Jordan Harband 8610e1578d [Fix] nvm_process_nvmrc_content: reject control characters ...

An `.nvmrc` line containing a control character
(eg, an escape, a bell, or a carriage return in the middle of the version)
was accepted as-is,
so the raw bytes were passed along as the version and printed verbatim in the "Found '…' with version <…>" and "N/A: version … is not yet installed" messages,
garbling the terminal output.

Any line that still contains a control character other than a tab,
after comments and leading and trailing white space are removed,
now makes the file invalid.
CRLF line endings keep working,
since the trailing carriage return is trimmed as white space before the check.
The "non-commented content parsed" part of the invalid `.nvmrc` message now shows each control character
(other than tabs and newlines) as `?`,
so it prints as plain text

Discovered by Anthropic's OSS Scanner, as ANT-2026-R3FR49Z7; the scanner reported it as a vulnerability, but it is not one.

2026-10-23 08:53:59 -07:00

..

mocks

[New] nvm ls-remote: annotate versions with the node alias and local aliases

2026-09-23 21:35:43 +00:00

assert_not_ok

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

assert_ok

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

bash_completion lists alias and version names without expanding them

[Fix] bash_completion: list alias and version names without expanding them

2026-10-22 20:10:42 -07:00

make_echo

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

mirror URL credentials are masked in output

[Fix] nvm_download_artifact, nvm debug: mask credentials in mirror URLs when printing them

2026-10-23 08:53:59 -07:00

nvm install --offline

[Tests] run every remaining test file: exec bits, fixes; add check-exec to CI

2026-07-09 22:40:07 -07:00

nvm install -b

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm install -s and -b conflict

[Fix] nvm install: fix nvm err typo to nvm_err for -s/-b conflict

2026-03-14 09:38:04 -07:00

nvm install NVM_NO_SOURCE_FALLBACK

[New] nvm install: add NVM_NO_SOURCE_FALLBACK to disable the source fallback

2026-07-24 10:54:17 -07:00

nvm install validates an inherited NVM_MAKE_JOBS

[Fix] nvm install: validate an inherited NVM_MAKE_JOBS like -j

2026-10-22 20:10:42 -07:00

nvm install verifies the installed version

[Robustness] nvm install: reject a structurally broken installed version

2026-07-24 10:51:53 -07:00

nvm install with nonlowercase LTS name

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm ls-remote

[New] nvm ls-remote: annotate versions with the node alias and local aliases

2026-09-23 21:35:43 +00:00

nvm ls-remote aliases

[New] nvm ls-remote: annotate versions with the node alias and local aliases

2026-09-23 21:35:43 +00:00

nvm ls-remote with nounset should not fail

[Fix] avoid an unbound variable

2026-05-15 23:08:37 -07:00

nvm set_colors

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm use skips re-resolving an exact installed version

[Perf] nvm use: skip re-resolving an exact, installed version

2026-10-01 09:51:16 +05:30

nvm version-remote

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_acquire_install_lock

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_add_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_alias handles comments

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias LTS-N

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias path traversal

[Fix] nvm_alias, nvm_version_path: reject .. path components

2026-09-21 10:01:34 +08:00

nvm_alias_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_auto use with a prerelease default

[Fix] nvm exec/nvm run: do not treat filenames with digits as versions

2026-09-28 15:05:28 +09:00

nvm_cd

[Fix] nvm_cd: bypass a user-defined cd function

2026-10-09 21:16:17 -07:00

nvm_change_path

[Fix] nvm use: do not clobber man's default search path

2026-09-08 11:01:03 -07:00

nvm_change_path special characters

[Fix] nvm use: handle regex-special characters in $NVM_DIR

2026-10-01 16:35:00 +05:00

nvm_check_for_help

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_clang_version

Add nvm_clang_version to ensure clang version > 3.5

2016-11-14 12:28:41 +08:00

nvm_command_info

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_compare_checksum

[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed

2026-09-04 14:08:01 -07:00

nvm_compute_checksum

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_curl_libz_support

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_curl_use_compression

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_curl_version

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_die_on_prefix

[Perf] nvm_npmrc_bad_news_bears: scan npmrc files without forking grep

2026-10-06 14:01:11 -03:00

nvm_download

[Tests] reduce CI flakiness from transient Docker registry failures

2026-06-03 13:12:31 -07:00

nvm_download and curl helpers bypass shadowed curl

[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable

2026-07-08 13:03:16 -07:00

nvm_download and nvm_get_latest pass -q to curl first

[Fix] nvm_download, nvm_get_latest, install.sh: pass -q to curl first, so .curlrc is ignored again

