Jordan Harband e780535240 [Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER ...

curl 7.58.0 and later drop a custom Authorization header when a redirect leads to another host,
but wget sends `--header` along to every redirect target,
so on a machine without curl,
a mirror that redirected elsewhere handed the credential to that other host.

When a header is sent with GNU Wget,
run it with `--max-redirect=0`.
When it then exits with 8
(an HTTP error, which includes a redirect it did not follow),
read the `Location` with one more request,
and re-request it only if it keeps the same scheme,
host, and port, up to 20 times.
A redirect to another origin,
including a downgrade to `http`,
fails with exit code 8 and an error that names the URL nvm requested and suggests curl.
`--max-redirect` is not a BusyBox wget option,
so other wgets are invoked as before;
the README says so

Discovered by Anthropic's OSS Scanner, as ANT-2026-PKUZHTT3; the scanner reported it as a vulnerability, but it is not one.

2026-10-23 08:53:59 -07:00

..

mocks

[New] nvm ls-remote: annotate versions with the node alias and local aliases

2026-09-23 21:35:43 +00:00

assert_not_ok

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

assert_ok

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

bash_completion lists alias and version names without expanding them

[Fix] bash_completion: list alias and version names without expanding them

2026-10-22 20:10:42 -07:00

make_echo

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

mirror URL credentials are masked in output

[Fix] nvm_download_artifact, nvm debug: mask credentials in mirror URLs when printing them

2026-10-23 08:53:59 -07:00

nvm install --offline

[Tests] run every remaining test file: exec bits, fixes; add check-exec to CI

2026-07-09 22:40:07 -07:00

nvm install -b

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm install -s and -b conflict

[Fix] nvm install: fix nvm err typo to nvm_err for -s/-b conflict

2026-03-14 09:38:04 -07:00

nvm install NVM_NO_SOURCE_FALLBACK

[New] nvm install: add NVM_NO_SOURCE_FALLBACK to disable the source fallback

2026-07-24 10:54:17 -07:00

nvm install validates an inherited NVM_MAKE_JOBS

[Fix] nvm install: validate an inherited NVM_MAKE_JOBS like -j

2026-10-22 20:10:42 -07:00

nvm install verifies the installed version

[Robustness] nvm install: reject a structurally broken installed version

2026-07-24 10:51:53 -07:00

nvm install with nonlowercase LTS name

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm ls-remote

[New] nvm ls-remote: annotate versions with the node alias and local aliases

2026-09-23 21:35:43 +00:00

nvm ls-remote aliases

[New] nvm ls-remote: annotate versions with the node alias and local aliases

2026-09-23 21:35:43 +00:00

nvm ls-remote with nounset should not fail

[Fix] avoid an unbound variable

2026-05-15 23:08:37 -07:00

nvm set_colors

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm use skips re-resolving an exact installed version

[Perf] nvm use: skip re-resolving an exact, installed version

2026-10-01 09:51:16 +05:30

nvm version-remote

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_acquire_install_lock

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_add_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_alias handles comments

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias LTS-N

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias path traversal

[Fix] nvm_alias, nvm_version_path: reject .. path components

2026-09-21 10:01:34 +08:00

nvm_alias_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_auth_header_applies_to

[Fix] nvm_download: only send $NVM_AUTH_HEADER to URLs under a mirror it applies to

2026-10-23 08:53:59 -07:00

nvm_auto use with a prerelease default

[Fix] nvm exec/nvm run: do not treat filenames with digits as versions

2026-09-28 15:05:28 +09:00

nvm_cd

[Fix] nvm_cd: bypass a user-defined cd function

2026-10-09 21:16:17 -07:00

nvm_change_path

[Fix] nvm use: do not clobber man's default search path

2026-09-08 11:01:03 -07:00

nvm_change_path special characters

[Fix] nvm use: handle regex-special characters in $NVM_DIR

2026-10-01 16:35:00 +05:00

nvm_check_for_help

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_clang_version

Add nvm_clang_version to ensure clang version > 3.5

2016-11-14 12:28:41 +08:00

nvm_command_info

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_compare_checksum

[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed

2026-09-04 14:08:01 -07:00

nvm_compute_checksum

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_curl_libz_support

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_curl_use_compression

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_curl_version

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_die_on_prefix

[Perf] nvm_npmrc_bad_news_bears: scan npmrc files without forking grep

2026-10-06 14:01:11 -03:00

nvm_download

[Tests] nvm_download: point the httpbin Authorization check at a configured mirror

2026-10-23 08:53:59 -07:00

nvm_download and curl helpers bypass shadowed curl

[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable

2026-07-08 13:03:16 -07:00

nvm_download and nvm_get_latest pass -q to curl first

[Fix] nvm_download, nvm_get_latest, install.sh: pass -q to curl first, so .curlrc is ignored again

