`\cd` only bypasses aliases, so a user-defined `cd` function (eg, cdhist's) still ran,
and broke `NVM_DIR` auto-detection when it rejected zsh's `-q`.
Use `command cd`, which skips functions in POSIX shells.
zsh's `command` runs `/usr/bin/cd` instead of the builtin,
so use `builtin cd` there, as `nvm_echo` does for `printf`.
`nvm_die_on_prefix` also now uses `nvm_cd` instead of a bare `cd`.
Fixes#3835. See #3836.
Co-authored-by: Elan Ruusamäe <glen@delfi.ee>
Each container job now looks up the image's index, manifest,
and config digests from the registry,
keys an `actions/cache` entry on the config digest,
and only uses a cached image if its ID matches one of those digests;
otherwise it is discarded and the image is pulled (with retries) instead.
A poisoned or stale cache entry can therefore never be used,
and a cache hit needs only a couple of small manifest requests,
so this scales regardless of pull rate limits.
DockerHub's anonymous pull rate limit applies per IP for hours,
so retrying cannot ride it out on shared runners;
`mirror.gcr.io` serves the same official images without that limit,
as the io.js source-install job already does.
nvm_change_path interpolated `$NVM_DIR` and the new version dir unescaped into grep and sed expressions,
so a path containing `&`, `#`, `[`, `*`, etc. corrupted `$PATH` (or made sed fail) when switching versions.
Escape them before use.
When `nvm use` is given an exact `vX.Y.Z` that is already installed,
and no alias with that exact name exists,
use it directly instead of re-resolving it through
`nvm_match_version` and `nvm_ensure_version_installed`,
both of which call `nvm_version`.
`nvm_auto` takes this path on every shell startup with an already-resolved version,
so this removes ~95ms from each new shell
(~330ms -> ~235ms in a clean environment on macOS/zsh).
Fixes#3930
Moving WSL package installs out of `setup-wsl`'s `additional-packages` lost its non-interactive setup:
on Ubuntu 18.04, upgrading `libssl1.1` asks whether to restart services,
and the job waited on that dialog until it was cancelled.
Set `DEBIAN_FRONTEND=noninteractive`,
keep existing config files without asking, and give apt no stdin.
Mirror outages have outlasted the existing retries,
which covered only `apt-get update` (and not the WSL `additional-packages` install).
Installs now go through `.github/scripts/apt-install.sh`,
which retries each request within apt and retries the whole update+install with backoff for about 10 minutes.
macOS covers a case-insensitive filesystem and bash 3.2
(`/bin/sh`, `/bin/bash`);
WSL covers Windows.
Both run it as the Linux jobs do:
without a system node, with a PTY,
and on WSL as a non-root user with passwordless sudo.
- `nvm_get_arch`: the unmocked smartos cases fall through to the host, so only run them on x86_64
- `nvm_get_arch_unofficial`: the chroot checks need x86_64 glibc Linux
- `nvm_install_no_progress_bar`: derive the tarball slug and checksum tool instead of assuming linux-x64 and `sha256sum`
bash 3.2 (macOS `/bin/bash` and `/bin/sh`) exec-optimizes a trailing `command` call inside a function run as a background job,
which silently drops the output of nested command substitutions;
in `nvm alias` that lost installed-alias colors and some default aliases,
Running each job in an explicit subshell avoids it.
`nvm_install_binary` and `nvm_install_source` declared `local TMPDIR` without initializing it, and remove it with `rm -rf` on failure. dash's `local` keeps the caller's value, as does bash's when `TMPDIR` is passed as a prefix assignment (`TMPDIR=… nvm install`), so a failed download removed the caller's temp directory; on macOS, `tar` instead blocked reading the archive from the terminal.
Fixes#2786.
Ben Younes added the alias annotations to bare `nvm ls-remote`, with their regression tests;
Jordan Harband moved `(Latest: node)` onto the newest node release, gave each kind of annotation a fixed column so the output can be sliced with `cut`, matched aliases to versions in one pass, and kept local aliases out of the mocks and tests.
