash_reset returned ${RC}: ${OUTPUT}"
+  [ -z "${OUTPUT}" ] || die "with hashing disabled, nvm_hash_reset was not silent: ${OUTPUT}"
+
+  ls >/dev/null 2>&1
+  hash -t ls >/dev/null 2>&1 || die 'expected `ls` to be hashed'
+  nvm_hash_reset || die 'with hashing enabled, nvm_hash_reset failed'
+  ! hash -t ls >/dev/null 2>&1 || die 'nvm_hash_reset did not clear the hash table'
+fi

test/fast/Unit tests/nvm_print_alias_file

@@ -0,0 +1,53 @@
+#!/bin/sh
+
+die () { echo "$@" ; cleanup ; exit 1; }
+
+cleanup () {
+  rm -rf "${TEST_DIR-}"
+  unset TEST_DIR OUTPUT EXPECTED
+}
+
+: nvm.sh
+\. ../../../nvm.sh
+
+TEST_DIR="${PWD}/nvm_print_alias_file_tmp"
+mkdir -p "${TEST_DIR}" || die 'failed to create test dir'
+
+printf 'v0.10 # inline comment\n' > "${TEST_DIR}/inline"
+OUTPUT="$(nvm_print_alias_file "${TEST_DIR}/inline")"
+[ "_${OUTPUT}" = '_v0.10' ] || die "inline comment not stripped; got '${OUTPUT}'"
+
+printf '# leading comment\nv0.11\n' > "${TEST_DIR}/comment-first"
+OUTPUT="$(nvm_print_alias_file "${TEST_DIR}/comment-first")"
+[ "_${OUTPUT}" = '_v0.11' ] || die "comment-only line not skipped; got '${OUTPUT}'"
+
+printf 'v0.12\t \nv0.13\n' > "${TEST_DIR}/trailing-space"
+OUTPUT="$(nvm_print_alias_file "${TEST_DIR}/trailing-space")"
+EXPECTED="$(printf 'v0.12\nv0.13')"
+[ "_${OUTPUT}" = "_${EXPECTED}" ] || die "trailing whitespace not stripped, or a line was dropped; got '${OUTPUT}'"
+
+printf '\n   \n\t\n# only a comment\n' > "${TEST_DIR}/nothing-usable"
+OUTPUT="$(nvm_print_alias_file "${TEST_DIR}/nothing-usable")"
+[ "_${OUTPUT}" = '_' ] || die "blank and comment-only lines should produce no output; got '${OUTPUT}'"
+
+nvm_print_alias_file "${TEST_DIR}/nothing-usable" >/dev/null 2>&1 \
+  || die 'a file with no usable lines should still exit zero'
+
+printf 'v0.14' > "${TEST_DIR}/no-trailing-newline"
+OUTPUT="$(nvm_print_alias_file "${TEST_DIR}/no-trailing-newline")"
+[ "_${OUTPUT}" = '_v0.14' ] || die "a final line with no trailing newline should be read; got '${OUTPUT}'"
+
+# a `#` pattern is a repetition operator under zsh's `extendedglob`, which is what
+# made `nvm_alias` print nothing at all: https://github.com/nvm-sh/nvm/issues/3885
+if [ -n "${ZSH_VERSION-}" ]; then
+  setopt extendedglob || die 'enabling extendedglob failed'
+  OUTPUT="$(nvm_print_alias_file "${TEST_DIR}/inline")"
+  [ "_${OUTPUT}" = '_v0.10' ] || die "with extendedglob set, expected 'v0.10', got '${OUTPUT}'"
+  [[ -o extendedglob ]] || die 'nvm_print_alias_file left extendedglob unset'
+
+  unsetopt extendedglob
+  nvm_print_alias_file "${TEST_DIR}/inline" > /dev/null
+  [[ -o extendedglob ]] && die 'nvm_print_alias_file left extendedglob set'
+fi
+
+cleanup

