Merge b4ee18be6a into 759f70f196

Fix symlink traversal

README.md

@@ -19,7 +19,6 @@
   - [Install & Update Script](#install--update-script)
     - [Additional Notes](#additional-notes)
     - [Installing in Docker](#installing-in-docker)
-      - [Installing in Docker for CICD-Jobs](#installing-in-docker-for-cicd-jobs)
     - [Troubleshooting on Linux](#troubleshooting-on-linux)
     - [Troubleshooting on macOS](#troubleshooting-on-macos)
     - [Ansible](#ansible)
@@ -155,62 +154,6 @@ RUN echo node > .nvmrc
 RUN nvm install
 ```
 
-##### Installing in Docker for CICD-Jobs
-
-More robust, works in CI/CD-Jobs. Can be run in interactive and non-interactive containers.
-See https://github.com/nvm-sh/nvm/issues/3531.
-
-```Dockerfile
-FROM ubuntu:latest
-ARG NODE_VERSION=20
-
-# install curl
-RUN apt update && apt install curl -y
-
-# install nvm
-RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
-
-# set env
-ENV NVM_DIR=/root/.nvm
-
-# install node
-RUN bash -c "source $NVM_DIR/nvm.sh && nvm install $NODE_VERSION"
-
-# set ENTRYPOINT for reloading nvm-environment
-ENTRYPOINT ["bash", "-c", "source $NVM_DIR/nvm.sh && exec \"$@\"", "--"]
-
-# set cmd to bash
-CMD ["/bin/bash"]
-
-```
-
-This example defaults to installation of nodejs version 20.x.y. Optionally you can easily override the version with docker build args like:
-```
-docker build -t nvmimage --build-arg NODE_VERSION=19 .
-```
-
-After creation of the image you can start container interactively and run commands, for example:
-```
-docker run --rm -it nvmimage
-
-root@0a6b5a237c14:/# nvm -v
-0.40.1
-
-root@0a6b5a237c14:/# node -v
-v19.9.0
-
-root@0a6b5a237c14:/# npm -v
-9.6.3
-```
-
-Noninteractive example:
-```
-user@host:/tmp/test $ docker run --rm -it nvmimage node -v
-v19.9.0
-user@host:/tmp/test $ docker run --rm -it nvmimage npm -v
-9.6.3
-```
-
 #### Troubleshooting on Linux
 
 On Linux, after running the install script, if you get `nvm: command not found` or see no feedback from your terminal after you type `command -v nvm`, simply close your current terminal, open a new terminal, and try verifying again.
@@ -890,7 +833,7 @@ my_alias        default        v10.22.0       v12.18.3      v14.8.0
 
 ## Compatibility Issues
 
-`nvm` will encounter some issues if you have some non-default settings set. (see [#606](https://github.com/nvm-sh/nvm/issues/606))
+`nvm` will encounter some issues if you have some non-default settings set. (see [#606](https://github.com/creationix/nvm/issues/606))
 The following are known to cause issues:
 
 Inside `~/.npmrc`:

nvm-exec

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 
-DIR="$(command cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+SOURCE=${BASH_SOURCE[0]}
+test -L "$SOURCE" && command cd "$( dirname "$SOURCE" )" && \
+  SOURCE=$(readlink "$SOURCE")
+DIR="$(command cd "$( dirname "$SOURCE" )" && pwd )"
 
 unset NVM_CD_FLAGS
 

nvm.sh

@@ -1265,10 +1265,9 @@ nvm_list_aliases() {
         if [ -n "${LTS_ALIAS}" ]; then
           nvm_echo "${LTS_ALIAS}"
         fi
-      } &
+      }
     done
-    wait
-  ) | command sort
+  )
   return
 }
 
@@ -2534,12 +2533,12 @@ nvm_extract_tarball() {
 
   if [ "${NVM_OS}" = 'openbsd' ]; then
     if [ "${tar_compression_flag}" = 'J' ]; then
-      command xzcat "${TARBALL}" | "${tar}" -xf - -C "${TMPDIR}" -s '/[^\/]*\///' || return 1
+      command xzcat "${TARBALL}" | "${tar}" --no-same-owner -xf - -C "${TMPDIR}" -s '/[^\/]*\///' || return 1
     else
-      command "${tar}" -x${tar_compression_flag}f "${TARBALL}" -C "${TMPDIR}" -s '/[^\/]*\///' || return 1
+      command "${tar}" --no-same-owner -x${tar_compression_flag}f "${TARBALL}" -C "${TMPDIR}" -s '/[^\/]*\///' || return 1
     fi
   else
-    command "${tar}" -x${tar_compression_flag}f "${TARBALL}" -C "${TMPDIR}" --strip-components 1 || return 1
