2448 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Jordan HarbandandElan Ruusamäe	b1b3a0038c	[Fix] nvm_cd: bypass a user-defined cd function ... `\cd` only bypasses aliases, so a user-defined `cd` function (eg, cdhist's) still ran, and broke `NVM_DIR` auto-detection when it rejected zsh's `-q`. Use `command cd`, which skips functions in POSIX shells. zsh's `command` runs `/usr/bin/cd` instead of the builtin, so use `builtin cd` there, as `nvm_echo` does for `printf`. `nvm_die_on_prefix` also now uses `nvm_cd` instead of a bare `cd`. Fixes #3835. See #3836. Co-authored-by: Elan Ruusamäe <glen@delfi.ee>	2026-10-09 21:16:17 -07:00
clifennelandJordan Harband	6dc3765f6b	[readme] Fix a Docker warning from using Docker installation instructions ... Fix a LegacyKeyValueFormat warning when building a Docker image using the 'Installing In Docker' instructions. The warning fixed is: `LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format` See: [LegacyKeyValueFormat](https://docs.docker.com/reference/build-checks/legacy-key-value-format/) Co-authored-by: clifennel <li.chr+github@northeastern.edu> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-15 21:28:51 -07:00
Jordan Harband	5c05fb659c	[actions] cache container images, verified against digests looked up live ... Each container job now looks up the image's index, manifest, and config digests from the registry, keys an `actions/cache` entry on the config digest, and only uses a cached image if its ID matches one of those digests; otherwise it is discarded and the image is pulled (with retries) instead. A poisoned or stale cache entry can therefore never be used, and a cache hit needs only a couple of small manifest requests, so this scales regardless of pull rate limits.	2026-10-09 14:14:20 -07:00
Jordan Harband	37be73f11d	[actions] pull container images through Google's Docker Hub mirror ... DockerHub's anonymous pull rate limit applies per IP for hours, so retrying cannot ride it out on shared runners; `mirror.gcr.io` serves the same official images without that limit, as the io.js source-install job already does.	2026-10-09 14:04:54 -07:00
Saadanjum0	906fb605bc	[Fix] nvm use: handle regex-special characters in $NVM_DIR ... nvm_change_path interpolated `$NVM_DIR` and the new version dir unescaped into grep and sed expressions, so a path containing `&`, `#`, `[`, `*`, etc. corrupted `$PATH` (or made sed fail) when switching versions. Escape them before use.	2026-10-01 16:35:00 +05:00
lazerg	e45c2df7c0	[Fix] install.sh: start a new line before appending to a profile that does not end with one ... Fixes #3951	2026-10-08 18:50:50 +05:00
Cassidy Marble	d55a55c387	[Perf] nvm_version_greater, nvm_version_greater_than_or_equal_to: avoid awk where possible	2026-10-07 15:30:01 -03:00
Cassidy Marble	9c8cac4a2e	[Perf] nvm_is_valid_version, nvm_validate_implicit_alias: avoid forks	2026-10-06 18:01:38 -03:00
Cassidy Marble	66640e6000	[Perf] nvm_echo: use the printf shell builtin under zsh ... In zsh, `command printf` skips the builtin and forks `/usr/bin/printf`.	2026-10-06 17:54:48 -03:00
Cassidy Marble	1dd1d8c82e	[Perf] nvm_get_os: read /etc/os-release instead of forking uname -a ... The file is read, not sourced. An `ID` with no OS of its own is only taken as Linux when the kernel's `ostype` says so; otherwise `uname -a` decides.	2026-10-06 14:23:02 -03:00
Cassidy Marble	c28f2b70db	[Perf] nvm_npmrc_bad_news_bears: scan npmrc files without forking grep	2026-10-06 14:01:11 -03:00
Cassidy Marble	f296b8d210	[Perf] nvm_die_on_prefix: detect the OS only when it is needed	2026-10-06 14:00:46 -03:00
Cassidy Marble	c7ba8d2106	[Perf] nvm_version: resolve an exact, installed version without nvm_ls ... An alias of the same name still takes precedence, as it does in `nvm_ls`.	2026-10-06 12:43:22 -03:00
Cassidy Marble	d211d5fdb8	[Perf] nvm_is_version_installed: check the modern layout's path before the full lookup	2026-10-06 12:43:22 -03:00
Hridhin Varkey Joseph	913b8cb625	[Perf] nvm_resolve_local_alias: skip nvm_version for an exact, installed version ... See #3416	2026-10-04 02:22:58 +05:30
