Compare commits

..

1 Commits

Author SHA1 Message Date
Jordan Harband
833530eb12 [Tests] attempt to fix failing test 2023-11-03 15:51:24 -07:00
28 changed files with 163 additions and 645 deletions

View File

@@ -26,10 +26,3 @@ insert_final_newline = off
[Makefile]
indent_style = tab
[test/fixtures/nvmrc/**]
indent_style = off
insert_final_newline = off
[test/fixtures/actual/alias/empty]
insert_final_newline = off

2
.gitattributes vendored
View File

@@ -1 +1 @@
* text=auto eol=lf
* eol=lf

4
.github/SECURITY.md vendored
View File

@@ -21,7 +21,3 @@ We meet 95% of the “silver” criteria. The gaps are as follows:
We meet 65% of the “gold” criteria. The gaps are as follows:
- we do not yet have the “silver” badge; see all the gaps above.
- We do not include a copyright or license statement in each source file. Efforts are underway to change this archaic practice into a suggestion instead of a hard requirement.
## Threat Model
See [THREAT_MODEL.md](./THREAT_MODEL.md).

View File

@@ -1,109 +0,0 @@
# `nvm` Threat Model
## Introduction
Threat model analysis assists organizations to proactively identify potential security threats and vulnerabilities, enabling them to develop effective strategies to mitigate these risks before they are exploited by attackers.
Furthermore, this often helps to improve the overall security and resilience of a system or application.
The aim of this section is to facilitate the identification of potential security threats and vulnerabilities that may be exploited by adversaries, along with possible outcomes and appropriate mitigations.
## Relevant assets and threat actors
The following assets are considered important for the `nvm` project:
- `nvm` source code and project documentation
- Underlying `nvm` dependencies
- `nvm` development infrastructure
- `nvm` installed devices including servers
The following threat actors are considered relevant to the `nvm` application:
- External malicious attackers
- Internal malicious attackers
- Services
- Malicious insider actors
- Third-party libraries
## Attack surface for external/internal attackers and services
In threat modeling, an attack surface refers to any possible point of entry that an attacker might use to exploit a system or application.
This includes all the paths and interfaces that an attacker may use to access, manipulate or extract sensitive data from a system.
By understanding the attack surface, organizations are typically able to identify potential attack vectors and implement appropriate countermeasures to mitigate risks.
In the following diagrams, _External Malicious Attacker_ applies to threat actors who do not yet have direct access to the `nvm` application and the underlying operating system, while the _Internal Malicious Attacker_ applies to an attacker with access to the device (computer, server), potentially after successfully exploiting a threat from the _External Malicious Attacker_ scenario.
**Please note that some of the external threats may be also exploitable from internal threats and vice versa.**
<img src="./external-threat-actor.png" alt="Fig.: Possible attacks from internal and external threat actors and services" />
Fig.: Possible attacks from internal and external threat actors and services
## Identified threats
The identified threats against the `nvm` application are as follows:
### Threat ID 1: `nvm` commands
Overview: The `nvm` commands and subcommands take user input for handling and executing appropriate functions from the project directory (or any parent directory).
When user-controlled inputs are not adequately validated and later passed to the `nvm` functions as a part of a command, an attacker might be able to execute operating system commands triggered by any parsing functionality.
Possible Outcome: Attacks against `nvm` commands could lead to unauthorized access to user data or unauthorized access to the device (i.e. laptop or server, depending on where `nvm` is installed), resulting in loss of user private data stored on the device, among other possibilities.
Recommendation: Input validation should be implemented to prevent attackers from requesting operating system commands.
Similarly, secure coding practices ought to be in place to minimize the risk of buffer overflow vulnerabilities.
### Threat ID 2: URI scheme
Overview: `nvm` commands heavily use the [Secure HyperText Transfer](https://datatracker.ietf.org/doc/html/rfc2660) protocol for `nvm` related actions.
Missing [scheme](https://datatracker.ietf.org/doc/html/rfc3986#section-3.1) validation for any `nvm` command might result in file retrieval, enumeration, file overwrite, or [path traversal](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/01-Testing_Directory_Traversal_File_Include) attacks.
An example of this could be path validation for [`nvm_download`](https://github.com/nvm-sh/nvm/blob/ef7fc2f2c06ad75fe7fbabf28d427561ae7b007d/nvm.sh#L118), among many other possibilities.
Possible Outcome: Security misconfiguration flaws for URI scheme may lead to unauthorized access to user data, as well as data integrity compromises.
Recommendation: Adequate input validation should be implemented to prevent attackers from enumerating, retrieving and writing to application files and paths.
### Threat ID 3: Communication channel
Overview: The `nvm` commands and its subcommands use network protocol to communicate with external services.
Insecure communication may allow malicious attackers to perform [_Man-in-the-Middle_](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack) attacks in order to manipulate the data sent during the users active connection.
Possible Outcome: Usage of plaintext communication protocols, like HTTP could lead to data sniffing and modification through insecure communications channels.
Recommendation: Mitigation countermeasures such as data encryption should be in place to prevent data manipulation via insecure communication channels.
### Threat ID 4: Environment variables
Overview: Each `nvm` installation defines its environment variables, which should be secured from internal malicious attackers, preventing access control attack vectors.
Missing stringent restrictions on setting variables, might allow attackers to prepare various targeted attacks against other local users, who use `nvm` in their user space.
For example, [_Privilege Escalation_](https://owasp.org/Top10/A01_2021-Broken_Access_Control/), [_Command Injection_](https://cwe.mitre.org/data/definitions/77.html), as well as many other parser-related attacks.
Possible Outcome: Attacks against environment variables could lead to unauthorized access to the user space, resulting in the loss of user private data and disruptions in service availability.
Recommendation: Adequate hardening of configuration file permissions should be in place for all relevant configuration files, as this provides protection against attackers able to manipulate variables and inject malicious code.
## Attack surface for malicious insider actors and third-party libraries
The following diagram summarizes the main possible threats against the `nvm` project from malicious insider actors and third-party libraries:
<img src="./insider-threat-actor-and-libs.png" alt="Fig.: Possible attacks from insider threat actors and third-party libraries" />
Fig.: Possible attacks from insider threat actors and third-party libraries
The identified threats against the `nvm` project are as follows:
### Threat ID 1: Insider threat actor
**Overview**: An insider threat actor, such as an `nvm` project contributor or employee with access to the code base, might abuse their role in the organization to modify the `nvm` application source code.
For example, intentionally adding malicious code snippets, clearing logs after being written and/or modifying specific sections of the documentation.
**Possible Outcome**: Reputation damage, financial losses.
**Recommendation**: Secure coding practices, code reviews, automated code scanning and separation of duties (i.e. requiring at least two developers to approve any code change) are potentially useful security controls to identify and mitigate vulnerabilities that may be introduced by an insider threat actor.
### Threat ID 2: Third-party libraries
**Overview**: Please note that while `nvm` does not currently make use of any third-party libraries, this might become an attack vector if that changes in the future.
Third-party libraries may introduce potential risks related to maintaining security requirements by third-party vendors.
As a result, third-party libraries used by the `nvm` project, might contain vulnerabilities, such as [_Buffer Overflows_](https://owasp.org/www-community/vulnerabilities/Buffer_Overflow), [_Format String Vulnerabilities_](https://owasp.org/www-community/attacks/Format_string_attack), as well as many other types of weaknesses that, in a worst-case scenario may lead to _Remote Code Execution_ (_RCE_).
Additionally, the maintainer of a third-party dependency might introduce a vulnerability on purpose, or be compromised by an attacker that subsequently introduces vulnerable code.
**Possible Outcome**: Code vulnerabilities may lead to unauthorized access to user data, loss of user private data, service disruptions and reputation damage.
**Recommendation**: Third-party libraries should be kept up-to-date, applying patches to address publicly known vulnerabilities in a timely fashion.
Monitoring and logging capabilities should also be in place to detect and respond to potential attacks.
SLSA compliance may also be considered for further supply chain security hardening.

Binary file not shown.

