mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-10-27 01:05:20 +08:00
c8a2a81f92
curl only skips reading `.curlrc` when `-q` is its very first argument; anywhere else, the config file has already been read by the time `-q` is seen.a4f89c62added `-q` to every curl call so that a user's `.curlrc` would not affect nvm, but6a3b1dd2(v0.33.2) put `--compressed` in front of it everywhere.bd090ef7(v0.40.0) moved it back to the front in `nvm.sh`'s `nvm_download`, and then6d870d18(v0.40.5) began building those arguments with `set --`, prepending `--compressed` after `-q`, so whenever curl supports compression, `-q` was second again. `nvm_get_latest` and `install.sh`'s `nvm_download` have passed `--compressed` before `-q` since v0.33.2. Pass `-q` first in all three places. Settings in a user's `.curlrc` (such as a proxy, CA bundle, or `write-out`) no longer apply to nvm's own curl calls, as was intended, and as in v0.40.0 through v0.40.4 for `nvm_download`; the corresponding environment variables (eg, `https_proxy`, `CURL_CA_BUNDLE`) still apply. The existing `nvm_get_latest` test pinned the old argument order, so its expectation is updated Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.