2436 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Cassidy Marble	c7ba8d2106	[Perf] nvm_version: resolve an exact, installed version without nvm_ls ... An alias of the same name still takes precedence, as it does in `nvm_ls`.	2026-10-06 12:43:22 -03:00
Cassidy Marble	d211d5fdb8	[Perf] nvm_is_version_installed: check the modern layout's path before the full lookup	2026-10-06 12:43:22 -03:00
Hridhin Varkey Joseph	913b8cb625	[Perf] nvm_resolve_local_alias: skip nvm_version for an exact, installed version ... See #3416	2026-10-04 02:22:58 +05:30
Hridhin Varkey Joseph	f1f3d463ab	[Perf] nvm use: skip re-resolving an exact, installed version ... When `nvm use` is given an exact `vX.Y.Z` that is already installed, and no alias with that exact name exists, use it directly instead of re-resolving it through `nvm_match_version` and `nvm_ensure_version_installed`, both of which call `nvm_version`. `nvm_auto` takes this path on every shell startup with an already-resolved version, so this removes ~95ms from each new shell (~330ms -> ~235ms in a clean environment on macOS/zsh). Fixes #3930	2026-10-01 09:51:16 +05:30
Jordan Harband	077156e88f	[actions] never let an apt install wait on a prompt ... Moving WSL package installs out of `setup-wsl`'s `additional-packages` lost its non-interactive setup: on Ubuntu 18.04, upgrading `libssl1.1` asks whether to restart services, and the job waited on that dialog until it was cancelled. Set `DEBIAN_FRONTEND=noninteractive`, keep existing config files without asking, and give apt no stdin.	2026-10-08 11:10:27 -07:00
Jordan Harband	50e73c4cd5	[actions] retry apt package installs through Ubuntu mirror outages ... Mirror outages have outlasted the existing retries, which covered only `apt-get update` (and not the WSL `additional-packages` install). Installs now go through `.github/scripts/apt-install.sh`, which retries each request within apt and retries the whole update+install with backoff for about 10 minutes.	2026-10-07 15:10:36 -07:00
Hridhin Varkey Joseph	ed1b96f5db	[readme] explain the misleading npm install error from npm run test/fast	2026-10-04 00:49:18 +05:30
Shrikant	5326eaab9d	[Tests] add unit coverage for nvm_version_greater_than_or_equal_to	2026-10-03 12:49:00 +05:30
Hridhin Varkey Joseph	a27fb0bd78	[Tests] add unit tests for nvm_version_greater_than_or_equal_to	2026-10-03 11:51:31 +05:30
Mingyang Wu	cb96d2a56a	[Fix] Handle filesystem identity when checking path containment ... Fixes #1049. Assisted-by: OpenAI GPT-6 <noreply@openai.com>	2026-09-11 16:49:46 +08:00
Jordan Harband	46ca42f939	[Tests] nvm install --reinstall-packages-from: mock the remote version instead of fetching it	2026-10-05 10:52:19 -07:00
Jordan Harband	52a1e55574	[actions] run the fast suite on macOS and WSL too ... macOS covers a case-insensitive filesystem and bash 3.2 (`/bin/sh`, `/bin/bash`); WSL covers Windows. Both run it as the Linux jobs do: without a system node, with a PTY, and on WSL as a non-root user with passwordless sudo.	2026-09-30 16:12:14 +09:00
Jordan Harband	79bc9b90dd	[Tests] make the fast suite pass on macOS ... - `nvm_get_arch`: the unmocked smartos cases fall through to the host, so only run them on x86_64 - `nvm_get_arch_unofficial`: the chroot checks need x86_64 glibc Linux - `nvm_install_no_progress_bar`: derive the tarball slug and checksum tool instead of assuming linux-x64 and `sha256sum`	2026-09-30 16:09:09 +09:00
Jordan Harband	e2f57b733f	[Fix] nvm alias: do not drop output from background jobs on bash 3.2 ... bash 3.2 (macOS `/bin/bash` and `/bin/sh`) exec-optimizes a trailing `command` call inside a function run as a background job, which silently drops the output of nested command substitutions; in `nvm alias` that lost installed-alias colors and some default aliases, Running each job in an explicit subshell avoids it.	2026-09-30 15:56:49 +09:00
Jordan Harband	0add6b8555	[Fix] nvm: do not change or export the caller's IFS ... `IFS=... nvm "$@"` is a prefix assignment to a function call, which bash's POSIX mode (macOS `/bin/sh`) keeps after the call returns, and exports.	2026-09-30 15:50:38 +09:00
