Jordan Harband 70fb4ede6b [Fix] nvm_download_artifact: reject version strings with disallowed characters ...

The mirror-supplied (untrusted) version flows into download URLs,
filesystem paths, and the checksum awk match.
Reject any version outside the node/io.js grammar
(`[0-9A-Za-z._+-]`) before it is used.
A blocklist of metacharacters is used rather than a strict semver allowlist so RCs, nightlies, v8-canary, and io.js versions still install.

Completes the remediation of GHSA-3c52-35h2-gfmm.

2026-06-03 13:09:07 -07:00

..

Aliases

[Fix] nvm_normalize_lts: only reject uppercase for LTS names, not regular aliases

2026-03-26 10:18:40 -07:00

Listing paths

[patch] show system Node.js version in nvm ls

2026-01-25 18:19:50 +08:00

Listing versions

[patch] show system Node.js version in nvm ls

2026-01-25 18:19:50 +08:00

Set Colors

[Fix] nvm_has_colors: also check if stdout is a terminal

2026-01-27 10:31:07 -08:00

Unit tests

[Fix] nvm_download_artifact: reject version strings with disallowed characters

2026-06-03 13:09:07 -07:00

nvm should remove the last trailing slash in $NVM_DIR

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm alias' should create a file in the alias directory

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm current' should display current nvm environment

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm deactivate' should unset the nvm environment variables

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm install' with '--reinstall-packages-from' requires a valid version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm install' with an invalid version fails nicely

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm unalias' should remove the alias file

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm uninstall' should clean up aliases pointing to uninstalled version

[Fix] nvm uninstall: fix alias cleanup glob expansion

2026-03-14 14:34:06 -07:00

Running 'nvm uninstall' should remove the appropriate directory

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm uninstall' with an inferred version shows the inferred message

Improve uninstall error message for missing versions

2026-01-30 00:04:01 +08:00

Running 'nvm uninstall' with an uninstalled version shows the requested version

Improve uninstall error message for missing versions

2026-01-30 00:04:01 +08:00

Running 'nvm uninstall' with incorrect file permissions fails nicely

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm unload' should unset all function and variables

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use foo' where 'foo' is circular aborts

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

Running 'nvm use iojs' uses latest io.js version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use system' should work as expected

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use x' should create and change the 'current' symlink

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use x' should not create the 'current' symlink if $NVM_SYMLINK_CURRENT is false

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use' should drop CR char automatically

[Refactor] nvm_rc_version: use fd 3 instead of exported env var for multiple return

2026-03-12 15:32:17 -04:00

Running 'nvm use' should respect alias pointing to system

[patch] show system Node.js version in nvm ls

2026-01-25 18:19:50 +08:00

Running 'nvm use' should respect system in .nvmrc

[patch] show system Node.js version in nvm ls

2026-01-25 18:19:50 +08:00

Running 'nvm which' with circular alias shows alias name

[Fix] nvm which: show alias name in infinite loop error message

2026-03-14 14:37:57 -07:00

Running 'nvm-exec' should display required node version

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

setup

[Tests] use -ex option during tests when possible

2016-07-10 19:58:32 -07:00

setup_dir

[Tests] use -ex option during tests when possible

2016-07-10 19:58:32 -07:00

Sourcing nvm.sh should make the nvm command available

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Sourcing nvm.sh should not modify parameters of caller

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

teardown

[Tests] use -ex option during tests when possible

2016-07-10 19:58:32 -07:00

teardown_dir

[Tests] use -ex option during tests when possible

2016-07-10 19:58:32 -07:00