Before

Width:  |  Height:  |  Size: 134 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 55 KiB

View File

@@ -2,9 +2,6 @@ name: 'Tests: `nvm install-latest-npm`'
on: [pull_request, push]
permissions:
contents: read
jobs:
matrix:
runs-on: ubuntu-latest
@@ -12,12 +9,11 @@ jobs:
latest: ${{ steps.set-matrix.outputs.requireds }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
iojs.org:443
nodejs.org:443
raw.githubusercontent.com:443
- uses: ljharb/actions/node/matrix@main
id: set-matrix
with:
@@ -50,7 +46,7 @@ jobs:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
@@ -58,7 +54,7 @@ jobs:
iojs.org:443
nodejs.org:443
registry.npmjs.org:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- uses: ljharb/actions/node/install@main
name: 'install node'
with:
@@ -78,4 +74,8 @@ jobs:
needs: [nodes]
runs-on: ubuntu-latest
steps:
- run: true
- name: Harden Runner
uses: step-security/harden-runner@v1
with:
egress-policy: block
- run: 'echo tests completed'

View File

@@ -2,21 +2,20 @@ name: 'Tests: linting'
on: [pull_request, push]
permissions:
contents: read
jobs:
eclint:
permissions:
contents: read
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@v2
- uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
raw.githubusercontent.com:443
nodejs.org:443
registry.npmjs.org:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- uses: ljharb/actions/node/install@main
name: 'nvm install ${{ matrix.node-version }} && npm install'
with:
@@ -24,9 +23,11 @@ jobs:
- run: npm run eclint
dockerfile_lint:
permissions:
contents: read
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@v2
- uses: step-security/harden-runner@v1
with:
allowed-endpoints:
ghcr.io:443
@@ -35,7 +36,7 @@ jobs:
pkg-containers.githubusercontent.com:443
nodejs.org:443
registry.npmjs.org:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- uses: ljharb/actions/node/install@main
name: 'nvm install ${{ matrix.node-version }} && npm install'
with:
@@ -43,16 +44,18 @@ jobs:
- run: npm run dockerfile_lint
doctoc:
permissions:
contents: read
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@v2
- uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
raw.githubusercontent.com:443
nodejs.org:443
registry.npmjs.org:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- uses: ljharb/actions/node/install@main
name: 'nvm install ${{ matrix.node-version }} && npm install'
with:
@@ -60,13 +63,15 @@ jobs:
- run: npm run doctoc:check
test_naming:
permissions:
contents: read
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@v2
- uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
raw.githubusercontent.com:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- name: check tests filenames
run: ./rename_test.sh --check

View File

@@ -2,9 +2,6 @@ name: Automatic Rebase
on: [pull_request_target]
permissions:
contents: read
jobs:
_:
permissions:
@@ -15,12 +12,12 @@ jobs:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
api.github.com:443
github.com:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- uses: ljharb/rebase@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

View File

@@ -2,24 +2,20 @@ name: 'Tests: release process'
on: [pull_request, push]
permissions:
contents: read
jobs:
release:
permissions:
contents: read
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
api.github.com:443
objects.githubusercontent.com:443
raw.githubusercontent.com:443
registry.npmjs.org:443
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: "14"
- run: npm install

View File

@@ -2,9 +2,6 @@ name: Require “Allow Edits”
on: [pull_request_target]
permissions:
contents: read
jobs:
_:
permissions:
@@ -15,7 +12,7 @@ jobs:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
api.github.com:443

View File

@@ -2,11 +2,10 @@ name: 'Tests: shellcheck'
on: [pull_request, push]
permissions:
contents: read
jobs:
shellcheck_matrix:
permissions:
contents: read
runs-on: ubuntu-latest
strategy:
fail-fast: false
@@ -28,14 +27,13 @@ jobs:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
ghcr.io:443
github.com:443
pkg-containers.githubusercontent.com:443
formulae.brew.sh:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- name: Set up Homebrew
uses: Homebrew/actions/setup-homebrew@master
- name: Install latest shellcheck
@@ -53,4 +51,8 @@ jobs:
needs: [shellcheck_matrix]
runs-on: ubuntu-latest
steps:
- run: true
- name: Harden Runner
uses: step-security/harden-runner@v1
with:
egress-policy: block
- run: 'echo tests completed'

View File

@@ -2,9 +2,6 @@ name: urchin tests
on: [push]
permissions:
contents: read
jobs:
tests:
permissions:
@@ -29,7 +26,7 @@ jobs:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
@@ -37,7 +34,7 @@ jobs:
raw.githubusercontent.com:443
nodejs.org:443
iojs.org:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
- run: sudo ${{ matrix.shell }} --version 2> /dev/null || dpkg -s ${{ matrix.shell }} 2> /dev/null || which ${{ matrix.shell }}
- run: curl --version
- run: wget --version
@@ -52,10 +49,8 @@ jobs:
- run: make TERM=xterm-256color TEST_SUITE="${{ matrix.suite }}" SHELL="${{ matrix.shell }}" URCHIN="$(npx which urchin)" test-${{ matrix.shell }}
nvm:
permissions:
contents: none
name: 'all test suites, all shells'
needs: [tests]
runs-on: ubuntu-latest
steps:
- run: true
- run: 'echo tests completed'

View File

@@ -2,9 +2,6 @@ name: update readme TOC
on: [push]
permissions:
contents: read
jobs:
_:
permissions:
@@ -15,12 +12,12 @@ jobs:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
uses: step-security/harden-runner@v1
with:
allowed-endpoints:
github.com:443
registry.npmjs.org:443
- uses: actions/checkout@v4
- uses: actions/checkout@v3
with:
# https://github.com/actions/checkout/issues/217#issue-599945005
# pulls all commits (needed for lerna / semantic release to correctly version)
@@ -28,7 +25,7 @@ jobs:
# pulls all tags (needed for lerna / semantic release to correctly version)
- run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
- uses: actions/setup-node@v4
- uses: actions/setup-node@v3
with:
node-version: '16'
- run: npm install

View File

@@ -2,9 +2,6 @@ name: 'Tests on Windows: `nvm install`'
on: [pull_request, push]
permissions:
contents: read
env:
NVM_INSTALL_GITHUB_REPO: ${{ github.repository }}
NVM_INSTALL_VERSION: ${{ github.sha }}
@@ -50,7 +47,6 @@ jobs:
nvm install ${{ matrix.npm-node-version }}
cygwin_matrix:
continue-on-error: true
permissions:
contents: none
name: 'Cygwin nvm install'
@@ -91,7 +87,6 @@ jobs:
bash.exe "%USERPROFILE%\setup.sh"
wsl_matrix:
continue-on-error: true
name: 'WSL nvm install'
defaults:
run:
@@ -126,7 +121,7 @@ jobs:
- ''
- 'script'
steps:
- uses: Vampire/setup-wsl@v3
- uses: Vampire/setup-wsl@v2
with:
distribution: ${{ matrix.wsl-distrib }}
additional-packages: bash git curl ca-certificates wget
@@ -142,7 +137,6 @@ jobs:
node -v
wsl_matrix_unofficial:
continue-on-error: true
name: 'WSL nvm install'
defaults:
run:
@@ -169,7 +163,7 @@ jobs:
- ''
- 'script'
steps:
- uses: Vampire/setup-wsl@v3
- uses: Vampire/setup-wsl@v2
with:
distribution: ${{ matrix.wsl-distrib }}
additional-packages: bash git curl ca-certificates wget
@@ -187,7 +181,7 @@ jobs:
name: 'tests, on windows'
permissions:
contents: none
needs: [wsl_matrix, wsl_matrix_unofficial, cygwin_matrix, msys_matrix, msys_fail_install]
needs: [wsl_matrix, cygwin_matrix, msys_matrix, msys_fail_install]
runs-on: ubuntu-latest
steps:
- run: true
- run: 'echo tests completed'

3
.gitmodules vendored
View File

@@ -1,3 +0,0 @@
[submodule "test/fixtures/nvmrc"]
path = test/fixtures/nvmrc
url = git@github.com:nvm-sh/nvmrc.git