test/fast/Unit tests/nvm_print_color_legend

@@ -0,0 +1,197 @@
+#!/bin/sh
+
+ONESHOT=''
+cleanup () {
+  if [ -n "${ONESHOT}" ]; then
+    command rm -f "${ONESHOT}"
+  fi
+}
+die () { echo "$@" ; cleanup ; exit 1; }
+
+\. ../../../nvm.sh
+
+set -e
+
+# assert about nvm, not about the caller's environment
+NVM_HAS_COLORS_WAS="${NVM_HAS_COLORS-}"
+unset NVM_HAS_COLORS
+
+ESC="$(printf '\033')"
+# The legend's letters are wrapped in color codes when the terminal supports
+# them, so every text assertion below compares against the output with any
+# escapes removed. That keeps these checks about structure and alignment only.
+strip_colors() { command sed "s/${ESC}\[[0-9;]*m//g"; }
+
+# Exact whole-line match against an already-captured string. Deliberately
+# pipe-free: `grep -q` exits at its first match and hands SIGPIPE to whatever
+# feeds it, which BSD sed swallows but GNU sed reports as "couldn't flush
+# stdout", polluting the test's stderr.
+contains_line () {
+  case "
+${2}
+" in
+    *"
+${1}
+"*) return 0 ;;
+  esac
+  return 1
+}
+
+# This test file is itself an executable named `nvm_print_color_legend`, so a
+# plain `command -v` keeps finding it long after the function is gone. Emptying
+# `PATH` for the lookup is the only reliable way to ask about the function
+# alone: filtering on a `/` is not enough, because dash and zsh report a bare
+# name for a current-directory match reached through an empty `PATH` component.
+is_function () {
+  [ -n "$(PATH=/nonexistent command -v "${1}" 2>/dev/null)" ]
+}
+
+is_function nvm_print_color_legend \
+  || die 'nvm_print_color_legend is not defined'
+
+OUTPUT="$(nvm_print_color_legend)"
+
+LINES="$(nvm_echo "${OUTPUT}" | command wc -l | command tr -d ' ')"
+[ "${LINES}" = 11 ] || die "expected 11 legend lines, got ${LINES}: ${OUTPUT}"
+
+PLAIN="$(nvm_echo "${OUTPUT}" | strip_colors)"
+
+# the two labels are literal, and their indentation lines the legend up under
+# the `nvm set-colors` entry in the help output
+contains_line '                                               Initial colors are:' "${PLAIN}" \
+  || die "the 'Initial colors are:' label is missing or misaligned: ${PLAIN}"
+contains_line '                                               Color codes:' "${PLAIN}" \
+  || die "the 'Color codes:' label is missing or misaligned: ${PLAIN}"
+
+# the default-palette sample, indented one level deeper than its label
+contains_line '                                                  bygre' "${PLAIN}" \
+  || die "the initial-colors sample is missing or misaligned: ${PLAIN}"
+
+# all eight rows of the code table, in order, each with both letter forms
+for ROW in \
+  'r/R = red / bold red' \
+  'g/G = green / bold green' \
+  'b/B = blue / bold blue' \
+  'c/C = cyan / bold cyan' \
+  'm/M = magenta / bold magenta' \
+  'y/Y = yellow / bold yellow' \
+  'k/K = black / bold black' \
+  'e/W = light grey / white' \
+; do
+  contains_line "                                                ${ROW}" "${PLAIN}" \
+    || die "color code row '${ROW}' is missing or misaligned: ${PLAIN}"
+done
+
+# the extracted function has to stay wired into the help output
+HELP_PLAIN="$(nvm --help | strip_colors)"
+contains_line '                                               Color codes:' "${HELP_PLAIN}" \
+  || die 'nvm --help no longer includes the color legend'
+
+# --- the fix: colors have to survive command substitution ------------------
+
+# the bug condition: inside `$( )`, `[ -t 1 ]` sees the capture pipe, so
+# `nvm_has_colors` always fails
+nvm_has_colors () { return 1; }
+
+WRAPPED="$(nvm_wrap_with_color_code 'b' 'b')"