Hridhin Varkey Joseph	f1f3d463ab	[Perf] nvm use: skip re-resolving an exact, installed version ... When `nvm use` is given an exact `vX.Y.Z` that is already installed, and no alias with that exact name exists, use it directly instead of re-resolving it through `nvm_match_version` and `nvm_ensure_version_installed`, both of which call `nvm_version`. `nvm_auto` takes this path on every shell startup with an already-resolved version, so this removes ~95ms from each new shell (~330ms -> ~235ms in a clean environment on macOS/zsh). Fixes #3930	2026-10-01 09:51:16 +05:30
Jordan Harband	077156e88f	[actions] never let an apt install wait on a prompt ... Moving WSL package installs out of `setup-wsl`'s `additional-packages` lost its non-interactive setup: on Ubuntu 18.04, upgrading `libssl1.1` asks whether to restart services, and the job waited on that dialog until it was cancelled. Set `DEBIAN_FRONTEND=noninteractive`, keep existing config files without asking, and give apt no stdin.	2026-10-08 11:10:27 -07:00
Jordan Harband	50e73c4cd5	[actions] retry apt package installs through Ubuntu mirror outages ... Mirror outages have outlasted the existing retries, which covered only `apt-get update` (and not the WSL `additional-packages` install). Installs now go through `.github/scripts/apt-install.sh`, which retries each request within apt and retries the whole update+install with backoff for about 10 minutes.	2026-10-07 15:10:36 -07:00
Hridhin Varkey Joseph	ed1b96f5db	[readme] explain the misleading npm install error from npm run test/fast	2026-10-04 00:49:18 +05:30
Shrikant	5326eaab9d	[Tests] add unit coverage for nvm_version_greater_than_or_equal_to	2026-10-03 12:49:00 +05:30
Hridhin Varkey Joseph	a27fb0bd78	[Tests] add unit tests for nvm_version_greater_than_or_equal_to	2026-10-03 11:51:31 +05:30
Mingyang Wu	cb96d2a56a	[Fix] Handle filesystem identity when checking path containment ... Fixes #1049. Assisted-by: OpenAI GPT-6 <noreply@openai.com>	2026-09-11 16:49:46 +08:00
Jordan Harband	46ca42f939	[Tests] nvm install --reinstall-packages-from: mock the remote version instead of fetching it	2026-10-05 10:52:19 -07:00
Jordan Harband	52a1e55574	[actions] run the fast suite on macOS and WSL too ... macOS covers a case-insensitive filesystem and bash 3.2 (`/bin/sh`, `/bin/bash`); WSL covers Windows. Both run it as the Linux jobs do: without a system node, with a PTY, and on WSL as a non-root user with passwordless sudo.	2026-09-30 16:12:14 +09:00
Jordan Harband	79bc9b90dd	[Tests] make the fast suite pass on macOS ... - `nvm_get_arch`: the unmocked smartos cases fall through to the host, so only run them on x86_64 - `nvm_get_arch_unofficial`: the chroot checks need x86_64 glibc Linux - `nvm_install_no_progress_bar`: derive the tarball slug and checksum tool instead of assuming linux-x64 and `sha256sum`	2026-09-30 16:09:09 +09:00
Jordan Harband	e2f57b733f	[Fix] nvm alias: do not drop output from background jobs on bash 3.2 ... bash 3.2 (macOS `/bin/bash` and `/bin/sh`) exec-optimizes a trailing `command` call inside a function run as a background job, which silently drops the output of nested command substitutions; in `nvm alias` that lost installed-alias colors and some default aliases, Running each job in an explicit subshell avoids it.	2026-09-30 15:56:49 +09:00
Jordan Harband	0add6b8555	[Fix] nvm: do not change or export the caller's IFS ... `IFS=... nvm "$@"` is a prefix assignment to a function call, which bash's POSIX mode (macOS `/bin/sh`) keeps after the call returns, and exports.	2026-09-30 15:50:38 +09:00
Jordan Harband	3bfc2b4a9a	[actions] rename windows-npm workflow to windows-nvm, since it tests nvm install	2026-09-30 15:25:38 +09:00
Jordan Harband	04ac3f2a83	[Fix] nvm install: do not remove the caller's TMPDIR after a failed download ... `nvm_install_binary` and `nvm_install_source` declared `local TMPDIR` without initializing it, and remove it with `rm -rf` on failure. dash's `local` keeps the caller's value, as does bash's when `TMPDIR` is passed as a prefix assignment (`TMPDIR=… nvm install`), so a failed download removed the caller's temp directory; on macOS, `tar` instead blocked reading the archive from the terminal.	2026-10-05 10:02:48 -07:00