Co-authored-by: Ben Younes <2910651+ousamabenyounes@users.noreply.github.com>
Co-authored-by: Jordan Harband <ljharb@gmail.com>
`nvm_is_valid_version` accepted strings like `123.js`, `v1.js`, and `1.2.3.4.5.6.js`, because `nvm_version_greater_than_or_equal_to` exits as soon as the first number is greater than zero, without looking at the rest.
So `nvm run 123.js` failed with `N/A: version "v123.js" is not yet installed` instead of running the file.
It now checks the shape first: one to three dot-separated numbers, optionally with a trailing dot, and a prerelease suffix (rc, nightly, v8-canary, test builds) only after a full `x.y.z`.
A suffix with a dot followed by a non-digit, like a file extension, is rejected, so names like `1.2.3-foo.js` are treated as files too.
Every version listed in the nodejs.org and iojs.org `index.tab` files is still accepted, so shell startup keeps using a `default` alias that resolves to an installed prerelease.
Names that are also valid versions, like `123` or `v1`, are still treated as versions; `nvm run current 123` runs such a file.
Refs #1166. See #3931.
Bug Fixes
- `nvm_alias`, `nvm_version_path`: reject `..` path components
- `nvm_get_make_jobs`: count cores on platforms the `case` does not name
- `nvm-exec`: improve the no-version failure message
- `nvm use`: do not clobber `man`'s default search path (#3890)
- `nvm_err`, `nvm_err_with_colors`: do not fail when stderr is closed (#3907)
- `nvm_hash_reset`: only run `hash -r` where the shell supports it
- `nvm_alias`: unset zsh's `extendedglob` while reading an alias file (#3891)
- zsh: restore `nomatch` and `markdirs` rather than clobbering them
- `nvm --help`: render the set-colors legend in color (#3915)
- `nvm unload`: drop the undefined `nvm_format_help_message_colors`
- `nvm_get_mirror`: allow ports, userinfo, IPv6 hosts, and percent-encoding
- `nvm_sanitize_auth_header`: allow `~`, completing RFC 7235 `token68` (#3751)
Refactors
- `nvm --help`: extract the set-colors legend into `nvm_print_color_legend`
Performance
- Optimize nvm_tree_contains_path with in-memory POSIX parent-walk (#3912)
Docs
- [readme] document platforms with no official node binaries
- `install.sh`: Fix missing words in bash/zsh completion message (#3887)
- Remove stray closing HTML tag (#3919)
Misc
- [meta] remove CLAUDE.md symlink in favor of AGENTS.md (#3928)
- [meta] add `release-notes.sh`, the release notes generator
Tests
- homebrew/actions changed their default branch
- [actions] WSL: pin every distribution, and test the newest of each line
- `nvm_print_color_legend`: look up the function with `PATH` emptied
- `nvm_print_color_legend`: check for the function, not a same-named file
- `nvm_print_color_legend`: fix the `fast` suite on GNU userlands
- [actions] `release.yml`: provide `GH_TOKEN` so release-notes PR lookup can run
`nvm_alias` concatenated the requested name onto `$NVM_DIR/alias` and read whatever that resolved to,
so a name with a `..` component escaped the alias dir
- under the default layout, `../../.npmrc` reaches `$HOME/.npmrc`.
`nvm_print_alias_file` echoes every non-comment line of what it opens,
and `nvm use` reports the first one in its "is not yet installed" error,
so an untrusted `.nvmrc` could disclose any file the invoking user can read.
The write side already rejected `..` in an alias name (9275c5ba);
apply the same check on the read side, and to `nvm_version_path`,
which composes a version into a path with no check of its own.
Slashes stay legal, since `lts/iron` and the `lts/*` alias file depend on them.
`nvm_get_os` also returns `win` (Cygwin/MSYS/MinGW) and the empty string,
neither of which had an arm,
so `NVM_CPU_CORES` went unassigned
and nvm asked the user to report a gap it already knew about.
On an unrecognized `uname` that also meant a single-threaded source build;
`win` refuses source builds a few lines later either way.
`NUMBER_OF_PROCESSORS` comes last because Windows scopes it to the calling process' processor group.
Assigning `NVM_CPU_CORES` in every arm also keeps the
`nvm_is_natural_num` check below from aborting dash and ksh under `set -u`.