Jordan Harband	3bfc2b4a9a	[actions] rename windows-npm workflow to windows-nvm, since it tests nvm install	2026-09-30 15:25:38 +09:00
Jordan Harband	04ac3f2a83	[Fix] nvm install: do not remove the caller's TMPDIR after a failed download ... `nvm_install_binary` and `nvm_install_source` declared `local TMPDIR` without initializing it, and remove it with `rm -rf` on failure. dash's `local` keeps the caller's value, as does bash's when `TMPDIR` is passed as a prefix assignment (`TMPDIR=… nvm install`), so a failed download removed the caller's temp directory; on macOS, `tar` instead blocked reading the archive from the terminal.	2026-10-05 10:02:48 -07:00
Ben YounesandJordan Harband	a8bb497400	[New] nvm ls-remote: annotate versions with the node alias and local aliases ... Fixes #2786. Ben Younes added the alias annotations to bare `nvm ls-remote`, with their regression tests; Jordan Harband moved `(Latest: node)` onto the newest node release, gave each kind of annotation a fixed column so the output can be sliced with `cut`, matched aliases to versions in one pass, and kept local aliases out of the mocks and tests. Co-authored-by: Ben Younes <2910651+ousamabenyounes@users.noreply.github.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-23 21:35:43 +00:00
Jordan Harband	04fbd9570c	[New] add nvm_has_italics, to detect terminal italics support via terminfo	2026-09-29 17:08:36 +09:00
Jordan Harband	09822033d2	[Fix] nvm exec/nvm run: do not treat filenames with digits as versions ... `nvm_is_valid_version` accepted strings like `123.js`, `v1.js`, and `1.2.3.4.5.6.js`, because `nvm_version_greater_than_or_equal_to` exits as soon as the first number is greater than zero, without looking at the rest. So `nvm run 123.js` failed with `N/A: version "v123.js" is not yet installed` instead of running the file. It now checks the shape first: one to three dot-separated numbers, optionally with a trailing dot, and a prerelease suffix (rc, nightly, v8-canary, test builds) only after a full `x.y.z`. A suffix with a dot followed by a non-digit, like a file extension, is rejected, so names like `1.2.3-foo.js` are treated as files too. Every version listed in the nodejs.org and iojs.org `index.tab` files is still accepted, so shell startup keeps using a `default` alias that resolves to an installed prerelease. Names that are also valid versions, like `123` or `v1`, are still treated as versions; `nvm run current 123` runs such a file. Refs #1166. See #3931.	2026-09-28 15:05:28 +09:00
Jordan Harband	a885b885fe	v0.40.8 ... Bug Fixes - `nvm_alias`, `nvm_version_path`: reject `..` path components - `nvm_get_make_jobs`: count cores on platforms the `case` does not name - `nvm-exec`: improve the no-version failure message - `nvm use`: do not clobber `man`'s default search path (#3890) - `nvm_err`, `nvm_err_with_colors`: do not fail when stderr is closed (#3907) - `nvm_hash_reset`: only run `hash -r` where the shell supports it - `nvm_alias`: unset zsh's `extendedglob` while reading an alias file (#3891) - zsh: restore `nomatch` and `markdirs` rather than clobbering them - `nvm --help`: render the set-colors legend in color (#3915) - `nvm unload`: drop the undefined `nvm_format_help_message_colors` - `nvm_get_mirror`: allow ports, userinfo, IPv6 hosts, and percent-encoding - `nvm_sanitize_auth_header`: allow `~`, completing RFC 7235 `token68` (#3751) Refactors - `nvm --help`: extract the set-colors legend into `nvm_print_color_legend` Performance - Optimize nvm_tree_contains_path with in-memory POSIX parent-walk (#3912) Docs - [readme] document platforms with no official node binaries - `install.sh`: Fix missing words in bash/zsh completion message (#3887) - Remove stray closing HTML tag (#3919) Misc - [meta] remove CLAUDE.md symlink in favor of AGENTS.md (#3928) - [meta] add `release-notes.sh`, the release notes generator Tests - homebrew/actions changed their default branch - [actions] WSL: pin every distribution, and test the newest of each line - `nvm_print_color_legend`: look up the function with `PATH` emptied - `nvm_print_color_legend`: check for the function, not a same-named file - `nvm_print_color_legend`: fix the `fast` suite on GNU userlands - [actions] `release.yml`: provide `GH_TOKEN` so release-notes PR lookup can run v0.40.8	2026-09-21 10:23:47 +08:00