View File

@@ -8,12 +8,6 @@ addons:
# - gcc-4.8
# - g++-4.8
# https://gist.github.com/iedemam/9830045
git:
submodules: false
group: previous
cache:
ccache: true
directories:
@@ -22,11 +16,6 @@ cache:
before_install:
- sudo sed -i 's/mozilla\/DST_Root_CA_X3.crt/!mozilla\/DST_Root_CA_X3.crt/g' /etc/ca-certificates.conf
- sudo update-ca-certificates -f
# https://gist.github.com/iedemam/9830045
- sed -i 's/git@github.com:/https:\/\/github.com\//' .gitmodules
- git submodule update --init --recursive
- $SHELL --version 2> /dev/null || dpkg -s $SHELL 2> /dev/null || which $SHELL
- curl --version
- wget --version
@@ -34,7 +23,7 @@ before_install:
- zsh --version
- dpkg -s dash | grep ^Version | awk '{print $2}'
# install python
- pyenv local 2.7.18 || pyenv install 2.7.18
- pyenv install 2.7.18
- pyenv local 2.7.18 || echo 'pyenv failed'
- python -V
install:

141
README.md
View File

@@ -6,7 +6,7 @@
</a>
# Node Version Manager [![Build Status](https://app.travis-ci.com/nvm-sh/nvm.svg?branch=master)][3] [![nvm version](https://img.shields.io/badge/version-v0.39.7-yellow.svg)][4] [![CII Best Practices](https://bestpractices.dev/projects/684/badge)](https://bestpractices.dev/projects/684)
# Node Version Manager [![Build Status](https://app.travis-ci.com/nvm-sh/nvm.svg?branch=master)][3] [![nvm version](https://img.shields.io/badge/version-v0.39.5-yellow.svg)][4] [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/684/badge)](https://bestpractices.coreinfrastructure.org/projects/684)
<!-- To update this table of contents, ensure you have run `npm install` then `npm run doctoc` -->
<!-- START doctoc generated TOC please keep comment here to allow auto update -->
@@ -36,15 +36,17 @@
- [Setting Custom Colors](#setting-custom-colors)
- [Persisting custom colors](#persisting-custom-colors)
- [Suppressing colorized output](#suppressing-colorized-output)
- [Restoring PATH](#restoring-path)
- [Set default node version](#set-default-node-version)
- [Use a mirror of node binaries](#use-a-mirror-of-node-binaries)
- [Restoring PATH](#restoring-path)
- [Set default node version](#set-default-node-version)
- [Use a mirror of node binaries](#use-a-mirror-of-node-binaries)
- [.nvmrc](#nvmrc)
- [Deeper Shell Integration](#deeper-shell-integration)
- [Calling `nvm use` automatically in a directory with a `.nvmrc` file](#calling-nvm-use-automatically-in-a-directory-with-a-nvmrc-file)
- [bash](#bash)
- [zsh](#zsh)
- [fish](#fish)
- [bash](#bash)
- [Automatically call `nvm use`](#automatically-call-nvm-use)
- [zsh](#zsh)
- [Calling `nvm use` automatically in a directory with a `.nvmrc` file](#calling-nvm-use-automatically-in-a-directory-with-a-nvmrc-file)
- [fish](#fish)
- [Calling `nvm use` automatically in a directory with a `.nvmrc` file](#calling-nvm-use-automatically-in-a-directory-with-a-nvmrc-file-1)
- [Running Tests](#running-tests)
- [Environment variables](#environment-variables)
- [Bash Completion](#bash-completion)
@@ -99,10 +101,10 @@ nvm is a version manager for [node.js](https://nodejs.org/en/), designed to be i
To **install** or **update** nvm, you should run the [install script][2]. To do that, you may either download and run the script manually, or use the following cURL or Wget command:
```sh
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
```
```sh
wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
```
Running either of the above commands downloads a script and runs it. The script clones the nvm repository to `~/.nvm`, and attempts to add the source lines from the snippet below to the correct profile file (`~/.bash_profile`, `~/.zshrc`, `~/.profile`, or `~/.bashrc`).
@@ -124,7 +126,7 @@ Eg: `curl ... | NVM_DIR="path/to/nvm"`. Ensure that the `NVM_DIR` does not conta
- The installer can use `git`, `curl`, or `wget` to download `nvm`, whichever is available.
- You can instruct the installer to not edit your shell config (for example if you already get completions via a [zsh nvm plugin](https://github.com/ohmyzsh/ohmyzsh/tree/master/plugins/nvm)) by setting `PROFILE=/dev/null` before running the `install.sh` script. Here's an example one-line command to do that: `PROFILE=/dev/null bash -c 'curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash'`
- You can instruct the installer to not edit your shell config (for example if you already get completions via a [zsh nvm plugin](https://github.com/ohmyzsh/ohmyzsh/tree/master/plugins/nvm)) by setting `PROFILE=/dev/null` before running the `install.sh` script. Here's an example one-line command to do that: `PROFILE=/dev/null bash -c 'curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash'`
#### Troubleshooting on Linux
@@ -157,13 +159,13 @@ If you get `nvm: command not found` after running the install script, one of the
If the above doesn't fix the problem, you may try the following:
- If you use bash, it may be that your `.bash_profile` (or `~/.profile`) does not source your `~/.bashrc` properly. You could fix this by adding `source ~/<your_profile_file>` to it or following the next step below.
- If you use bash, it may be that your `.bash_profile` (or `~/.profile`) does not source your `~/.bashrc` properly. You could fix this by adding `source ~/<your_profile_file>` to it or follow the next step below.
- Try adding [the snippet from the install section](#profile_snippet), that finds the correct nvm directory and loads nvm, to your usual profile (`~/.bash_profile`, `~/.zshrc`, `~/.profile`, or `~/.bashrc`).
- For more information about this issue and possible workarounds, please [refer here](https://github.com/nvm-sh/nvm/issues/576)
**Note** For Macs with the Apple Silicon chip, node started offering **arm64** arch Darwin packages since v16.0.0 and experimental **arm64** support when compiling from source since v14.17.0. If you are facing issues installing node using `nvm`, you may want to update to one of those versions or later.
**Note** For Macs with the M1 chip, node started offering **arm64** arch darwin packages since v16.0.0 and experimental **arm64** support when compiling from source since v14.17.0. If you are facing issues installing node using `nvm`, you may want to update to one of those versions or later.
#### Ansible
@@ -172,7 +174,7 @@ You can use a task:
```yaml
- name: Install nvm
ansible.builtin.shell: >
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
args:
creates: "{{ ansible_env.HOME }}/.nvm/nvm.sh"
```
@@ -191,9 +193,9 @@ which should output `nvm` if the installation was successful. Please note that `
### Important Notes
If you're running a system without prepackaged binary available, which means you're going to install node or io.js from its source code, you need to make sure your system has a C++ compiler. For OS X, Xcode will work, for Debian/Ubuntu based GNU/Linux, the `build-essential` and `libssl-dev` packages work.
If you're running a system without prepackaged binary available, which means you're going to install nodejs or io.js from its source code, you need to make sure your system has a C++ compiler. For OS X, Xcode will work, for Debian/Ubuntu based GNU/Linux, the `build-essential` and `libssl-dev` packages work.