Ben YounesandJordan Harband	a8bb497400	[New] nvm ls-remote: annotate versions with the node alias and local aliases ... Fixes #2786. Ben Younes added the alias annotations to bare `nvm ls-remote`, with their regression tests; Jordan Harband moved `(Latest: node)` onto the newest node release, gave each kind of annotation a fixed column so the output can be sliced with `cut`, matched aliases to versions in one pass, and kept local aliases out of the mocks and tests. Co-authored-by: Ben Younes <2910651+ousamabenyounes@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-23 21:35:43 +00:00
Jordan Harband	04fbd9570c	[New] add nvm_has_italics, to detect terminal italics support via terminfo	2026-09-29 17:08:36 +09:00
Jordan Harband	09822033d2	[Fix] nvm exec/nvm run: do not treat filenames with digits as versions ... `nvm_is_valid_version` accepted strings like `123.js`, `v1.js`, and `1.2.3.4.5.6.js`, because `nvm_version_greater_than_or_equal_to` exits as soon as the first number is greater than zero, without looking at the rest. So `nvm run 123.js` failed with `N/A: version "v123.js" is not yet installed` instead of running the file. It now checks the shape first: one to three dot-separated numbers, optionally with a trailing dot, and a prerelease suffix (rc, nightly, v8-canary, test builds) only after a full `x.y.z`. A suffix with a dot followed by a non-digit, like a file extension, is rejected, so names like `1.2.3-foo.js` are treated as files too. Every version listed in the nodejs.org and iojs.org `index.tab` files is still accepted, so shell startup keeps using a `default` alias that resolves to an installed prerelease. Names that are also valid versions, like `123` or `v1`, are still treated as versions; `nvm run current 123` runs such a file. Refs #1166. See #3931.	2026-09-28 15:05:28 +09:00
Jordan Harband	a885b885fe	v0.40.8 ... Bug Fixes - `nvm_alias`, `nvm_version_path`: reject `..` path components - `nvm_get_make_jobs`: count cores on platforms the `case` does not name - `nvm-exec`: improve the no-version failure message - `nvm use`: do not clobber `man`'s default search path (#3890) - `nvm_err`, `nvm_err_with_colors`: do not fail when stderr is closed (#3907) - `nvm_hash_reset`: only run `hash -r` where the shell supports it - `nvm_alias`: unset zsh's `extendedglob` while reading an alias file (#3891) - zsh: restore `nomatch` and `markdirs` rather than clobbering them - `nvm --help`: render the set-colors legend in color (#3915) - `nvm unload`: drop the undefined `nvm_format_help_message_colors` - `nvm_get_mirror`: allow ports, userinfo, IPv6 hosts, and percent-encoding - `nvm_sanitize_auth_header`: allow `~`, completing RFC 7235 `token68` (#3751) Refactors - `nvm --help`: extract the set-colors legend into `nvm_print_color_legend` Performance - Optimize nvm_tree_contains_path with in-memory POSIX parent-walk (#3912) Docs - [readme] document platforms with no official node binaries - `install.sh`: Fix missing words in bash/zsh completion message (#3887) - Remove stray closing HTML tag (#3919) Misc - [meta] remove CLAUDE.md symlink in favor of AGENTS.md (#3928) - [meta] add `release-notes.sh`, the release notes generator Tests - homebrew/actions changed their default branch - [actions] WSL: pin every distribution, and test the newest of each line - `nvm_print_color_legend`: look up the function with `PATH` emptied - `nvm_print_color_legend`: check for the function, not a same-named file - `nvm_print_color_legend`: fix the `fast` suite on GNU userlands - [actions] `release.yml`: provide `GH_TOKEN` so release-notes PR lookup can run v0.40.8	2026-09-21 10:23:47 +08:00