Jordan Harband	072622c748	[Fix] nvm_alias, nvm_version_path: reject .. path components ... `nvm_alias` concatenated the requested name onto `$NVM_DIR/alias` and read whatever that resolved to, so a name with a `..` component escaped the alias dir - under the default layout, `../../.npmrc` reaches `$HOME/.npmrc`. `nvm_print_alias_file` echoes every non-comment line of what it opens, and `nvm use` reports the first one in its "is not yet installed" error, so an untrusted `.nvmrc` could disclose any file the invoking user can read. The write side already rejected `..` in an alias name (9275c5ba); apply the same check on the read side, and to `nvm_version_path`, which composes a version into a path with no check of its own. Slashes stay legal, since `lts/iron` and the `lts/*` alias file depend on them.	2026-09-21 10:01:34 +08:00
Jarren San Jose	60a8da7a8e	[meta] remove CLAUDE.md symlink in favor of AGENTS.md ... Claude Code now reads AGENTS.md directly when a project has no CLAUDE.md, so the root CLAUDE.md symlink pointing at AGENTS.md is redundant.	2026-09-18 16:33:51 -07:00
Jordan Harband	5267556406	[Tests] homebrew/actions changed their default branch	2026-09-21 09:17:45 +08:00
Jordan Harband	a4f801ed72	[Fix] nvm_get_make_jobs: count cores on platforms the case does not name ... `nvm_get_os` also returns `win` (Cygwin/MSYS/MinGW) and the empty string, neither of which had an arm, so `NVM_CPU_CORES` went unassigned and nvm asked the user to report a gap it already knew about. On an unrecognized `uname` that also meant a single-threaded source build; `win` refuses source builds a few lines later either way. `NUMBER_OF_PROCESSORS` comes last because Windows scopes it to the calling process' processor group. Assigning `NVM_CPU_CORES` in every arm also keeps the `nvm_is_natural_num` check below from aborting dash and ksh under `set -u`.	2026-09-10 17:08:50 -07:00
Jordan Harband	7fc22fc9c7	[readme] document platforms with no official node binaries ... The README never said which platforms nvm can detect but nodejs.org does not build for, so a user on one of them only finds out from a slow, silent, source-build fallback. Also corrects the Alpine section: nvm remaps Alpine to a musl arch itself now, and nodejs.org has published `linux-x64-musl` since v24.20.0, so both the "no concrete plans" and the "does not exist errors" claims are out of date. Coverage bounds are stated per release line rather than per patch, since the newest of them are still shipping.	2026-09-10 17:11:20 -07:00
Hashim Khan	b6d7823bce	[Docs] install.sh: Fix missing words in bash/zsh completion message ... When profile detection fails, the completion hint omitted "correct file" between "to the" and "if you are using". Fixes #3528	2026-07-23 08:24:46 +05:00
dajiaohuang	3fb99c652b	[Docs] Remove stray closing HTML tag	2026-09-10 03:58:50 +08:00
Jordan Harband	74bb42ee23	[Fix] nvm-exec: improve the no-version failure message ... The message claimed "no .nvmrc file found" even when one was found and its version simply was not installed, and it never mentioned that `NODE_VERSION=default` selects the `default` alias. Refs #3810	2026-09-08 23:47:09 -07:00
Thanniru Sai Teja	cd84623ab2	[Perf] Optimize nvm_tree_contains_path with in-memory POSIX parent-walk ... Replace looping subshell process forks (dirname) in nvm_tree_contains_path with case-guarded in-memory POSIX parameter expansion () and exact string equality comparisons. Ensures literal string matching for glob metacharacters (*, ?, []) and full zsh compatibility across all platforms.	2026-09-03 12:24:16 +05:30