**Note:** `nvm` also supports Windows in some cases. It should work through WSL (Windows Subsystem for Linux) depending on the version of WSL. It should also work with [GitBash](https://gitforwindows.org/) (MSYS) or [Cygwin](https://cygwin.com). Otherwise, for Windows, a few alternatives exist, which are neither supported nor developed by us:
**Note:** `nvm` also support Windows in some cases. It should work through WSL (Windows Subsystem for Linux) depending on the version of WSL. It should also work with [GitBash](https://gitforwindows.org/) (MSYS) or [Cygwin](https://cygwin.com). Otherwise, for Windows, a few alternatives exist, which are neither supported nor developed by us:
- [nvm-windows](https://github.com/coreybutler/nvm-windows)
- [nodist](https://github.com/marcelklehr/nodist)
@@ -209,7 +211,7 @@ If you're running a system without prepackaged binary available, which means you
**Note:** We still have some problems with FreeBSD, because there is no official pre-built binary for FreeBSD, and building from source may need [patches](https://www.freshports.org/www/node/files/patch-deps_v8_src_base_platform_platform-posix.cc); see the issue ticket:
- [[#900] [Bug] node on FreeBSD may need to be patched](https://github.com/nvm-sh/nvm/issues/900)
- [[#900] [Bug] nodejs on FreeBSD may need to be patched](https://github.com/nvm-sh/nvm/issues/900)
- [nodejs/node#3716](https://github.com/nodejs/node/issues/3716)
**Note:** On OS X, if you do not have Xcode installed and you do not wish to download the ~4.3GB file, you can install the `Command Line Tools`. You can check out this blog post on how to just that:
@@ -234,7 +236,7 @@ If you have `git` installed (requires git v1.7.10+):
1. clone this repo in the root of your user profile
- `cd ~/` from anywhere then `git clone https://github.com/nvm-sh/nvm.git .nvm`
1. `cd ~/.nvm` and check out the latest version with `git checkout v0.39.7`
1. `cd ~/.nvm` and check out the latest version with `git checkout v0.39.5`
1. activate `nvm` by sourcing it from your shell: `. ./nvm.sh`
Now add these lines to your `~/.bashrc`, `~/.profile`, or `~/.zshrc` file to have it automatically sourced upon login:
@@ -298,13 +300,6 @@ To install a specific version of node:
nvm install 14.7.0 # or 16.3.0, 12.22.1, etc
```
To set an alias:
```sh
nvm alias my_alias v14.4.0
```
Make sure that your alias does not contain any spaces or slashes.
The first version installed becomes the default. New shells will start with the default version of node (e.g., `nvm alias default`).
You can list available versions using `ls-remote`:
@@ -361,7 +356,7 @@ Any time your local copy of `nvm` connects to https://nodejs.org, it will re-cre
To get the latest LTS version of node and migrate your existing installed packages, use
```sh
nvm install --reinstall-packages-from=current 'lts/*'
nvm install 'lts/*' --reinstall-packages-from=current
```
### Migrating Global Packages While Installing
@@ -369,7 +364,7 @@ nvm install --reinstall-packages-from=current 'lts/*'
If you want to install a new version of Node.js and migrate npm packages from a previous version:
```sh
nvm install --reinstall-packages-from=node node
nvm install node --reinstall-packages-from=node
```
This will first use "nvm version node" to identify the current version you're migrating packages from. Then it resolves the new version to install from the remote server and installs it. Lastly, it runs "nvm reinstall-packages" to reinstall the npm packages from your prior version of Node to the new one.
@@ -377,8 +372,8 @@ This will first use "nvm version node" to identify the current version you're mi
You can also install and migrate npm packages from specific versions of Node like this:
```sh
nvm install --reinstall-packages-from=5 6
nvm install --reinstall-packages-from=iojs v4.2
nvm install 6 --reinstall-packages-from=5
nvm install v4.2 --reinstall-packages-from=iojs
```
Note that reinstalling packages _explicitly does not update the npm version_ — this is to ensure that npm isn't accidentally upgraded to a broken version for the new node version.
@@ -386,7 +381,7 @@ Note that reinstalling packages _explicitly does not update the npm version_ —
To update npm at the same time add the `--latest-npm` flag, like this:
```sh
nvm install --reinstall-packages-from=default --latest-npm 'lts/*'
nvm install 'lts/*' --reinstall-packages-from=default --latest-npm
```
or, you can at any time run the following command to get the latest supported npm version on the current node version:
@@ -420,7 +415,7 @@ nvm install iojs
If you want to install a new version of io.js and migrate npm packages from a previous version:
```sh
nvm install --reinstall-packages-from=iojs iojs
nvm install iojs --reinstall-packages-from=iojs
```
The same guidelines mentioned for migrating npm packages in node are applicable to io.js.
@@ -493,14 +488,14 @@ nvm help --no-colors
TERM=dumb nvm ls
```
### Restoring PATH
#### Restoring PATH
To restore your PATH, you can deactivate it:
```sh
nvm deactivate
```
### Set default node version
#### Set default node version
To set a default Node version to be used in any new shell, use the alias 'default':
```sh
@@ -509,7 +504,7 @@ nvm alias default 18 # this refers to the latest installed v18.x version of node
nvm alias default 18.12 # this refers to the latest installed v18.12.x version of node
```
### Use a mirror of node binaries
#### Use a mirror of node binaries
To use a mirror of the node binaries, set `$NVM_NODEJS_ORG_MIRROR`:
```sh
@@ -570,11 +565,7 @@ Now using node v5.9.1 (npm v3.7.3)
`nvm use` et. al. will traverse directory structure upwards from the current directory looking for the `.nvmrc` file. In other words, running `nvm use` et. al. in any subdirectory of a directory with an `.nvmrc` will result in that `.nvmrc` being utilized.
The contents of a `.nvmrc` file **must** contain precisely one `<version>` (as described by `nvm --help`) followed by a newline. `.nvmrc` files may also have comments. The comment delimiter is `#`, and it and any text after it, as well as blank lines, and leading and trailing white space, will be ignored when parsing.
Key/value pairs using `=` are also allowed and ignored, but are reserved for future use, and may cause validation errors in the future.
Run [`npx nvmrc`](https://npmjs.com/nvmrc) to validate an `.nvmrc` file. If that tools results do not agree with nvm, one or the other has a bug - please file an issue.
The contents of a `.nvmrc` file **must** be the `<version>` (as described by `nvm --help`) followed by a newline. No trailing spaces are allowed, and the trailing newline is required.
### Deeper Shell Integration
@@ -584,53 +575,52 @@ You can also use [`nvshim`](https://github.com/iamogbz/nvshim) to shim the `node
If you prefer a lighter-weight solution, the recipes below have been contributed by `nvm` users. They are **not** supported by the `nvm` maintainers. We are, however, accepting pull requests for more examples.