The README never said which platforms nvm can detect but nodejs.org does not build for,
so a user on one of them only finds out from a slow, silent, source-build fallback.
Also corrects the Alpine section:
nvm remaps Alpine to a musl arch itself now,
and nodejs.org has published `linux-x64-musl` since v24.20.0,
so both the "no concrete plans" and the "does not exist errors" claims are out of date.
Coverage bounds are stated per release line rather than per patch,
since the newest of them are still shipping.
The message claimed "no .nvmrc file found" even when one was found and its version simply was not installed,
and it never mentioned that `NODE_VERSION=default` selects the `default` alias.
Refs #3810
Replace looping subshell process forks (dirname)
in nvm_tree_contains_path with case-guarded in-memory POSIX parameter expansion () and exact string equality comparisons.
Ensures literal string matching for glob metacharacters (*, ?, [])
and full zsh compatibility across all platforms.
`man` consults its own configured search path only when MANPATH holds an empty entry;
a list without one replaces the default outright.
`nvm use` produced exactly that,
so activating a version could hide every system man page.
Contribute the empty entry as a trailing one,
so that nvm's directory keeps precedence over the system's,
and only when the list has none already,
so that repeated `nvm use` calls are idempotent and an empty entry the user placed stays where they put it.
The `$(manpath)` snapshot this replaces went stale the moment man's configuration changed,
and cost a subprocess per `nvm use`.
It was also dead: `local MANPATH` scoped the assignment to `nvm()`,
so `export` did not outlive the call and MANPATH went untouched whenever it started out unset.
Only ksh, where `local` is not a builtin, ever ran it.
`nvm deactivate` now unsets MANPATH where nvm's was the only real entry,
rather than leaving a bare `:` behind.
Reported and diagnosed by @al0ksar in #3890, which used a leading empty entry instead.
That one accrues one more colon on every `nvm use`,
which `nvm deactivate` then leaves behind,
and it loses to the system's man pages wherever nvm's bin directory is not first on PATH.
Supersedes #2077.
Refs #3890
Refs #2077
The Ubuntu entries were pinned but `Debian` and `Alpine` were floating
aliases, so what those jobs tested drifted whenever the action updated.
Every line now carries a pin and the newest release setup-wsl offers for
it: Debian 12 and 13, Ubuntu 18.04, 20.04 and 24.04, Alpine 3.17 and 3.23.
`Alpine-3.17` is the image the unofficial jobs already ran, named
explicitly. Debian's pin is 12 rather than 11 because `Debian` and
`Debian-11` share a floating `aka.ms/wsl-debian-gnulinux` redirect and so
cannot be held still at all, where `Debian-12` is an immutable
salsa.debian.org artifact. The Debian-only steps key off `startsWith`, so
both Debian entries take the same path and moving a pin will not strand them.
There is no floating "newest" name to use instead: `kali-linux` is the only
unversioned distribution left, and setup-wsl's own CI disables
`additional-packages` on it. The newest only moves when the action's major
does, so the `uses:` ref is the thing to keep current.
Which is the other half of this: move that ref from v6 to v7. v6 is a dead
major, five months stale at v6.1.0 with no v6.2.0 and v7.0.0 tagged the next
day, so new distributions will only ever appear on v7 and later. v7's only
removals are the deprecated bare `Debian` and `Alpine`, which pinning has
already stopped using, and every name here is valid on both. It also drops
the Node.js 20 deprecation warning each WSL job currently emits, and it
tightens two pins that v6 left floating: Ubuntu 20.04 moves from
`aka.ms/wslubuntu2004` to a 20.04.6 image on releases.ubuntu.com, and 24.04
to a 24.04.4 one. Six of the seven platforms are now immutable artifacts;
Ubuntu 18.04 predates the format and still redirects through aka.ms.
Choosing a supported Debian also settles the 404s that had been failing
every Debian job: bullseye left LTS on 2026-08-31 and its security suite is
between homes, with `security.debian.org` still publishing an index whose
pool is being pruned and `archive.debian.org` carrying no `debian-security`
for bullseye yet. bookworm is on live mirrors, so `ca-certificates` is
current again, which matters for a job whose whole purpose is to fetch nvm
and node over TLS.