Jordan Harband	e361b93e4b	[Fix] nvm use: do not clobber man's default search path ... `man` consults its own configured search path only when MANPATH holds an empty entry; a list without one replaces the default outright. `nvm use` produced exactly that, so activating a version could hide every system man page. Contribute the empty entry as a trailing one, so that nvm's directory keeps precedence over the system's, and only when the list has none already, so that repeated `nvm use` calls are idempotent and an empty entry the user placed stays where they put it. The `$(manpath)` snapshot this replaces went stale the moment man's configuration changed, and cost a subprocess per `nvm use`. It was also dead: `local MANPATH` scoped the assignment to `nvm()`, so `export` did not outlive the call and MANPATH went untouched whenever it started out unset. Only ksh, where `local` is not a builtin, ever ran it. `nvm deactivate` now unsets MANPATH where nvm's was the only real entry, rather than leaving a bare `:` behind. Reported and diagnosed by @al0ksar in #3890, which used a leading empty entry instead. That one accrues one more colon on every `nvm use`, which `nvm deactivate` then leaves behind, and it loses to the system's man pages wherever nvm's bin directory is not first on PATH. Supersedes #2077. Refs #3890 Refs #2077	2026-09-08 11:01:03 -07:00
Jordan Harband	a5ff3a32f4	[actions] WSL: pin every distribution, and test the newest of each line ... The Ubuntu entries were pinned but `Debian` and `Alpine` were floating aliases, so what those jobs tested drifted whenever the action updated. Every line now carries a pin and the newest release setup-wsl offers for it: Debian 12 and 13, Ubuntu 18.04, 20.04 and 24.04, Alpine 3.17 and 3.23. `Alpine-3.17` is the image the unofficial jobs already ran, named explicitly. Debian's pin is 12 rather than 11 because `Debian` and `Debian-11` share a floating `aka.ms/wsl-debian-gnulinux` redirect and so cannot be held still at all, where `Debian-12` is an immutable salsa.debian.org artifact. The Debian-only steps key off `startsWith`, so both Debian entries take the same path and moving a pin will not strand them. There is no floating "newest" name to use instead: `kali-linux` is the only unversioned distribution left, and setup-wsl's own CI disables `additional-packages` on it. The newest only moves when the action's major does, so the `uses:` ref is the thing to keep current. Which is the other half of this: move that ref from v6 to v7. v6 is a dead major, five months stale at v6.1.0 with no v6.2.0 and v7.0.0 tagged the next day, so new distributions will only ever appear on v7 and later. v7's only removals are the deprecated bare `Debian` and `Alpine`, which pinning has already stopped using, and every name here is valid on both. It also drops the Node.js 20 deprecation warning each WSL job currently emits, and it tightens two pins that v6 left floating: Ubuntu 20.04 moves from `aka.ms/wslubuntu2004` to a 20.04.6 image on releases.ubuntu.com, and 24.04 to a 24.04.4 one. Six of the seven platforms are now immutable artifacts; Ubuntu 18.04 predates the format and still redirects through aka.ms. Choosing a supported Debian also settles the 404s that had been failing every Debian job: bullseye left LTS on 2026-08-31 and its security suite is between homes, with `security.debian.org` still publishing an index whose pool is being pruned and `archive.debian.org` carrying no `debian-security` for bullseye yet. bookworm is on live mirrors, so `ca-certificates` is current again, which matters for a job whose whole purpose is to fetch nvm and node over TLS. To keep a pin working once its release ages out in turn, derive sources.list from the image's own codename and list every layout a release passes through: main and security move to the archive on separate schedules, and the security suite is renamed to `<codename>/updates` on the way. `apt-get update` discards whichever entries 404, and where an index outlives its pool we fall back once to main alone. Debian 13 moved to deb822, so clear both formats first and leave what we write as the only thing apt reads. Drop the blanket `apt-get upgrade` with it: it fetched 77 packages the test never uses, and `apt-get install` already takes the newest version any working mirror offers.	2026-09-08 11:01:02 -07:00