Jordan Harband	072622c748	[Fix] nvm_alias, nvm_version_path: reject .. path components ... `nvm_alias` concatenated the requested name onto `$NVM_DIR/alias` and read whatever that resolved to, so a name with a `..` component escaped the alias dir - under the default layout, `../../.npmrc` reaches `$HOME/.npmrc`. `nvm_print_alias_file` echoes every non-comment line of what it opens, and `nvm use` reports the first one in its "is not yet installed" error, so an untrusted `.nvmrc` could disclose any file the invoking user can read. The write side already rejected `..` in an alias name (9275c5ba); apply the same check on the read side, and to `nvm_version_path`, which composes a version into a path with no check of its own. Slashes stay legal, since `lts/iron` and the `lts/*` alias file depend on them.	2026-09-21 10:01:34 +08:00
Jarren San Jose	60a8da7a8e	[meta] remove CLAUDE.md symlink in favor of AGENTS.md ... Claude Code now reads AGENTS.md directly when a project has no CLAUDE.md, so the root CLAUDE.md symlink pointing at AGENTS.md is redundant.	2026-09-18 16:33:51 -07:00
Jordan Harband	5267556406	[Tests] homebrew/actions changed their default branch	2026-09-21 09:17:45 +08:00
Jordan Harband	a4f801ed72	[Fix] nvm_get_make_jobs: count cores on platforms the case does not name ... `nvm_get_os` also returns `win` (Cygwin/MSYS/MinGW) and the empty string, neither of which had an arm, so `NVM_CPU_CORES` went unassigned and nvm asked the user to report a gap it already knew about. On an unrecognized `uname` that also meant a single-threaded source build; `win` refuses source builds a few lines later either way. `NUMBER_OF_PROCESSORS` comes last because Windows scopes it to the calling process' processor group. Assigning `NVM_CPU_CORES` in every arm also keeps the `nvm_is_natural_num` check below from aborting dash and ksh under `set -u`.	2026-09-10 17:08:50 -07:00
Jordan Harband	7fc22fc9c7	[readme] document platforms with no official node binaries ... The README never said which platforms nvm can detect but nodejs.org does not build for, so a user on one of them only finds out from a slow, silent, source-build fallback. Also corrects the Alpine section: nvm remaps Alpine to a musl arch itself now, and nodejs.org has published `linux-x64-musl` since v24.20.0, so both the "no concrete plans" and the "does not exist errors" claims are out of date. Coverage bounds are stated per release line rather than per patch, since the newest of them are still shipping.	2026-09-10 17:11:20 -07:00
Hashim Khan	b6d7823bce	[Docs] install.sh: Fix missing words in bash/zsh completion message ... When profile detection fails, the completion hint omitted "correct file" between "to the" and "if you are using". Fixes #3528	2026-07-23 08:24:46 +05:00
dajiaohuang	3fb99c652b	[Docs] Remove stray closing HTML tag	2026-09-10 03:58:50 +08:00
Jordan Harband	74bb42ee23	[Fix] nvm-exec: improve the no-version failure message ... The message claimed "no .nvmrc file found" even when one was found and its version simply was not installed, and it never mentioned that `NODE_VERSION=default` selects the `default` alias. Refs #3810	2026-09-08 23:47:09 -07:00
Thanniru Sai Teja	cd84623ab2	[Perf] Optimize nvm_tree_contains_path with in-memory POSIX parent-walk ... Replace looping subshell process forks (dirname) in nvm_tree_contains_path with case-guarded in-memory POSIX parameter expansion () and exact string equality comparisons. Ensures literal string matching for glob metacharacters (*, ?, []) and full zsh compatibility across all platforms.	2026-09-03 12:24:16 +05:30
Jordan Harband	e361b93e4b	[Fix] nvm use: do not clobber man's default search path ... `man` consults its own configured search path only when MANPATH holds an empty entry; a list without one replaces the default outright. `nvm use` produced exactly that, so activating a version could hide every system man page. Contribute the empty entry as a trailing one, so that nvm's directory keeps precedence over the system's, and only when the list has none already, so that repeated `nvm use` calls are idempotent and an empty entry the user placed stays where they put it. The `$(manpath)` snapshot this replaces went stale the moment