+case "${WRAPPED}" in
+  *"${ESC}"*) die "expected plain text when colors are unsupported, got >${WRAPPED}<" ;;
+esac
+
+NVM_HAS_COLORS=1
+export NVM_HAS_COLORS
+WRAPPED="$(nvm_wrap_with_color_code 'b' 'b')"
+[ "${WRAPPED}" = "${ESC}[0;34mb${ESC}[0m" ] \
+  || die "expected a colored 'b' with NVM_HAS_COLORS=1, got >${WRAPPED}<"
+
+WRAPPED="$(nvm_wrap_with_color_code 'X' 'X')"
+[ "${WRAPPED}" = 'X' ] \
+  || die "expected plain text for an unknown color code, got >${WRAPPED}<"
+unset NVM_HAS_COLORS
+
+# `0` is what the resolving callers start from, so it must not read as truthy
+NVM_HAS_COLORS=0
+export NVM_HAS_COLORS
+WRAPPED="$(nvm_wrap_with_color_code 'b' 'b')"
+case "${WRAPPED}" in
+  *"${ESC}"*) die "NVM_HAS_COLORS=0 must not enable colors, got >${WRAPPED}<" ;;
+esac
+unset NVM_HAS_COLORS
+
+UNSUPPORTED="$(nvm_print_color_legend)"
+case "${UNSUPPORTED}" in
+  *"${ESC}"*) die "the legend emitted colors while unsupported: ${UNSUPPORTED}" ;;
+esac
+
+# Model the real asymmetry: yes to the first, direct call, no to every later
+# one. The state has to live in a file, because each `$( )` is a fresh subshell
+# that would take its own copy of an in-shell counter and answer yes every time.
+ONESHOT="$(command mktemp)"
+oneshot_reset () { nvm_echo 0 > "${ONESHOT}"; }
+nvm_has_colors () {
+  if [ "$(command cat "${ONESHOT}")" = 0 ]; then
+    nvm_echo 1 > "${ONESHOT}"
+    return 0
+  fi
+  return 1
+}
+
+oneshot_reset
+COLORED_OUTPUT="$(nvm_print_color_legend)"
+# `grep -c` drains its input, so it cannot SIGPIPE its producer
+COLORED="$(nvm_echo "${COLORED_OUTPUT}" | nvm_grep -c "${ESC}" || true)"
+[ "${COLORED}" = 9 ] \
+  || die "expected all 9 legend lines colored, got ${COLORED}: ${COLORED_OUTPUT}"
+
+# the sample specifically, which is the case #3896 reports
+case "${COLORED_OUTPUT}" in
+  *"${ESC}[0;34mb${ESC}[0m${ESC}[0;33my${ESC}[0m"*) : ;;
+  *) die "the initial-colors sample was not colored: ${COLORED_OUTPUT}" ;;
+esac
+
+# in a substitution, so `nvm_set_colors`' `export NVM_COLORS` stays contained
+oneshot_reset
+SET_COLORS_OUTPUT="$(nvm_set_colors 'bygre')"
+case "${SET_COLORS_OUTPUT}" in
+  *"${ESC}"*) : ;;
+  *) die "nvm_set_colors did not color its confirmation line: ${SET_COLORS_OUTPUT}" ;;
+esac
+
+# coloring must change only the escapes, never the text or the alignment
+COLORED_STRIPPED="$(nvm_echo "${COLORED_OUTPUT}" | strip_colors)"
+[ "${COLORED_STRIPPED}" = "${PLAIN}" ] \
+  || die 'the colored legend does not match the plain legend once escapes are stripped'
+
+# called directly rather than in a substitution, so a leak is observable at all
+oneshot_reset
+nvm_print_color_legend >/dev/null
+[ -z "${NVM_HAS_COLORS-}" ] \
+  || die "nvm_print_color_legend leaked NVM_HAS_COLORS=${NVM_HAS_COLORS}"
+
+# And `nvm unload` has to clean it up, the way it does its sibling helpers.
+# `set +e` inside the subshell so a non-zero `nvm unload` cannot abort it before
+# the lookup runs; its status is reported separately, so "unload failed" can
+# never be misreported as "the function survived".
+UNLOAD_OUT="$(
+  set +e
+  nvm unload >/dev/null 2>&1
+  # plain `echo`: `nvm unload` has just unset `nvm_echo`
+  echo "unload_rc=$?"
+  if is_function nvm_print_color_legend; then
+    echo present
+  else
+    echo gone
+  fi
+)"
+case "${UNLOAD_OUT}" in
+  *gone*) : ;;
+  *) die "nvm unload did not remove nvm_print_color_legend (${UNLOAD_OUT})" ;;
+esac
+
+if [ -n "${NVM_HAS_COLORS_WAS}" ]; then
+  NVM_HAS_COLORS="${NVM_HAS_COLORS_WAS}"
+  export NVM_HAS_COLORS
+fi
+
+cleanup
+echo "nvm_print_color_legend: passed"