Lazizbek Ergashev	ccb49e5cd0	[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed ... Fixes #3906	2026-09-04 14:08:01 -07:00
Jordan Harband	aeace4606f	[Fix] nvm_hash_reset: only run hash -r where the shell supports it ... Under bash's `set +h`, `hash -r` errors with "hash: hashing disabled", which is then printed on every `nvm use`, including the one at shell startup. Guarding on `$-` alone would be wrong: `zsh` never puts `h` in `$-` - there `h` is `HIST_IGNORE_DUPS` - and `dash` has no `h` flag at all, so it would skip the call in 3 of the 4 shells the fast suite runs. Gate on the shell instead, and skip only where the call fails: bash under `set +h`, and `ksh93`, whose `hash` takes no `-r` and whose usage error aborts `nvm use` before it can export `NVM_BIN`. `ksh` is detected by probing rather than by version, so `mksh` and `pdksh`, which do accept `-r`, keep getting the call. The `${-#*h}` test is from #3910. Refs #2065 Refs #3247	2026-09-04 09:16:10 -07:00
debadityaandJordan Harband	80e700ec21	[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file ... `#` is a repetition operator under `extendedglob`, so `${VAR%%#*}` is an invalid pattern: zsh aborts the expansion and `nvm_alias` silently prints nothing, leaving the `default` alias unresolved when nvm.sh is sourced. The read loop moves into `nvm_print_alias_file` so that `local_options` scopes the option change to that section alone, rather than to everything `nvm_alias` does, and restores whatever the caller had set. Fixes #3885 Co-authored-by: debaditya <debaditya2005hait@gmail.com> Co-authored-by: Jordan Harband <ljharb@gmail.com>	2026-09-03 20:54:28 -07:00
Jordan Harband	25b378323c	[Fix] zsh: restore nomatch and markdirs rather than clobbering them ... `unsetopt local_options nomatch` unsets both named options, so LOCAL_OPTIONS is off by the time the function returns and the `nomatch` change escapes into the caller's shell: one `nvm ls` or `nvm alias` leaves NO_MATCH off for the rest of the session, after which an unmatched glob is silently passed through as a literal. `setopt local_options nonomatch`, already used in `nvm_check_file_permissions`, restores on return. The `markdirs` line also cancelled the snapshot taken for `shwordsplit` on the line above it; that one is latent, as `nvm_ls` is only ever called inside a command substitution.	2026-09-03 20:44:59 -07:00
CJstate	3a72926f4a	[Fix] nvm --help: render the set-colors legend in color ... Every legend line is built inside a command substitution, where `nvm_has_colors` can never succeed, because `[ -t 1 ]` sees the capture pipe rather than the terminal. The legend has therefore always printed plain, on every terminal and in every shell. Resolve color support once and pass it in, the way `nvm_print_alias_path` already accepts the same flag. A command-prefix assignment cannot carry it: POSIX expands a command's arguments before applying its assignments, so the substitutions would still see it unset, and in sh and ksh it would outlive the call and override `--no-colors` for everything after. The test needs no tty, and fails against an unfixed `nvm.sh` in sh, bash, dash, and zsh. Fixes #3896	2026-09-03 12:10:19 -07:00
Jordan Harband	38f0f2cfdf	[Tests] nvm_print_color_legend: look up the function with PATH emptied ... The presence checks were still satisfiable by this test file itself, which is an executable named `nvm_print_color_legend`. Filtering `command -v` output on a `/` was not enough: dash and zsh report a bare name, not a path, for a current-directory match reached through an empty `PATH` component, and that is indistinguishable from a function. So `nvm unload` looked as though it had left the function behind in exactly the shells CI runs as `sh`, `dash`, and `zsh`, while bash, which reports `./name`, passed. Emptying `PATH` for the lookup asks about the function alone, and is immune to whatever `PATH` happens to hold. Reproduced first, then fixed: with `PATH=":${PATH}"` the previous check fails under dash and zsh and passes under bash, matching CI exactly. The assertions now hold in sh, bash, dash, and zsh with the directory absent from `PATH`, present on it, and via an empty entry, and both dropping `nvm_print_color_legend` from `nvm unload` and renaming the function out from under the guard are still caught in all twelve combinations.	2026-09-03 15:12:34 -07:00