#### Calling `nvm use` automatically in a directory with a `.nvmrc` file
#### bash
In your profile (`~/.bash_profile`, `~/.zshrc`, `~/.profile`, or `~/.bashrc`), add the following to `nvm use` whenever you enter a new directory:
##### bash
##### Automatically call `nvm use`
Put the following at the end of your `$HOME/.bashrc`:
```bash
cdnvm() {
command cd "$@" || return $?
nvm_path="$(nvm_find_up .nvmrc | command tr -d '\n')"
nvm_path=$(nvm_find_up .nvmrc | tr -d '\n')
# If there are no .nvmrc file, use the default nvm version
if [[ ! $nvm_path = *[^[:space:]]* ]]; then
declare default_version
default_version="$(nvm version default)"
declare default_version;
default_version=$(nvm version default);
# If there is no default version, set it to `node`
# This will use the latest version on your machine
if [ $default_version = 'N/A' ]; then
nvm alias default node
default_version=$(nvm version default)
if [[ $default_version == "N/A" ]]; then
nvm alias default node;
default_version=$(nvm version default);
fi
# If the current version is not the default version, set it to use the default version
if [ "$(nvm current)" != "${default_version}" ]; then
nvm use default
if [[ $(nvm current) != "$default_version" ]]; then
nvm use default;
fi
elif [[ -s "${nvm_path}/.nvmrc" && -r "${nvm_path}/.nvmrc" ]]; then
elif [[ -s $nvm_path/.nvmrc && -r $nvm_path/.nvmrc ]]; then
declare nvm_version
nvm_version=$(<"${nvm_path}"/.nvmrc)
nvm_version=$(<"$nvm_path"/.nvmrc)
declare locally_resolved_nvm_version
# `nvm ls` will check all locally-available versions
# If there are multiple matching versions, take the latest one
# Remove the `->` and `*` characters and spaces
# `locally_resolved_nvm_version` will be `N/A` if no local versions are found
locally_resolved_nvm_version=$(nvm ls --no-colors "${nvm_version}" | command tail -1 | command tr -d '\->*' | command tr -d '[:space:]')
locally_resolved_nvm_version=$(nvm ls --no-colors "$nvm_version" | tail -1 | tr -d '\->*' | tr -d '[:space:]')
# If it is not already installed, install it
# `nvm install` will implicitly use the newly-installed version
if [ "${locally_resolved_nvm_version}" = 'N/A' ]; then
nvm install "${nvm_version}";
elif [ "$(nvm current)" != "${locally_resolved_nvm_version}" ]; then
nvm use "${nvm_version}";
if [[ "$locally_resolved_nvm_version" == "N/A" ]]; then
nvm install "$nvm_version";
elif [[ $(nvm current) != "$locally_resolved_nvm_version" ]]; then
nvm use "$nvm_version";
fi
fi
}
@@ -641,9 +631,9 @@ cdnvm "$PWD" || exit
This alias would search 'up' from your current directory in order to detect a `.nvmrc` file. If it finds it, it will switch to that version; if not, it will use the default version.
##### zsh
#### zsh
This shell function will install (if needed) and `nvm use` the specified Node version when an `.nvmrc` is found, and `nvm use default` otherwise.
##### Calling `nvm use` automatically in a directory with a `.nvmrc` file
Put this into your `$HOME/.zshrc` to call `nvm use` automatically whenever you enter a directory that contains an
`.nvmrc` file with a string telling nvm which node to `use`:
@@ -675,8 +665,9 @@ add-zsh-hook chpwd load-nvmrc
load-nvmrc
```
##### fish
#### fish
##### Calling `nvm use` automatically in a directory with a `.nvmrc` file
This requires that you have [bass](https://github.com/edc/bass) installed.
```fish
# ~/.config/fish/functions/nvm.fish
@@ -833,13 +824,13 @@ If installing nvm on Alpine Linux *is* still what you want or need to do, you sh
### Alpine Linux 3.13+
```sh
apk add -U curl bash ca-certificates openssl ncurses coreutils python3 make gcc g++ libgcc linux-headers grep util-linux binutils findutils
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
```
### Alpine Linux 3.5 - 3.12
```sh
apk add -U curl bash ca-certificates openssl ncurses coreutils python2 make gcc g++ libgcc linux-headers grep util-linux binutils findutils
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
```
_Note: Alpine 3.5 can only install NodeJS versions up to v6.9.5, Alpine 3.6 can only install versions up to v6.10.3, Alpine 3.7 installs versions up to v8.9.3, Alpine 3.8 installs versions up to v8.14.0, Alpine 3.9 installs versions up to v10.19.0, Alpine 3.10 installs versions up to v10.24.1, Alpine 3.11 installs versions up to v12.22.6, Alpine 3.12 installs versions up to v12.22.12, Alpine 3.13 & 3.14 install versions up to v14.20.0, Alpine 3.15 & 3.16 install versions up to v16.16.0 (**These are all versions on the main branch**). Alpine 3.5 - 3.12 required the package `python2` to build NodeJS, as they are older versions to build. Alpine 3.13+ requires `python3` to successfully build newer NodeJS versions, but you can use `python2` with Alpine 3.13+ if you need to build versions of node supported in Alpine 3.5 - 3.15, you just need to specify what version of NodeJS you need to install in the package install script._
@@ -855,12 +846,8 @@ As a potential alternative, @mhart (a Node contributor) has some [Docker images
To remove `nvm` manually, execute the following:
First, use `nvm unload` to remove the nvm command from your terminal session and delete the installation directory:
```sh
$ nvm_dir="${NVM_DIR:-~/.nvm}"
$ nvm unload
$ rm -rf "$nvm_dir"
$ rm -rf "$NVM_DIR"
```
Edit `~/.bashrc` (or other shell resource config) and remove the lines below:
@@ -942,9 +929,9 @@ You have to make sure that the user directory name in `$HOME` and the user direc
To change the user directory and/or account name follow the instructions [here](https://support.apple.com/en-us/HT201548)
[1]: https://github.com/nvm-sh/nvm.git
[2]: https://github.com/nvm-sh/nvm/blob/v0.39.7/install.sh
[2]: https://github.com/nvm-sh/nvm/blob/v0.39.5/install.sh
[3]: https://app.travis-ci.com/nvm-sh/nvm
[4]: https://github.com/nvm-sh/nvm/releases/tag/v0.39.7
[4]: https://github.com/nvm-sh/nvm/releases/tag/v0.39.5
[Urchin]: https://git.sdf.org/tlevine/urchin
[Fish]: https://fishshell.com
@@ -957,12 +944,12 @@ Ignore insecure directories and continue [y] or abort compinit [n]? y
Homebrew causes insecure directories like `/usr/local/share/zsh/site-functions` and `/usr/local/share/zsh`. This is **not** an `nvm` problem - it is a homebrew problem. Refer [here](https://github.com/zsh-users/zsh-completions/issues/680) for some solutions related to the issue.
**Macs with Apple Silicon chips**
**Macs with M1 chip**
Experimental support for the Apple Silicon chip architecture was added in node.js v15.3 and full support was added in v16.0.
Experimental support for the M1 architecture was added in node.js v15.3 and full support was added in v16.0.
Because of this, if you try to install older versions of node as usual, you will probably experience either compilation errors when installing node or out-of-memory errors while running your code.
So, if you want to run a version prior to v16.0 on an Apple Silicon Mac, it may be best to compile node targeting the `x86_64` Intel architecture so that Rosetta 2 can translate the `x86_64` processor instructions to ARM-based Apple Silicon instructions.