man's configuration changed, and cost a subprocess per `nvm use`. It was also dead: `local MANPATH` scoped the assignment to `nvm()`, so `export` did not outlive the call and MANPATH went untouched whenever it started out unset. Only ksh, where `local` is not a builtin, ever ran it. `nvm deactivate` now unsets MANPATH where nvm's was the only real entry, rather than leaving a bare `:` behind. Reported and diagnosed by @al0ksar in #3890, which used a leading empty entry instead. That one accrues one more colon on every `nvm use`, which `nvm deactivate` then leaves behind, and it loses to the system's man pages wherever nvm's bin directory is not first on PATH. Supersedes #2077. Refs #3890 Refs #2077	2026-09-08 11:01:03 -07:00
Jordan Harband	a5ff3a32f4	[actions] WSL: pin every distribution, and test the newest of each line ... The Ubuntu entries were pinned but `Debian` and `Alpine` were floating aliases, so what those jobs tested drifted whenever the action updated. Every line now carries a pin and the newest release setup-wsl offers for it: Debian 12 and 13, Ubuntu 18.04, 20.04 and 24.04, Alpine 3.17 and 3.23. `Alpine-3.17` is the image the unofficial jobs already ran, named explicitly. Debian's pin is 12 rather than 11 because `Debian` and `Debian-11` share a floating `aka.ms/wsl-debian-gnulinux` redirect and so cannot be held still at all, where `Debian-12` is an immutable salsa.debian.org artifact. The Debian-only steps key off `startsWith`, so both Debian entries take the same path and moving a pin will not strand them. There is no floating "newest" name to use instead: `kali-linux` is the only unversioned distribution left, and setup-wsl's own CI disables `additional-packages` on it. The newest only moves when the action's major does, so the `uses:` ref is the thing to keep current. Which is the other half of this: move that ref from v6 to v7. v6 is a dead major, five months stale at v6.1.0 with no v6.2.0 and v7.0.0 tagged the next day, so new distributions will only ever appear on v7 and later. v7's only removals are the deprecated bare `Debian` and `Alpine`, which pinning has already stopped using, and every name here is valid on both. It also drops the Node.js 20 deprecation warning each WSL job currently emits, and it tightens two pins that v6 left floating: Ubuntu 20.04 moves from `aka.ms/wslubuntu2004` to a 20.04.6 image on releases.ubuntu.com, and 24.04 to a 24.04.4 one. Six of the seven platforms are now immutable artifacts; Ubuntu 18.04 predates the format and still redirects through aka.ms. Choosing a supported Debian also settles the 404s that had been failing every Debian job: bullseye left LTS on 2026-08-31 and its security suite is between homes, with `security.debian.org` still publishing an index whose pool is being pruned and `archive.debian.org` carrying no `debian-security` for bullseye yet. bookworm is on live mirrors, so `ca-certificates` is current again, which matters for a job whose whole purpose is to fetch nvm and node over TLS. To keep a pin working once its release ages out in turn, derive sources.list from the image's own codename and list every layout a release passes through: main and security move to the archive on separate schedules, and the security suite is renamed to `<codename>/updates` on the way. `apt-get update` discards whichever entries 404, and where an index outlives its pool we fall back once to main alone. Debian 13 moved to deb822, so clear both formats first and leave what we write as the only thing apt reads. Drop the blanket `apt-get upgrade` with it: it fetched 77 packages the test never uses, and `apt-get install` already takes the newest version any working mirror offers.	2026-09-08 11:01:02 -07:00
Lazizbek Ergashev	ccb49e5cd0	[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed ... Fixes #3906	2026-09-04 14:08:01 -07:00