Jordan Harband	812a76bb41	[Fix] nvm unload: drop the undefined nvm_format_help_message_colors ... `unset -f` was passed a name that has never been a function. It arrived with `set-colors` in 6848c16d and has never existed. That matters because shells disagree about what `unset -f` does with a name that is not a function. bash unsets the rest of the list and carries on; Linux dash and zsh appear to stop there, which silently left every one of the ten names after it defined: `nvm_echo_with_colors`, `nvm_err_with_colors`, `nvm_get_artifact_compression`, `nvm_install_binary_extract`, `nvm_extract_tarball`, `nvm_process_nvmrc`, `nvm_process_nvmrc_content`, `nvm_nvmrc_invalid_msg`, `nvm_write_nvmrc`, and most recently `nvm_print_color_legend`. Nothing noticed until `nvm_print_color_legend` gained a test asserting that `nvm unload` removes it, because it sorts first among the survivors. With the dead name gone, every remaining entry is a real function, so no shell has an undefined name to disagree about.	2026-09-03 13:57:58 -07:00
Jordan Harband	26fef4fe1a	[Tests] nvm_print_color_legend: check for the function, not a same-named file ... The presence checks used `command -v`, which finds executables as readily as functions, and this test file is itself an executable named `nvm_print_color_legend`. Whenever its own directory is on `PATH`, as it is under CI, `command -v` kept resolving to the file long after `nvm unload` had removed the function, so the unload assertion could never pass there and the "is it defined" guard could never fail. `command -v` prints a bare name for a function and a path for an executable, in sh, bash, dash, zsh, and ksh alike, so requiring the result to contain no slash distinguishes the two. Verified both ways round: with the test's directory on `PATH` the suite passes in all four shells, and removing `nvm_print_color_legend` from `nvm unload`'s list is still caught in all four.	2026-09-03 12:08:18 -07:00
Jordan Harband	17f12a1207	[Tests] nvm_print_color_legend: fix the fast suite on GNU userlands ... The `nvm unload` assertion failed every `fast` job on Linux while passing on macOS, and its shape made the cause impossible to read off the failure. `set -e` aborts the command substitution when `nvm unload` returns non-zero, which leaves an empty string that the assertion then reports as "unload left nvm_print_color_legend defined". Run the unload with `set +e` inside the subshell and report its exit status next to the lookup, so a failing unload can no longer be misread as a function that survived it. The accompanying `sed: couldn't flush stdout: Broken pipe` came from the `grep -q` pipelines: `grep -q` exits at its first match and hands SIGPIPE to the `sed` feeding it, which BSD sed swallows and GNU sed reports. Match whole lines with `case` against the already-captured string instead, which needs no pipe at all, and capture `nvm --help` before stripping it rather than piping it through two processes into `grep -q`. Test stderr is now empty in sh, bash, dash, and zsh.	2026-09-03 11:54:45 -07:00
Jordan Harband	ab83657ba6	[Refactor] nvm --help: extract the set-colors legend into nvm_print_color_legend	2026-09-03 10:17:16 -07:00