So, if you want to run a version prior to v16.0 on an M1 Mac, it may be best to compile node targeting the `x86_64` Intel architecture so that Rosetta 2 can translate the `x86_64` processor instructions to ARM-based Apple Silicon instructions.
Here's what you will need to do:
- Install Rosetta, if you haven't already done so
@@ -971,7 +958,7 @@ Here's what you will need to do:
$ softwareupdate --install-rosetta
```
You might wonder, "how will my Apple Silicon Mac know to use Rosetta for a version of node compiled for an Intel chip?".
You might wonder, "how will my M1 Mac know to use Rosetta for a version of node compiled for an Intel chip?".
If an executable contains only Intel instructions, macOS will automatically use Rosetta to translate the instructions.
- Open a shell that's running using Rosetta
@@ -1002,7 +989,7 @@ Here's what you will need to do:
If one of these broken versions is installed on your system, the above step will likely still succeed even if you didn't include the `--shared-zlib` flag.
However, later, when you attempt to `npm install` something using your old version of node.js, you will see `incorrect data check` errors.
If you want to avoid the possible hassle of dealing with this, include that flag.
For more details, see [this issue](https://github.com/nodejs/node/issues/39313) and [this comment](https://github.com/nodejs/node/issues/39313#issuecomment-90.39.776)
For more details, see [this issue](https://github.com/nodejs/node/issues/39313) and [this comment](https://github.com/nodejs/node/issues/39313#issuecomment-902395576)
- Exit back to your native shell.
@@ -1029,7 +1016,7 @@ Now you should be able to use node as usual.
If you've encountered this error on WSL-2:
```sh
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:09 --:--:-- 0curl: (6) Could not resolve host: raw.githubusercontent.com
@@ -1050,7 +1037,7 @@ This could simply be solved by running this in your root directory:
sudo chattr +i /etc/resolv.conf
```
This deletes your `resolv.conf` file that is automatically generated when you run WSL, creates a new file and puts `nameserver 8.8.8.8`, then creates a `wsl.conf` file and adds `[network]` and `generateResolveConf = false` to prevent auto-generation of that file.
This deletes your `resolv.conf` file thats automatically generated when u run WSL, creates a new file and puts `nameserver 8.8.8.8`, then creates a `wsl.conf` file and adds `[network]` and `generateResolveConf = false` to prevent auto generation of that file.
You can check the contents of the file by running:

View File

@@ -33,7 +33,7 @@ nvm_install_dir() {
}
nvm_latest_version() {
nvm_echo "v0.39.7"
nvm_echo "v0.39.5"
}
nvm_profile_is_bash_or_zsh() {

114
nvm.sh
View File

@@ -467,89 +467,7 @@ nvm_find_nvmrc() {
fi
}
nvm_nvmrc_invalid_msg() {
local error_text
error_text="invalid .nvmrc!
all non-commented content (anything after # is a comment) must be either:
- a single bare nvm-recognized version-ish
- or, multiple distinct key-value pairs, each key/value separated by a single equals sign (=)
additionally, a single bare nvm-recognized version-ish must be present (after stripping comments)."
local warn_text
warn_text="non-commented content parsed:
${1}"
nvm_err "$(nvm_wrap_with_color_code r "${error_text}")
$(nvm_wrap_with_color_code y "${warn_text}")"
}
nvm_process_nvmrc() {
local NVMRC_PATH="$1"
local lines
local unpaired_line
lines=$(command sed 's/#.*//' "$NVMRC_PATH" | command sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | nvm_grep -v '^$')
if [ -z "$lines" ]; then
nvm_nvmrc_invalid_msg "${lines}"
return 1
fi
# Initialize key-value storage
local keys=''
local values=''
while IFS= read -r line; do
if [ -z "${line}" ]; then
continue
elif [ -z "${line%%=*}" ]; then
if [ -n "${unpaired_line}" ]; then
nvm_nvmrc_invalid_msg "${lines}"
return 1
fi
unpaired_line="${line}"
elif case "$line" in *'='*) true;; *) false;; esac; then
key="${line%%=*}"
value="${line#*=}"
# Trim whitespace around key and value
key=$(nvm_echo "${key}" | command sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
value=$(nvm_echo "${value}" | command sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
# Check for invalid key "node"
if [ "${key}" = 'node' ]; then
nvm_nvmrc_invalid_msg "${lines}"
return 1
fi
# Check for duplicate keys
if nvm_echo "${keys}" | nvm_grep -q -E "(^| )${key}( |$)"; then
nvm_nvmrc_invalid_msg "${lines}"
return 1
fi
keys="${keys} ${key}"
values="${values} ${value}"
else
if [ -n "${unpaired_line}" ]; then
nvm_nvmrc_invalid_msg "${lines}"
return 1
fi
unpaired_line="${line}"
fi
done <<EOF
$lines
EOF
if [ -z "${unpaired_line}" ]; then
nvm_nvmrc_invalid_msg "${lines}"
return 1
fi
nvm_echo "${unpaired_line}"
}
# Obtain nvm version from rc file
nvm_rc_version() {
export NVM_RC_VERSION=''
local NVMRC_PATH
@@ -560,12 +478,7 @@ nvm_rc_version() {
fi
return 1
fi
if ! NVM_RC_VERSION="$(nvm_process_nvmrc "${NVMRC_PATH}")"; then
return 1
fi
NVM_RC_VERSION="$(command head -n 1 "${NVMRC_PATH}" | command tr -d '\r')" || command printf ''
if [ -z "${NVM_RC_VERSION}" ]; then
if [ "${NVM_SILENT:-0}" -ne 1 ]; then
nvm_err "Warning: empty .nvmrc file found at \"${NVMRC_PATH}\""
@@ -765,11 +678,6 @@ nvm_remote_versions() {
NVM_FLAVOR="${NVM_NODE_PREFIX}"
unset PATTERN
;;
*)
if [ "${NVM_IOJS_ORG_MIRROR-x}" = '' ]; then
NVM_FLAVOR="${NVM_NODE_PREFIX}"
fi
;;
esac
if nvm_validate_implicit_alias "${PATTERN-}" 2>/dev/null; then
@@ -2127,18 +2035,12 @@ nvm_get_mirror() {
esac
case "${NVM_MIRROR}" in
*\`* | *\\* | *\'* | *\(* | *' '* )
*\`* | *\\* | *\'* | *\(* )
nvm_err '$NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL'
return 2
;;
esac
if ! nvm_echo "${NVM_MIRROR}" | command awk '{ $0 ~ "^https?://[a-zA-Z0-9./_-]+$" }'; then
nvm_err '$NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL'
return 2
fi
nvm_echo "${NVM_MIRROR}"
}
@@ -3657,7 +3559,7 @@ nvm() {
fi
else
export PATH="${NEWPATH}"
\hash -r
hash -r
if [ "${NVM_SILENT:-0}" -ne 1 ]; then
nvm_echo "${NVM_DIR}/*/bin removed from \${PATH}"
fi
@@ -3789,7 +3691,7 @@ nvm() {
export MANPATH
fi
export PATH
\hash -r
hash -r
export NVM_BIN="${NVM_VERSION_DIR}/bin"
export NVM_INC="${NVM_VERSION_DIR}/include/node"
if [ "${NVM_SYMLINK_CURRENT-}" = true ]; then
@@ -4150,9 +4052,6 @@ nvm() {
# so, unalias it.
nvm unalias "${ALIAS}"
return $?
elif echo "${ALIAS}" | grep -q "#"; then
nvm_err 'Aliases with a comment delimiter (#) are not supported.'
return 1
elif [ "${TARGET}" != '--' ]; then
# a target was passed: create an alias
if [ "${ALIAS#*\/}" != "${ALIAS}" ]; then
@@ -4321,7 +4220,7 @@ nvm() {
NVM_VERSION_ONLY=true NVM_LTS="${NVM_LTS-}" nvm_remote_version "${PATTERN:-node}"
;;
"--version" | "-v")
nvm_echo '0.39.7'
nvm_echo '0.39.5'
;;
"unload")
nvm deactivate >/dev/null 2>&1
@@ -4366,7 +4265,6 @@ nvm() {
nvm_get_colors nvm_set_colors nvm_print_color_code nvm_wrap_with_color_code nvm_format_help_message_colors \
nvm_echo_with_colors nvm_err_with_colors \
nvm_get_artifact_compression nvm_install_binary_extract nvm_extract_tarball \
nvm_process_nvmrc nvm_nvmrc_invalid_msg \
>/dev/null 2>&1
unset NVM_RC_VERSION NVM_NODEJS_ORG_MIRROR NVM_IOJS_ORG_MIRROR NVM_DIR \
NVM_CD_FLAGS NVM_BIN NVM_INC NVM_MAKE_JOBS \