Jordan Harband	aeace4606f	[Fix] nvm_hash_reset: only run hash -r where the shell supports it ... Under bash's `set +h`, `hash -r` errors with "hash: hashing disabled", which is then printed on every `nvm use`, including the one at shell startup. Guarding on `$-` alone would be wrong: `zsh` never puts `h` in `$-` - there `h` is `HIST_IGNORE_DUPS` - and `dash` has no `h` flag at all, so it would skip the call in 3 of the 4 shells the fast suite runs. Gate on the shell instead, and skip only where the call fails: bash under `set +h`, and `ksh93`, whose `hash` takes no `-r` and whose usage error aborts `nvm use` before it can export `NVM_BIN`. `ksh` is detected by probing rather than by version, so `mksh` and `pdksh`, which do accept `-r`, keep getting the call. The `${-#*h}` test is from #3910. Refs #2065 Refs #3247	2026-09-04 09:16:10 -07:00
debadityaandJordan Harband	80e700ec21	[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file ... `#` is a repetition operator under `extendedglob`, so `${VAR%%#*}` is an invalid pattern: zsh aborts the expansion and `nvm_alias` silently prints nothing, leaving the `default` alias unresolved when nvm.sh is sourced. The read loop moves into `nvm_print_alias_file` so that `local_options` scopes the option change to that section alone, rather than to everything `nvm_alias` does, and restores whatever the caller had set. Fixes #3885 Co-authored-by: debaditya <debaditya2005hait@gmail.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-03 20:54:28 -07:00
Jordan Harband	25b378323c	[Fix] zsh: restore nomatch and markdirs rather than clobbering them ... `unsetopt local_options nomatch` unsets both named options, so LOCAL_OPTIONS is off by the time the function returns and the `nomatch` change escapes into the caller's shell: one `nvm ls` or `nvm alias` leaves NO_MATCH off for the rest of the session, after which an unmatched glob is silently passed through as a literal. `setopt local_options nonomatch`, already used in `nvm_check_file_permissions`, restores on return. The `markdirs` line also cancelled the snapshot taken for `shwordsplit` on the line above it; that one is latent, as `nvm_ls` is only ever called inside a command substitution.	2026-09-03 20:44:59 -07:00
CJstate	3a72926f4a	[Fix] nvm --help: render the set-colors legend in color ... Every legend line is built inside a command substitution, where `nvm_has_colors` can never succeed, because `[ -t 1 ]` sees the capture pipe rather than the terminal. The legend has therefore always printed plain, on every terminal and in every shell. Resolve color support once and pass it in, the way `nvm_print_alias_path` already accepts the same flag. A command-prefix assignment cannot carry it: POSIX expands a command's arguments before applying its assignments, so the substitutions would still see it unset, and in sh and ksh it would outlive the call and override `--no-colors` for everything after. The test needs no tty, and fails against an unfixed `nvm.sh` in sh, bash, dash, and zsh. Fixes #3896	2026-09-03 12:10:19 -07:00
Jordan Harband	38f0f2cfdf	[Tests] nvm_print_color_legend: look up the function with PATH emptied ... The presence checks were still satisfiable by this test file itself, which is an executable named `nvm_print_color_legend`. Filtering `command -v` output on a `/` was not enough: dash and zsh report a bare name, not a path, for a current-directory match reached through an empty `PATH` component, and that is indistinguishable from a function. So `nvm unload` looked as though it had left the function behind in exactly the shells CI runs as `sh`, `dash`, and `zsh`, while bash, which reports `./name`, passed. Emptying `PATH` for the lookup asks about the function alone, and is immune to whatever `PATH` happens to hold. Reproduced first, then fixed: with `PATH=":${PATH}"` the previous check fails under dash and zsh and passes under bash, matching CI exactly. The assertions now hold in sh, bash, dash, and zsh with the directory absent from `PATH`, present on it, and via an empty entry, and both dropping `nvm_print_color_legend` from `nvm unload` and renaming the function out from under the guard are still caught in all twelve combinations.	2026-09-03 15:12:34 -07:00