+    command "${tar}" --no-same-owner -x${tar_compression_flag}f "${TARBALL}" -C "${TMPDIR}" --strip-components 1 || return 1
   fi
 }
 
@@ -2740,7 +2739,7 @@ nvm_npm_global_modules() {
   NPMLIST=$(nvm use "${VERSION}" >/dev/null && npm list -g --depth=0 2>/dev/null | command sed -e '1d' -e '/UNMET PEER DEPENDENCY/d')
 
   local INSTALLS
-  INSTALLS=$(nvm_echo "${NPMLIST}" | command sed -e '/ -> / d' -e '/\(empty\)/ d' -e 's/^.* \(.*@[^ ]*\).*/\1/' -e '/^npm@[^ ]*.*$/ d' -e '/^corepack@[^ ]*.*$/ d' | command xargs)
+  INSTALLS=$(nvm_echo "${NPMLIST}" | command sed -e '/ -> / d' -e '/\(empty\)/ d' -e 's/^.* \(.*@[^ ]*\).*/\1/' -e '/^npm@[^ ]*.*$/ d' | command xargs)
 
   local LINKS
   LINKS="$(nvm_echo "${NPMLIST}" | command sed -n 's/.* -> \(.*\)/\1/ p')"
@@ -4080,7 +4079,9 @@ nvm() {
           nvm_echo "Running node ${VERSION}$(nvm use --silent "${VERSION}" && nvm_print_npm_version)"
         fi
       fi
-      NODE_VERSION="${VERSION}" "${NVM_DIR}/nvm-exec" "$@"
+      NVM_EXEC="$NVM_DIR/nvm-exec"
+      test ! -f "$NVM_EXEC" && NVM_EXEC="$(dirname "${BASH_SOURCE[0]-}")/nvm-exec"
+      NODE_VERSION="$VERSION" "$NVM_EXEC" "$@"
     ;;
     "ls" | "list")
       local PATTERN

package.json

@@ -45,9 +45,9 @@
     "dockerfile_lint": "^0.3.4",
     "doctoc": "^2.2.1",
     "eclint": "^2.8.1",
-    "markdown-link-check": "^3.13.7",
+    "markdown-link-check": "^3.13.6",
     "replace": "^1.2.2",
-    "semver": "^7.7.1",
+    "semver": "^7.6.3",
     "urchin": "^0.0.5"
   }
 }

test/slow/nvm exec/Running "nvm exec --lts" when NVM_DIR differs from nvm

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+set -ex
+
+die () { echo "$@" ; exit 1; }
+
+INSTPATH="$(mktemp -p "$(pwd)" -d)"
+trap 'test ! -z "${INSTPATH-}" && test -d "$INSTPATH" && rm -rf "$INSTPATH"' EXIT
+declare -x NVM_DIR=$INSTPATH
+\. ../../../nvm.sh
+
+nvm install --lts || die 'nvm install --lts failed'
+nvm exec --lts npm --version || die "`nvm exec` failed to run"
+declare -x NODE_VERSION="$(nvm exec --lts --silent node --version)"
+
+ln -s ../../../../nvm-exec "$INSTPATH/nvm-exec" || die "failed to create a symlink to $INSTPATH/"
+"$INSTPATH/nvm-exec" npm ls > /dev/null || die "`nvm exec` failed to run using nvm-exec helper"
+

test/slow/nvm reinstall-packages/should work as expected

@@ -16,7 +16,7 @@ EXPECTED_PACKAGES_INSTALL="autoprefixer bower david@11 grunt-cli grunth-cli http
 echo "$EXPECTED_PACKAGES_INSTALL" | sed -e 's/test-npmlink //' | xargs npm install -g --quiet
 
 get_packages() {
-  npm list -g --depth=0 | \sed -e '1 d' -e 's/^.* \(.*\)@.*/\1/' -e '/^npm$/ d' -e '/^corepack$/ d' | xargs
+  npm list -g --depth=0 | \sed -e '1 d' -e 's/^.* \(.*\)@.*/\1/' -e '/^npm$/ d' | xargs
 }
 
 nvm use 0.10.29

test/slow/nvm reinstall-packages/works with no installs

@@ -5,7 +5,7 @@ die () { echo "$@" ; exit 1; }
 \. ../../../nvm.sh
 
 get_packages() {
-  npm list -g --depth=0 | \sed -e '1 d' -e 's/^.* \(.*\)@.*/\1/' -e '/^npm$/ d' -e '/^corepack$/ d' | xargs
+  npm list -g --depth=0 | \sed -e '1 d' -e 's/^.* \(.*\)@.*/\1/' -e '/^npm$/ d' | xargs
 }
 
 nvm use 4.7.2
@@ -14,14 +14,5 @@ ORIGINAL_PACKAGES=$(get_packages)
 nvm reinstall-packages 4.7.1
 FINAL_PACKAGES=$(get_packages)
 
-[ -z "${ORIGINAL_PACKAGES}" ] || die "v4: original packages were not empty: ${ORIGINAL_PACKAGES}"
-[ -z "${FINAL_PACKAGES}" ] || die "v4: final packages were not empty: ${FINAL_PACKAGES}"
-
-nvm use 23.8.20
-ORIGINAL_PACKAGES=$(get_packages)
-
-nvm reinstall-packages 23.8.0
-FINAL_PACKAGES=$(get_packages)
-
-[ -z "${ORIGINAL_PACKAGES}" ] || die "v23: original packages were not empty: ${ORIGINAL_PACKAGES}"
-[ -z "${FINAL_PACKAGES}" ] || die "v23: final packages were not empty: ${FINAL_PACKAGES}"
+[ -z "${ORIGINAL_PACKAGES}" ] || die "original packages were not empty: ${ORIGINAL_PACKAGES}"
+[ -z "${FINAL_PACKAGES}" ] || die "final packages were not empty: ${FINAL_PACKAGES}"