View File

@@ -1,6 +1,6 @@
{
"name": "nvm",
"version": "0.39.7",
"version": "0.39.5",
"description": "Node Version Manager - Simple bash script to manage multiple active node.js versions",
"directories": {
"test": "test"
@@ -43,9 +43,9 @@
"dockerfile_lint": "^0.3.4",
"doctoc": "^2.2.1",
"eclint": "^2.8.1",
"markdown-link-check": "^3.12.2",
"markdown-link-check": "^3.11.2",
"replace": "^1.2.2",
"semver": "^7.6.2",
"semver": "^7.5.4",
"urchin": "^0.0.5"
}
}

View File

@@ -101,147 +101,3 @@ watch() {
kill %2;
return $EXIT_CODE
}
# JSON parsing from https://gist.github.com/assaf/ee377a186371e2e269a7
nvm_json_throw() {
nvm_err "$*"
exit 1
}
nvm_json_awk_egrep() {
local pattern_string
pattern_string="${1}"
awk '{
while ($0) {
start=match($0, pattern);
token=substr($0, start, RLENGTH);
print token;
$0=substr($0, start+RLENGTH);
}
}' "pattern=${pattern_string}"
}
nvm_json_tokenize() {
local GREP
GREP='grep -Eao'
local ESCAPE
local CHAR
# if echo "test string" | grep -Eo "test" > /dev/null 2>&1; then
# ESCAPE='(\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})'
# CHAR='[^[:cntrl:]"\\]'
# else
GREP=nvm_json_awk_egrep
ESCAPE='(\\\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})'
CHAR='[^[:cntrl:]"\\\\]'
# fi
local STRING
STRING="\"${CHAR}*(${ESCAPE}${CHAR}*)*\""
local NUMBER
NUMBER='-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?'
local KEYWORD
KEYWORD='null|false|true'
local SPACE
SPACE='[[:space:]]+'
$GREP "${STRING}|${NUMBER}|${KEYWORD}|${SPACE}|." | TERM=dumb grep -Ev "^${SPACE}$"
}
_json_parse_array() {
local index=0
local ary=''
read -r token
case "$token" in
']') ;;
*)
while :; do
_json_parse_value "${1}" "${index}"
index=$((index+1))
ary="${ary}${value}"
read -r token
case "${token}" in
']') break ;;
',') ary="${ary}," ;;
*) nvm_json_throw "EXPECTED , or ] GOT ${token:-EOF}" ;;
esac
read -r token
done
;;
esac
:
}
_json_parse_object() {
local key
local obj=''
read -r token
case "$token" in
'}') ;;
*)
while :; do
case "${token}" in
'"'*'"') key="${token}" ;;
*) nvm_json_throw "EXPECTED string GOT ${token:-EOF}" ;;
esac
read -r token
case "${token}" in
':') ;;
*) nvm_json_throw "EXPECTED : GOT ${token:-EOF}" ;;
esac
read -r token
_json_parse_value "${1}" "${key}"
obj="${obj}${key}:${value}"
read -r token
case "${token}" in
'}') break ;;
',') obj="${obj}," ;;
*) nvm_json_throw "EXPECTED , or } GOT ${token:-EOF}" ;;
esac
read -r token
done
;;
esac
:
}
_json_parse_value() {
local jpath="${1:+$1,}$2"
local isleaf=0
local isempty=0
local print=0
case "$token" in
'{') _json_parse_object "${jpath}" ;;
'[') _json_parse_array "${jpath}" ;;
# At this point, the only valid single-character tokens are digits.
''|[!0-9]) nvm_json_throw "EXPECTED value GOT >${token:-EOF}<" ;;
*)
value=$token
isleaf=1
[ "${value}" = '""' ] && isempty=1
;;
esac
[ "${value}" = '' ] && return
[ "${isleaf}" -eq 1 ] && [ $isempty -eq 0 ] && print=1
[ "${print}" -eq 1 ] && printf "[%s]\t%s\n" "${jpath}" "${value}"
:
}
_json_parse() {
read -r token
_json_parse_value
read -r token
case "${token}" in
'') ;;
*) nvm_json_throw "EXPECTED EOF GOT >${token}<" ;;
esac
}
nvm_json_extract() {
nvm_json_tokenize | _json_parse | grep -e "${1}" | awk '{print $2 $3}'
}

View File

@@ -1,26 +0,0 @@
#!/bin/sh
\. ../../../nvm.sh
die () { echo "$@" ; exit 1; }
OUTPUT="$(nvm alias foo#bar baz 2>&1)"
EXPECTED_OUTPUT="Aliases with a comment delimiter (#) are not supported."
[ "$OUTPUT" = "$EXPECTED_OUTPUT" ] || die "trying to create an alias with a hash should fail with '$EXPECTED_OUTPUT', got '$OUTPUT'"
EXIT_CODE="$(nvm alias foo#bar baz >/dev/null 2>&1 ; echo $?)"
[ "$EXIT_CODE" = "1" ] || die "trying to create an alias with a hash should fail with code 1, got '$EXIT_CODE'"
OUTPUT="$(nvm alias foo# baz 2>&1)"
EXPECTED_OUTPUT="Aliases with a comment delimiter (#) are not supported."
[ "$OUTPUT" = "$EXPECTED_OUTPUT" ] || die "trying to create an alias ending with a hash should fail with '$EXPECTED_OUTPUT', got '$OUTPUT'"
EXIT_CODE="$(nvm alias foo# baz >/dev/null 2>&1 ; echo $?)"
[ "$EXIT_CODE" = "1" ] || die "trying to create an alias ending with a hash should fail with code 1, got '$EXIT_CODE'"
OUTPUT="$(nvm alias \#bar baz 2>&1)"
EXPECTED_OUTPUT="Aliases with a comment delimiter (#) are not supported."
[ "$OUTPUT" = "$EXPECTED_OUTPUT" ] || die "trying to create an alias starting with a hash should fail with '$EXPECTED_OUTPUT', got '$OUTPUT'"
EXIT_CODE="$(nvm alias \#bar baz >/dev/null 2>&1 ; echo $?)"
[ "$EXIT_CODE" = "1" ] || die "trying to create an alias starting with a hash should fail with code 1, got '$EXIT_CODE'"

View File

@@ -24,6 +24,7 @@ env | grep -v PATH= | grep -v IFS= | sort >> "${AFTER}"
! type nvm > /dev/null 2>&1 || die "nvm not unloaded"
diff "${BEFORE}" "${AFTER}"
DIFF="$(diff "${BEFORE}" "${AFTER}" ||:)"
[ -z "${DIFF}" ] || die "function pollution found: ${DIFF}"

View File

@@ -23,25 +23,18 @@ set -e
[ "$(nvm_get_mirror node std)" = "https://nodejs.org/dist" ] || die "incorrect default node-std mirror"
[ "$(nvm_get_mirror iojs std)" = "https://iojs.org/dist" ] || die "incorrect default iojs-std mirror"
NVM_NODEJS_ORG_MIRROR="https://test-domain"
[ "$(nvm_get_mirror node std)" = "https://test-domain" ] || die "node-std mirror should respect NVM_NODEJS_ORG_MIRROR"
NVM_NODEJS_ORG_MIRROR="test://domain"
[ "$(nvm_get_mirror node std)" = "test://domain" ] || die "node-std mirror should respect NVM_NODEJS_ORG_MIRROR"
unset NVM_NODEJS_ORG_MIRROR
NVM_IOJS_ORG_MIRROR="https://test-domain"
[ "$(nvm_get_mirror iojs std)" = "https://test-domain" ] || die "iojs-std mirror should respect NVM_IOJS_ORG_MIRROR"
NVM_IOJS_ORG_MIRROR="test://domain"
[ "$(nvm_get_mirror iojs std)" = "test://domain" ] || die "iojs-std mirror should respect NVM_IOJS_ORG_MIRROR"
unset NVM_IOJS_ORG_MIRROR
testMirrors() {
NVM_NODEJS_ORG_MIRROR="${1-}"
! nvm_get_mirror node std || die "NVM_NODEJS_ORG_MIRROR errors with command injection attempt (${1-})"
[ "$(nvm_get_mirror node std)" = "" ] || die 'NVM_NODEJS_ORG_MIRROR is protected against command injection'
NVM_NODEJS_ORG_MIRROR='`do something bad`'
! nvm_get_mirror node std || die 'NVM_NODEJS_ORG_MIRROR errors with command injection attempt'
[ "$(nvm_get_mirror node std)" = "" ] || die 'NVM_NODEJS_ORG_MIRROR is protected against command injection'
NVM_IOJS_ORG_MIRROR="${1-}"
! nvm_get_mirror iojs std || die "NVM_IOJS_ORG_MIRROR errors with command injection attempt (${1-})"
[ "$(nvm_get_mirror iojs std)" = "" ] || die 'NVM_IOJS_ORG_MIRROR is protected against command injection'
}
testMirrors '`do something bad`'
testMirrors 'https://nodejs.org/dist; xdg-open http://www.google.com;'
testMirrors 'https://nodejs.org/dist&&xdg-open http://www.google.com;'
testMirrors 'https://nodejs.org/dist|xdg-open http://www.google.com;'
NVM_IOJS_ORG_MIRROR='`do something bad`'
! nvm_get_mirror iojs std || die 'NVM_IOJS_ORG_MIRROR errors with command injection attempt'
[ "$(nvm_get_mirror iojs std)" = "" ] || die 'NVM_IOJS_ORG_MIRROR is protected against command injection'

View File

@@ -1,34 +0,0 @@
#!/bin/sh
die () { echo "$@" ; cleanup ; exit 1; }