test/fast/Unit tests/nvm_sanitize_auth_header

@@ -35,4 +35,18 @@ case "${RESULT}" in
     ;;
 esac
 
+# Test 6: every character of RFC 7235 §2.1 `token68` is preserved.
+# token68 = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"="
+# This is a superset of both base64 and base64url; note the '~', which no
+# base64 variant emits but which an opaque token may legitimately contain.
+TOKEN68="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/="
+RESULT=$(nvm_sanitize_auth_header "${TOKEN68}")
+[ "${RESULT}" = "${TOKEN68}" ] || die "FAIL: token68 chars were stripped. Got: '${RESULT}'"
+
+# Test 7: the RFC 6750 §2.1 example Bearer token, extended with the remaining
+# valid `b64token` characters, survives intact.
+B64TOKEN="Bearer mF_9.B5f-4.1JqM~+/="
+RESULT=$(nvm_sanitize_auth_header "${B64TOKEN}")
+[ "${RESULT}" = "${B64TOKEN}" ] || die "FAIL: b64token chars were stripped. Got: '${RESULT}'"
+
 echo "All nvm_sanitize_auth_header tests passed"

test/fast/Unit tests/nvm_tree_contains_path

@@ -29,4 +29,11 @@ nvm_tree_contains_path tmp2 tmp2/node || die '"tmp2" should contain "tmp2/node"'
 
 nvm_tree_contains_path tmp2 tmp/node && die '"tmp2" should not contain "tmp/node"'
 
+nvm_tree_contains_path tmp/ tmp/node || die '"tmp/" should contain "tmp/node"'
+nvm_tree_contains_path tmp// tmp/node || die '"tmp//" should contain "tmp/node"'
+nvm_tree_contains_path / /tmp/node || die '"/" should contain "/tmp/node"'
+
+nvm_tree_contains_path "tmp[glob]" "tmp[glob]/node" || die '"tmp[glob]" should contain "tmp[glob]/node"'
+nvm_tree_contains_path "tmp" "tmp[glob]/node" && die '"tmp" should not contain "tmp[glob]/node"'
+
 cleanup