2026-10-23 08:53:58 -07:00

nvm_download Authorization header only goes to the mirror

[Fix] nvm_download: only send $NVM_AUTH_HEADER to URLs under a mirror it applies to

2026-10-23 08:53:59 -07:00

nvm_download no eval injection

[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands

2026-06-02 17:41:44 -07:00

nvm_download wget Authorization header

[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68

2026-09-02 19:36:04 -07:00

nvm_download wget follows only same-origin redirects with Authorization header

[Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER

2026-10-23 08:53:59 -07:00

nvm_download_artifact

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_download_artifact error propagation

[Fix] nvm_download_artifact: fix error propagation from subshells

2026-03-14 14:30:31 -07:00

nvm_download_artifact keeps downloader output off stdout

[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache

2026-10-23 08:53:58 -07:00

nvm_download_artifact version injection

[Fix] nvm_download_artifact: reject version strings with disallowed characters

2026-06-03 13:09:07 -07:00

nvm_echo

[Perf] nvm_echo: use the printf shell builtin under zsh

2026-10-06 17:54:48 -03:00

nvm_ensure_default_set

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ensure_version_installed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ensure_version_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_err

[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed

2026-09-04 14:08:01 -07:00

nvm_extract_tarball

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_find_project_dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_find_up

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_format_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_arch

[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a

2026-10-06 14:23:02 -03:00

nvm_get_arch alpine

[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a

2026-10-06 14:23:02 -03:00

nvm_get_arch_unofficial

[Tests] nvm_get_arch_unofficial: set NVM_DIR when sourcing nvm.sh in the chroots

2026-10-23 08:53:59 -07:00

nvm_get_artifact_compression

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_checksum

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_get_checksum awk injection

[Fix] nvm_get_checksum: pass the tarball name to awk as data, not program text

2026-06-03 13:11:26 -07:00

nvm_get_checksum_alg

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_checksum_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_colors

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_default_packages

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_default_packages mawk compat

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_download_slug

[Fix] install: use darwin-x64 for all binary on mac for node < v16

2025-11-16 14:48:10 +05:30

nvm_get_latest missing curl or wget

[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable

2026-07-08 13:03:16 -07:00

nvm_get_make_jobs

[Fix] nvm_is_natural_num: reject anything but digits

2026-10-22 20:10:42 -07:00

nvm_get_minor_version

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_get_mirror

[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding

2026-09-02 19:40:47 -07:00

nvm_get_os

[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a

2026-10-06 14:23:02 -03:00

nvm_has

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_colors

[Fix] nvm_has_colors: also check if stdout is a terminal

2026-01-27 10:31:07 -08:00

nvm_has_italics

[New] add nvm_has_italics, to detect terminal italics support via terminfo

2026-09-29 17:08:36 +09:00

nvm_has_non_aliased

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_solaris_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_system_iojs

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_system_node

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_hash_reset

[Fix] nvm_hash_reset: only run hash -r where the shell supports it

2026-09-04 09:16:10 -07:00

nvm_install_binary and nvm_install_source do not remove an inherited TMPDIR

[Fix] nvm install: do not remove the caller's TMPDIR after a failed download

2026-10-05 10:02:48 -07:00

nvm_install_binary and nvm_install_source only use a tarball from the cache

[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache

2026-10-23 08:53:58 -07:00

nvm_install_binary_extract

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_install_binary_extract self-heals a broken version dir

[Robustness] nvm_install_binary_extract: replace a broken version dir atomically

2026-07-24 10:50:47 -07:00

nvm_install_binary_nosource

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

nvm_install_latest_npm

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_install_lock_name

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_install_no_progress_bar

[Tests] make the fast suite pass on macOS

2026-09-30 16:09:09 +09:00

nvm_install_source SHELL override

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_iojs_version_has_solaris_binary

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

nvm_is_alias

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_cached_artifact

[Fix] nvm_install_binary, nvm_install_source: only use a tarball that nvm_download_artifact put in the cache

2026-10-23 08:53:58 -07:00

nvm_is_installed_exact_version

[Perf] nvm use: skip re-resolving an exact, installed version

2026-10-01 09:51:16 +05:30

nvm_is_iojs_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_merged_node_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_natural_num

[Fix] nvm_is_natural_num: reject anything but digits

2026-10-22 20:10:42 -07:00

nvm_is_valid_version

[Perf] nvm_is_valid_version, nvm_validate_implicit_alias: avoid forks

2026-10-06 18:01:38 -03:00

nvm_is_version_installed

[Fix] nvm_is_version_installed: fail when nvm_version_path fails

2026-10-22 20:10:42 -07:00

nvm_ls handles hash in pattern

[Tests] nvm_ls handles hash in pattern: fix cleanup, isolate NVM_DIR, cover the sed path