cleanup() {
echo 'cleaned up'
}
\. ../../../nvm.sh
\. ../../common.sh
for f in ../../../test/fixtures/nvmrc/test/fixtures/valid/*; do
STDOUT="$(nvm_process_nvmrc $f/.nvmrc 2>/dev/null)"
EXIT_CODE="$(nvm_process_nvmrc $f/.nvmrc >/dev/null 2>/dev/null; echo $?)"
EXPECTED="$(nvm_json_extract node < "${f}/expected.json" | tr -d '"')"
[ "${EXIT_CODE}" = "0" ] || die "$(basename "${f}"): expected exit code of 0 but got ${EXIT_CODE}"
[ "${STDOUT}" = "${EXPECTED}" ] || die "$(basename "${f}"): expected STDOUT of \`${EXPECTED}\` but got \`${STDOUT}\`"
done
for f in ../../../test/fixtures/nvmrc/test/fixtures/invalid/*; do
STDOUT="$(nvm_process_nvmrc $f/.nvmrc 2>/dev/null)"
STDERR="$(nvm_process_nvmrc $f/.nvmrc 2>&1 >/dev/null | awk '{if(NR > 8) print $0}' | strip_colors)"
EXIT_CODE="$(nvm_process_nvmrc $f/.nvmrc >/dev/null 2>/dev/null; echo $?)"
EXPECTED="$(nvm_json_extract < "${f}/expected.json" | tr -d '"')"
[ "${EXIT_CODE}" != "0" ] || die "$(basename "${f}"): expected exit code of 'not 0' but got ${EXIT_CODE}"
[ "${STDERR}" = "${EXPECTED}" ] || die "$(basename "${f}"): expected STDERR of \`${EXPECTED}\` but got \`${STDERR}\`"
done

View File

@@ -3,7 +3,7 @@
die () { echo "$@" ; cleanup ; exit 1; }
cleanup() {
unset -f nvm_ls_remote nvm_ls_remote_iojs nvm_ls_remote_node NVM_IOJS_ORG_MIRROR
unset -f nvm_ls_remote nvm_ls_remote_iojs
}
\. ../../../nvm.sh
@@ -11,72 +11,67 @@ cleanup() {
OUTPUT="$(nvm_remote_versions stable 2>&1)"
EXPECTED_OUTPUT="Implicit aliases are not supported in nvm_remote_versions."
EXIT_CODE="$(nvm_remote_versions stable >/dev/null 2>&1; echo $?)"
[ "_${OUTPUT}" = "_${EXPECTED_OUTPUT}" ] || die "implicit alias 'stable' did not error out with correct message, got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_1' ] || die "implicit alias 'stable' did not exit with code 1, got ${EXIT_CODE}"
[ "_$OUTPUT" = "_$EXPECTED_OUTPUT" ] || die "implicit alias 'stable' did not error out with correct message, got $OUTPUT"
[ "_$EXIT_CODE" = "_1" ] || die "implicit alias 'stable' did not exit with code 1, got $EXIT_CODE"
OUTPUT="$(nvm_remote_versions unstable 2>&1)"
EXPECTED_OUTPUT="Implicit aliases are not supported in nvm_remote_versions."
EXIT_CODE="$(nvm_remote_versions unstable >/dev/null 2>&1; echo $?)"
[ "_${OUTPUT}" = "_${EXPECTED_OUTPUT}" ] || die "implicit alias 'unstable' did not error out with correct message, got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_1' ] || die "implicit alias 'unstable' did not exit with code 1, got ${EXIT_CODE}"
[ "_$OUTPUT" = "_$EXPECTED_OUTPUT" ] || die "implicit alias 'unstable' did not error out with correct message, got $OUTPUT"
[ "_$EXIT_CODE" = "_1" ] || die "implicit alias 'unstable' did not exit with code 1, got $EXIT_CODE"
nvm_ls_remote() {
echo "N/A"
}
OUTPUT="$(nvm_remote_versions foo)"
EXIT_CODE="$(nvm_remote_versions foo >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_N/A" ] || die "nonexistent version did not report N/A"
[ "_${EXIT_CODE}" = '_3' ] || die "nonexistent version did not exit with code 3, got ${EXIT_CODE}"
[ "_$OUTPUT" = "_N/A" ] || die "nonexistent version did not report N/A"
[ "_$EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $EXIT_CODE"
nvm_ls_remote_iojs() {
echo "N/A"
}
OUTPUT="$(nvm_remote_versions iojs-foo)"
EXIT_CODE="$(nvm_remote_versions iojs-foo >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_N/A" ] || die "nonexistent version did not report N/A"
[ "_${EXIT_CODE}" = '_3' ] || die "nonexistent version did not exit with code 3, got ${EXIT_CODE}"
[ "_$OUTPUT" = "_N/A" ] || die "nonexistent version did not report N/A"
[ "_$EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $EXIT_CODE"
nvm_ls_remote_node() {
nvm_ls_remote() {
echo "test output"
echo "more test output"
echo "pattern received: _${1}_"
echo "pattern received: _$1_"
}
nvm_ls_remote_iojs() {
echo "test iojs output"
echo "more iojs test output"
echo "iojs pattern received: _${1}_"
echo "iojs pattern received: _$1_"
}
OUTPUT="$(nvm_remote_versions foo)"
EXIT_CODE="$(nvm_remote_versions foo >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_$(nvm_ls_remote foo)
[ "_$OUTPUT" = "_$(nvm_ls_remote foo)
$(nvm_ls_remote_iojs foo)" ] \
|| die "nvm_remote_versions foo did not return contents of nvm_ls_remote foo combined with nvm_ls_remote_iojs foo; got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_0' ] || die "nvm_remote_versions foo did not exit with 0, got ${EXIT_CODE}"
|| die "nvm_remote_versions foo did not return contents of nvm_ls_remote foo combined with nvm_ls_remote_iojs foo; got $OUTPUT"
[ "_$EXIT_CODE" = "_0" ] || die "nvm_remote_versions foo did not exit with 0, got $EXIT_CODE"
OUTPUT="$(nvm_remote_versions node)"
EXIT_CODE="$(nvm_remote_versions node >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_$(nvm_ls_remote)" ] \
|| die "nvm_remote_versions node did not return contents of nvm_ls_remote; got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_0' ] || die "nvm_remote_versions node did not exit with 0, got ${EXIT_CODE}"
[ "_$OUTPUT" = "_$(nvm_ls_remote)" ] \
|| die "nvm_remote_versions node did not return contents of nvm_ls_remote; got $OUTPUT"
[ "_$EXIT_CODE" = "_0" ] || die "nvm_remote_versions node did not exit with 0, got $EXIT_CODE"
OUTPUT="$(nvm_remote_versions iojs-foo)"
EXIT_CODE="$(nvm_remote_versions iojs-foo >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_$(nvm_ls_remote iojs-foo)
[ "_$OUTPUT" = "_$(nvm_ls_remote iojs-foo)
$(nvm_ls_remote_iojs iojs-foo)" ] \
|| die "nvm_remote_versions iojs-foo did not return contents of nvm_ls_remote iojs-foo combined with nvm_ls_remote_iojs iojs-foo; got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_0' ] || die "nvm_remote_versions iojs-foo did not exit with 0, got ${EXIT_CODE}"
|| die "nvm_remote_versions iojs-foo did not return contents of nvm_ls_remote iojs-foo combined with nvm_ls_remote_iojs iojs-foo; got $OUTPUT"
[ "_$EXIT_CODE" = "_0" ] || die "nvm_remote_versions iojs-foo did not exit with 0, got $EXIT_CODE"
OUTPUT="$(nvm_remote_versions iojs)"
EXIT_CODE="$(nvm_remote_versions iojs >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_$(nvm_ls_remote_iojs)" ] \
|| die "nvm_remote_versions iojs did not return contents of nvm_ls_remote_iojs; got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_0' ] || die "nvm_remote_versions iojs did not exit with 0, got ${EXIT_CODE}"
OUTPUT="$(NVM_IOJS_ORG_MIRROR= nvm_remote_versions)"
EXIT_CODE="$(nvm_remote_versions iojs >/dev/null 2>&1 ; echo $?)"
[ "_${OUTPUT}" = "_$(nvm_ls_remote_node)" ] \
|| die "NVM_IOJS_ORG_MIRROR= nvm_remote_versions did not return contents of nvm_ls_remote_node; got ${OUTPUT}"
[ "_${EXIT_CODE}" = '_0' ] || die "nvm_ls_remote_node= nvm_remote_versions did not exit with 0, got ${EXIT_CODE}"
[ "_$OUTPUT" = "_$(nvm_ls_remote_iojs)" ] \
|| die "nvm_remote_versions iojs did not return contents of nvm_ls_remote_iojs; got $OUTPUT"
[ "_$EXIT_CODE" = "_0" ] || die "nvm_remote_versions iojs did not exit with 0, got $EXIT_CODE"
cleanup

1
test/fixtures/nvmrc vendored

Submodule test/fixtures/nvmrc deleted from 0d325aa903