test/fast/Unit tests/zsh options survive nvm_list_aliases and nvm_ls

@@ -0,0 +1,54 @@
+#!/bin/sh
+
+die () { echo "$@" ; cleanup ; exit 1; }
+
+cleanup () {
+  rm -rf "${TEST_DIR-}"
+  unset TEST_DIR NVM_DIR
+}
+
+: nvm.sh
+\. ../../../nvm.sh
+
+\. ../../common.sh
+
+# `local_options` is zsh-only, so no other shell can regress this
+[ -n "${ZSH_VERSION-}" ] || exit 0
+
+# an isolated NVM_DIR with a single known version, so that ambient versions
+# and aliases can not affect any assertions. `alias/lts` is deliberately absent:
+# globbing it is why `nvm_list_aliases` has to suppress `nomatch` at all.
+TEST_DIR="${PWD}/nvm_zsh_options_tmp"
+mkdir -p "${TEST_DIR}/alias" "${TEST_DIR}/versions/node/v24.13.0/bin" || die 'failed to create test dirs'
+make_echo "${TEST_DIR}/versions/node/v24.13.0/bin/node" 'v24.13.0' || die 'failed to create test node binary'
+echo '24' > "${TEST_DIR}/alias/default" || die 'failed to create default alias'
+NVM_DIR="${TEST_DIR}"
+
+setopt nomatch
+unsetopt markdirs
+unsetopt shwordsplit
+
+nvm_list_aliases >/dev/null 2>&1
+[[ -o nomatch ]] || die 'nvm_list_aliases left nomatch unset'
+
+nvm alias >/dev/null 2>&1
+[[ -o nomatch ]] || die '"nvm alias" left nomatch unset'
+
+nvm ls >/dev/null 2>&1
+[[ -o nomatch ]] || die '"nvm ls" left nomatch unset'
+
+# called directly rather than in a command substitution, so that anything
+# `nvm_ls` fails to restore is visible here
+nvm_ls 24 >/dev/null 2>&1
+[[ -o markdirs ]] && die 'nvm_ls left markdirs set'
+[[ -o shwordsplit ]] && die 'nvm_ls left shwordsplit set'
+
+# and the inverse: a caller that wants these on has to get them back
+setopt markdirs
+setopt shwordsplit
+
+nvm_ls 24 >/dev/null 2>&1
+[[ -o markdirs ]] || die 'nvm_ls left markdirs unset'
+[[ -o shwordsplit ]] || die 'nvm_ls left shwordsplit unset'
+
+cleanup

test/sourcing/Sourcing nvm.sh with zsh extendedglob should use the default

@@ -0,0 +1,33 @@
+#!/bin/sh
+
+die () { echo "$@" ; exit 1; }
+
+\. ../common.sh
+
+# `#` is a pattern operator only under zsh's `extendedglob`
+[ -n "${ZSH_VERSION-}" ] || exit 0
+
+# We need to unload nvm again first, as by the time this test is run,
+# despite being unloaded in setup, the inherited PATH still contains
+# an nvm-installed node version. `nvm unload` unsets NVM_DIR, so cache it.
+\. ../../nvm.sh || die 'sourcing returned nonzero exit code'
+NVM_DIR_CACHED="${NVM_DIR}"
+nvm unload || die 'unloading returned nonzero exit code'
+NVM_DIR="${NVM_DIR_CACHED}"
+
+# the comment is the point: stripping it is what needs a `#` pattern
+echo '0.10.1 # comment' > "${NVM_DIR}/alias/default" || die 'creation of default alias failed'
+
+setopt extendedglob || die 'enabling extendedglob failed'
+
+\. ../../nvm.sh || die 'sourcing returned nonzero exit code'
+
+[[ -o extendedglob ]] || die 'sourcing nvm.sh disabled extendedglob'
+
+NVM_LS_CURRENT_NOT_GREPPED="$(nvm ls current | strip_colors)"
+NVM_LS_CURRENT="$(nvm ls current | strip_colors | \grep -o 'v0\.10\.1')"
+[ "_${NVM_LS_CURRENT}" = '_v0.10.1' ] || die "'nvm ls current' did not return '-> v0.10.1', got '${NVM_LS_CURRENT_NOT_GREPPED}'"
+
+NVM_ALIAS_DEFAULT="$(nvm alias default | strip_colors)"
+[ "_${NVM_ALIAS_DEFAULT}" = '_default -> 0.10.1 (-> v0.10.1 *)' ] \
+  || die "'nvm alias default' did not return 'default -> 0.10.1 (-> v0.10.1 *)', got '${NVM_ALIAS_DEFAULT}'"