2026-10-23 08:53:58 -07:00

nvm_download no eval injection

[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands

2026-06-02 17:41:44 -07:00

nvm_download wget Authorization header

[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68

2026-09-02 19:36:04 -07:00

nvm_download_artifact

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_download_artifact error propagation

[Fix] nvm_download_artifact: fix error propagation from subshells

2026-03-14 14:30:31 -07:00

nvm_download_artifact keeps downloader output off stdout

[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache

2026-10-23 08:53:58 -07:00

nvm_download_artifact version injection

[Fix] nvm_download_artifact: reject version strings with disallowed characters

2026-06-03 13:09:07 -07:00

nvm_echo

[Perf] nvm_echo: use the printf shell builtin under zsh

2026-10-06 17:54:48 -03:00

nvm_ensure_default_set

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ensure_version_installed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ensure_version_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_err

[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed

2026-09-04 14:08:01 -07:00

nvm_extract_tarball

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_find_project_dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_find_up

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_format_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_arch

[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a

2026-10-06 14:23:02 -03:00

nvm_get_arch alpine

[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a

2026-10-06 14:23:02 -03:00

nvm_get_arch_unofficial

[Tests] make the fast suite pass on macOS

2026-09-30 16:09:09 +09:00

nvm_get_artifact_compression

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_checksum

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_get_checksum awk injection

[Fix] nvm_get_checksum: pass the tarball name to awk as data, not program text

2026-06-03 13:11:26 -07:00

nvm_get_checksum_alg

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_checksum_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_colors

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_default_packages

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_default_packages mawk compat

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_download_slug

[Fix] install: use darwin-x64 for all binary on mac for node < v16

2025-11-16 14:48:10 +05:30

nvm_get_latest missing curl or wget

[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable

2026-07-08 13:03:16 -07:00

nvm_get_make_jobs

[Fix] nvm_is_natural_num: reject anything but digits

2026-10-22 20:10:42 -07:00

nvm_get_minor_version

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_get_mirror

[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding

2026-09-02 19:40:47 -07:00

nvm_get_os

[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a

2026-10-06 14:23:02 -03:00

nvm_has

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_colors

[Fix] nvm_has_colors: also check if stdout is a terminal

2026-01-27 10:31:07 -08:00

nvm_has_italics

[New] add nvm_has_italics, to detect terminal italics support via terminfo

2026-09-29 17:08:36 +09:00

nvm_has_non_aliased

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_solaris_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_system_iojs

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_system_node

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_hash_reset

[Fix] nvm_hash_reset: only run hash -r where the shell supports it

2026-09-04 09:16:10 -07:00

nvm_install_binary and nvm_install_source do not remove an inherited TMPDIR

[Fix] nvm install: do not remove the caller's TMPDIR after a failed download

2026-10-05 10:02:48 -07:00

nvm_install_binary and nvm_install_source only use a tarball from the cache

[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache

2026-10-23 08:53:58 -07:00

nvm_install_binary_extract

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_install_binary_extract self-heals a broken version dir

[Robustness] nvm_install_binary_extract: replace a broken version dir atomically

2026-07-24 10:50:47 -07:00

nvm_install_binary_nosource

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

nvm_install_latest_npm

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_install_lock_name

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_install_no_progress_bar

[Tests] make the fast suite pass on macOS

2026-09-30 16:09:09 +09:00

nvm_install_source SHELL override

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_iojs_version_has_solaris_binary

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

nvm_is_alias

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_cached_artifact

[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache

2026-10-23 08:53:58 -07:00

nvm_is_installed_exact_version

[Perf] nvm use: skip re-resolving an exact, installed version

2026-10-01 09:51:16 +05:30

nvm_is_iojs_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_merged_node_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_natural_num