2026-07-08 23:14:23 -07:00

nvm_ls matches patterns literally

[Fix] nvm_ls: match the version pattern literally

2026-10-22 20:10:42 -07:00

nvm_ls_current

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls_remote

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_ls_remote LTS aliases

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls_remote LTS codename traversal

[Robustness] reject unsafe LTS alias names from a mirror's index.tab

2026-07-15 13:46:52 -07:00

nvm_ls_remote nightly

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_ls_remote_iojs

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_make_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_node_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_node_version_has_solaris_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_normalize_lts

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_num_version_groups

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_offline_version

[Fix] nvm_ls_cached: include source-cached and io.js artifacts

2026-07-09 22:35:15 -07:00

nvm_print_alias_file

[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file

2026-09-03 20:54:28 -07:00

nvm_print_alias_path

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_color_code

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_print_color_legend

[Tests] nvm_print_color_legend: look up the function with PATH emptied

2026-09-03 15:12:34 -07:00

nvm_print_default_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_implicit_alias errors

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_implicit_alias success

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_print_npm_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_process_nvmrc

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_process_nvmrc_content rejects control characters

[Fix] nvm_process_nvmrc_content: reject control characters

2026-10-23 08:53:59 -07:00

nvm_rc_version errors when no version and no .nvmrc

[Fix] nvm_rc_version: clarify error when no version and no .nvmrc

2026-06-10 15:16:23 -07:00

nvm_release_install_lock

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_remote_version

[Fix] nvm_remote_versions: only consult io.js's version list for majors 1 through 3

2026-10-23 08:53:59 -07:00

nvm_remote_versions

[Fix] nvm_remote_versions: only consult io.js's version list for majors 1 through 3

2026-10-23 08:53:59 -07:00

nvm_remote_versions propagates iojs failure

[Fix] nvm_ls_remote_combined: propagate iojs remote listing failures

2026-03-14 09:39:20 -07:00

nvm_sanitize_auth_header

[Fix] nvm_sanitize_auth_header: strip newlines, so wrapped base64 credentials work

2026-10-22 20:10:42 -07:00

nvm_sanitize_path special characters

[Fix] nvm use: handle regex-special characters in $NVM_DIR

2026-10-01 16:35:00 +05:00

nvm_sanitize_url

[Fix] nvm_download_artifact, nvm debug: mask credentials in mirror URLs when printing them

2026-10-23 08:53:59 -07:00

nvm_stdout_is_terminal

[actions] migrate Travis CI tests to GitHub Actions

2026-01-27 10:31:07 -08:00

nvm_strip_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_strip_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_supports_xz

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_tree_contains_path

[Fix] Handle filesystem identity when checking path containment

2026-09-11 16:49:46 +08:00

nvm_url_origin

[Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER

2026-10-23 08:53:59 -07:00

nvm_use_if_needed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_validate_implicit_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_validate_install

[Robustness] nvm install: reject a structurally broken installed version

2026-07-24 10:51:53 -07:00

nvm_version

[Perf] nvm_version: resolve an exact, installed version without nvm_ls

2026-10-06 12:43:22 -03:00

nvm_version_dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_version_greater

[Perf] nvm_version_greater, nvm_version_greater_than_or_equal_to: avoid awk where possible

2026-10-07 15:30:01 -03:00

nvm_version_greater_than_or_equal_to

[Tests] add unit coverage for nvm_version_greater_than_or_equal_to

2026-10-03 12:49:00 +05:30

nvm_version_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_wget_is_gnu

[Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER

2026-10-23 08:53:59 -07:00

nvm_wget_same_origin

[Fix] nvm_download: with GNU Wget, follow only same-origin redirects when sending $NVM_AUTH_HEADER

2026-10-23 08:53:59 -07:00

nvm_wrap_with_color_code

[Refactor] add nvm_wrap_with_color_code; allow no color code

2022-10-13 20:16:42 -07:00

nvm_write_nvmrc

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

release-notes.sh replaces control characters in commit subjects

[meta] release-notes.sh: replace control characters in commit subjects

2026-10-23 08:53:58 -07:00

Running 'nvm install --save' works as expected'

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --save' works as expected'

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --save' works with a .nvmrc in the parent dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --silent --save' doesn't output anything

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

security_wget_injection

[Fix] auth header: Add all valid base64 chars to sanitize function

2026-05-25 11:14:39 +10:00

zsh options survive nvm_list_aliases and nvm_ls

[Fix] zsh: restore nomatch and markdirs rather than clobbering them

2026-09-03 20:44:59 -07:00