To keep a pin working once its release ages out in turn, derive sources.list
from the image's own codename and list every layout a release passes through:
main and security move to the archive on separate schedules, and the security
suite is renamed to `<codename>/updates` on the way. `apt-get update`
discards whichever entries 404, and where an index outlives its pool we fall
back once to main alone. Debian 13 moved to deb822, so clear both formats
first and leave what we write as the only thing apt reads.
Drop the blanket `apt-get upgrade` with it: it fetched 77 packages the test
never uses, and `apt-get install` already takes the newest version any
working mirror offers.
Under bash's `set +h`, `hash -r` errors with "hash: hashing disabled",
which is then printed on every `nvm use`, including the one at shell startup.
Guarding on `$-` alone would be wrong:
`zsh` never puts `h` in `$-` - there `h` is `HIST_IGNORE_DUPS` -
and `dash` has no `h` flag at all,
so it would skip the call in 3 of the 4 shells the fast suite runs.
Gate on the shell instead, and skip only where the call fails:
bash under `set +h`, and `ksh93`, whose `hash` takes no `-r` and whose
usage error aborts `nvm use` before it can export `NVM_BIN`.
`ksh` is detected by probing rather than by version,
so `mksh` and `pdksh`, which do accept `-r`, keep getting the call.
The `${-#*h}` test is from #3910.
Refs #2065
Refs #3247
`#` is a repetition operator under `extendedglob`,
so `${VAR%%#*}` is an invalid pattern:
zsh aborts the expansion and `nvm_alias` silently prints nothing,
leaving the `default` alias unresolved when nvm.sh is sourced.
The read loop moves into `nvm_print_alias_file` so that `local_options`
scopes the option change to that section alone,
rather than to everything `nvm_alias` does,
and restores whatever the caller had set.
Fixes#3885
Co-authored-by: debaditya <debaditya2005hait@gmail.com>
Co-authored-by: Jordan Harband <ljharb@gmail.com>
`unsetopt local_options nomatch` unsets both named options,
so LOCAL_OPTIONS is off by the time the function returns and the
`nomatch` change escapes into the caller's shell:
one `nvm ls` or `nvm alias` leaves NO_MATCH off for the rest of the session,
after which an unmatched glob is silently passed through as a literal.
`setopt local_options nonomatch`,
already used in `nvm_check_file_permissions`, restores on return.
The `markdirs` line also cancelled the snapshot
taken for `shwordsplit` on the line above it;
that one is latent,
as `nvm_ls` is only ever called inside a command substitution.
Every legend line is built inside a command substitution,
where `nvm_has_colors` can never succeed,
because `[ -t 1 ]` sees the capture pipe rather than the terminal.
The legend has therefore always printed plain,
on every terminal and in every shell.
Resolve color support once and pass it in,
the way `nvm_print_alias_path` already accepts the same flag.
A command-prefix assignment cannot carry it:
POSIX expands a command's arguments before applying its assignments,
so the substitutions would still see it unset,
and in sh and ksh it would outlive the call and override `--no-colors` for everything after.
The test needs no tty,
and fails against an unfixed `nvm.sh` in sh, bash, dash, and zsh.
Fixes#3896
The presence checks were still satisfiable by this test file itself,
which is an executable named `nvm_print_color_legend`.
Filtering `command -v` output on a `/` was not enough:
dash and zsh report a bare name,
not a path,
for a current-directory match reached through an empty `PATH` component,
and that is indistinguishable from a function.
So `nvm unload` looked as though it had left the function behind in exactly the shells CI runs as `sh`, `dash`, and `zsh`,
while bash, which reports `./name`, passed.
Emptying `PATH` for the lookup asks about the function alone,
and is immune to whatever `PATH` happens to hold.
Reproduced first, then fixed:
with `PATH=":${PATH}"` the previous check fails under dash and zsh
and passes under bash, matching CI exactly.
The assertions now hold in sh, bash, dash, and zsh
with the directory absent from `PATH`, present on it, and via an empty entry,
and both dropping `nvm_print_color_legend` from `nvm unload`
and renaming the function out from under the guard
are still caught in all twelve combinations.