Jordan Harband	10a277ec47	[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding ... 3c480159 correctly made this validator actually enforce, instead of the no-op `awk '{ $0 ~ "..." }'` it had been, but its character class had never been audited against real mirror URLs: it has no `:`, so enabling enforcement silently rejected every mirror URL bearing a port. $ NVM_NODEJS_ORG_MIRROR=https://mirror.internal:8443/dist nvm_ls_remote $NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL No request is made at all, so an internal mirror on a non-default port has been unusable since v0.40.5. Allow RFC 3986 `unreserved` plus the authority and path punctuation a mirror URL legitimately needs: `:` for a port, `@` for userinfo, `[`/`]` for an IPv6 literal host, and `%` for percent-encoding. `sub-delims` and the query/fragment delimiters stay rejected: nvm appends a path to this value, so a query string could never have worked, and several of those characters are shell metacharacters.	2026-09-02 19:40:47 -07:00
Andres Mejia Sanchez	dd0f702fb1	[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68 ... `~` is a member of RFC 7235 §2.1 `token68`, and thus of RFC 6750 §2.1 `b64token`, but the allowlist stripped it, silently corrupting any opaque Bearer credential containing it: Bearer mF_9.B5f-4.1JqM~+/= -> Bearer mF_9.B5f-4.1JqM+/= `Basic` credentials were never affected, since RFC 4648 §4 base64 cannot emit `~`; `;` stays stripped, as it belongs to no auth-scheme production. Cover the charset in the unit test, and assert the credential reaches the downloader intact via the existing fake-`wget` harness, which needs no container.	2026-09-02 19:36:04 -07:00
Jordan Harband	6798d1dbc9	[actions] release.yml: provide GH_TOKEN so release-notes PR lookup can run ... In GitHub Actions, `gh` refuses to run without a token, and `release-notes.sh` fails closed on `gh` errors, so the `make release` dry run died once the script was checked in. The workflow already permits `api.github.com` egress and only needs the default read-only token.	2026-08-17 23:33:17 -07:00
Jordan Harband	df7a936157	[meta] add release-notes.sh, the release notes generator ... The `release` target has invoked `./release-notes.sh` since 0b8ed9fa, but the script itself was never committed, so the "Tests: release process" workflow fails on a fresh checkout.	2026-08-17 23:21:32 -07:00
Jordan Harband	f0b0c6bb0b	v0.40.7 ... New Stuff - `nvm install`: serialize concurrent installs of the same version - `nvm install`: add `NVM_NO_SOURCE_FALLBACK` to disable the source fallback Robustness - `nvm install`: reject a structurally broken installed version - `nvm_install_binary_extract`: replace a broken version dir atomically - `install.sh`: `nvm_download`: avoid `eval` so arguments aren't re-parsed by the shell Docs - [readme] link every referenced person and project to its canonical page Misc - [Dev Deps] update `markdown-link-check` Tests - install_nvm_from_git: don't fail when master is at the latest release tag v0.40.7	2026-08-17 23:08:13 -07:00
Jordan Harband	0b8ed9fa7d	[Dev Deps] update markdown-link-check	2026-08-17 22:59:46 -07:00
Jordan Harband	65ded65d46	[readme] link every referenced person and project to its canonical page ... Link the first mention of each named person to their GitHub and each named project, tool, or OS to its official homepage or repo. Mentions that appear only inside a heading (Ansible), an HTML comment (doctoc), or a multi-word code span (grunt) are left unlinked, since a link there would break the generated table-of-contents anchors or fail to render.	2026-07-24 11:11:57 -07:00
Jordan Harband	809f3ee5ab	[New] nvm install: serialize concurrent installs of the same version ... Two `nvm install <same version>` runs could race on the version directory - one removing or replacing it while the other reads or writes it. Take a per-version advisory lock (an atomically-created directory under $NVM_DIR/.cache locks) around the binary/source install, so a second run of the same version waits for the first; installs of different versions never contend. NVM_INSTALL_LOCK_TIMEOUT (seconds, default 600) bounds the wait, after which nvm reports the lock path so a lock left by a killed install can be removed. NVM_INSTALL_LOCK_STALE (minutes, default 0 / off) opts into automatically stealing a lock older than that, for unattended or CI use.	2026-07-24 10:55:58 -07:00