[Fix] nvm_is_natural_num: reject anything but digits

2026-10-22 20:10:42 -07:00

nvm_is_valid_version

[Perf] nvm_is_valid_version, nvm_validate_implicit_alias: avoid forks

2026-10-06 18:01:38 -03:00

nvm_is_version_installed

[Fix] nvm_is_version_installed: fail when nvm_version_path fails

2026-10-22 20:10:42 -07:00

nvm_ls handles hash in pattern

[Tests] nvm_ls handles hash in pattern: fix cleanup, isolate NVM_DIR, cover the sed path

2026-07-08 23:14:23 -07:00

nvm_ls matches patterns literally

[Fix] nvm_ls: match the version pattern literally

2026-10-22 20:10:42 -07:00

nvm_ls_current

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls_remote

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_ls_remote LTS aliases

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls_remote LTS codename traversal

[Robustness] reject unsafe LTS alias names from a mirror's index.tab

2026-07-15 13:46:52 -07:00

nvm_ls_remote nightly

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_ls_remote_iojs

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_make_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_node_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_node_version_has_solaris_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_normalize_lts

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_num_version_groups

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_offline_version

[Fix] nvm_ls_cached: include source-cached and io.js artifacts

2026-07-09 22:35:15 -07:00

nvm_print_alias_file

[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file

2026-09-03 20:54:28 -07:00

nvm_print_alias_path

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_color_code

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_print_color_legend

[Tests] nvm_print_color_legend: look up the function with PATH emptied

2026-09-03 15:12:34 -07:00

nvm_print_default_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_implicit_alias errors

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_implicit_alias success

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_print_npm_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_process_nvmrc

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_process_nvmrc_content rejects control characters

[Fix] nvm_process_nvmrc_content: reject control characters

2026-10-23 08:53:59 -07:00

nvm_rc_version errors when no version and no .nvmrc

[Fix] nvm_rc_version: clarify error when no version and no .nvmrc

2026-06-10 15:16:23 -07:00

nvm_release_install_lock

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_remote_version

[Fix] nvm_remote_version: match the requested version as a whole version component

2026-10-22 20:10:42 -07:00

nvm_remote_versions

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_remote_versions propagates iojs failure

[Fix] nvm_ls_remote_combined: propagate iojs remote listing failures

2026-03-14 09:39:20 -07:00

nvm_sanitize_auth_header

[Fix] nvm_sanitize_auth_header: strip newlines, so wrapped base64 credentials work

2026-10-22 20:10:42 -07:00

nvm_sanitize_path special characters

[Fix] nvm use: handle regex-special characters in $NVM_DIR

2026-10-01 16:35:00 +05:00

nvm_sanitize_url

[Fix] nvm_download_artifact, nvm debug: mask credentials in mirror URLs when printing them

2026-10-23 08:53:59 -07:00

nvm_stdout_is_terminal

[actions] migrate Travis CI tests to GitHub Actions

2026-01-27 10:31:07 -08:00

nvm_strip_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_strip_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_supports_xz

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_tree_contains_path

[Fix] Handle filesystem identity when checking path containment

2026-09-11 16:49:46 +08:00

nvm_use_if_needed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_validate_implicit_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_validate_install

[Robustness] nvm install: reject a structurally broken installed version

2026-07-24 10:51:53 -07:00

nvm_version

[Perf] nvm_version: resolve an exact, installed version without nvm_ls

2026-10-06 12:43:22 -03:00

nvm_version_dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_version_greater

[Perf] nvm_version_greater, nvm_version_greater_than_or_equal_to: avoid awk where possible

2026-10-07 15:30:01 -03:00

nvm_version_greater_than_or_equal_to

[Tests] add unit coverage for nvm_version_greater_than_or_equal_to

2026-10-03 12:49:00 +05:30

nvm_version_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_wrap_with_color_code

[Refactor] add nvm_wrap_with_color_code; allow no color code

2022-10-13 20:16:42 -07:00

nvm_write_nvmrc

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

release-notes.sh replaces control characters in commit subjects

[meta] release-notes.sh: replace control characters in commit subjects

2026-10-23 08:53:58 -07:00

Running 'nvm install --save' works as expected'

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --save' works as expected'

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --save' works with a .nvmrc in the parent dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --silent --save' doesn't output anything

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

security_wget_injection

[Fix] auth header: Add all valid base64 chars to sanitize function

2026-05-25 11:14:39 +10:00

zsh options survive nvm_list_aliases and nvm_ls

[Fix] zsh: restore nomatch and markdirs rather than clobbering them

2026-09-03 20:44:59 -07:00