v0.40.6

New Stuff

 - `install`: add support for loongarch64 architecture (nvm-sh#3693)

Bug Fixes

 - support arm64-musl on Alpine Linux (nvm-sh#3845)
 - `nvm_ls_cached`: include source-cached and io.js artifacts
 - auth header: Add all valid base64 chars to sanitize function (nvm-sh#3846)
 - Parse commented nvmrc content in nvm_ls
 - bypass aliased curl (nvm-sh#2932)
 - `nvm_download`, `nvm_get_latest`, `install`: only select a downloader that exists as an executable
 - use `command` to bypass `curl`/`wget` shell functions and aliases
 - `install`: use darwin-x64 for all binary on mac for node < v16 (nvm-sh#3709)
 - `nvm install`: migrate packages/set alias when target is already installed
 - focused error on missing/invalid args for several subcommands
 - `nvm_rc_version`: clarify error when no version and no .nvmrc
 - `nvm exec`/`nvm run`: warn when no version and no .nvmrc

Refactors

 - `nvm_alias`: one-pass trailing whitespace strip
 - `nvm_alias`: use [[:space:]] instead of literal tab
 - `nvm_alias`, `nvm_resolve_alias`: use builtins

Robustness

 - reject unsafe LTS alias names from a mirror's index.tab
 - avoid a `set -u` error when `$_` is unset (nvm-sh#3845)
 - `nvm_get_arch`: only apply the Alpine musl suffix when the OS is linux (nvm-sh#3845)
 - `nvm_alias`: explicitly succeed when the alias file is unreadable

Docs

 - [readme] Docker: build time is "several" minutes, not 8 (nvm-sh#3875)
 - [readme] Docker: Just say "Ubuntu" (no version) for base image (nvm-sh#3873)
 - document `nvm reinstall-packages` as a standalone command
 - document `current` and clarify .nvmrc fallback in help/README
 - threat model: document the mirror payload/metadata trust boundary

Tests

 - [actions] nodejs.org PR: sync the fork before branching, and surface create-ref errors
 - [actions] nodejs.org PR: fix `force` boolean and grab the latest tag on dispatch
 - [actions] fall back to the canonical nvmrc submodule when a fork lacks its own
 - [actions] update workflows
 - [actions] `nvm-install-test`: turn the expected v0.40.0 failures green
 - [actions] add `tests-alpine`: a green fast suite and a musl-binary regression matrix (nvm-sh#3845)
 - make the fast suite pass on Alpine (nvm-sh#3845)
 - `nvm_ls handles hash in pattern`: fix cleanup, isolate NVM_DIR, cover the sed path (nvm-sh#3854)
 - `installation_node`: only match top-level global packages
 - `installation_node`: use a published `is-nan` version
 - run every remaining test file: exec bits, fixes; add `check-exec` to CI (nvm-sh#2232)
 - `nvm_offline_version`: make it executable; pin `nvm_ls_cached` cache visibility
 - `aliases`: cover the regex-metachar cycle fix; clean up fixtures in teardown (nvm-sh#3787)

v0.40.5

New Stuff

 - `nvm install --offline`: install from cache without network access

Bug Fixes

 - `nvm_download_artifact`: reject version strings with disallowed characters
 - `nvm_get_checksum`: pass the tarball name to awk as data, not program text
 - `nvm_download`: avoid `eval` so mirror-supplied version strings can't inject commands
 - `nvm_download`: send a well-formed Authorization header on the wget path
 - avoid an unbound variable
 - Add local for sanitized_header (nvm-sh#3837)
 - fix same owner for root when install from binary (nvm-sh#3834)
 - `nvm_normalize_lts`: only reject uppercase for LTS names, not regular aliases
 - `install.sh`: check `mkdir` return codes
 - `install.sh`: fix POSIX compliance, printf format strings, and profile detection
 - `nvm which`: show alias name in infinite loop error message
 - `nvm uninstall`: fix alias cleanup glob expansion
 - `nvm debug`: use default empty values for potentially unset variables
 - `nvm_iojs_version_has_solaris_binary`: fix comparison to detect non-iojs versions
 - `nvm_download_artifact`: fix error propagation from subshells
 - `nvm_install_binary`: return failure when binary download fails with `-b`
 - `nvm_get_arch`: only apply musl suffix on x64 Alpine
 - `nvm_get_arch`: add `command` prefix to `uname` call
 - `nvm_resolve_local_alias`: avoid using variable as printf format string
 - `nvm_get_mirror`: fix awk URL validation to actually reject invalid URLs
 - `nvm_ls_remote_combined`: propagate iojs remote listing failures
 - `nvm install`: fix `nvm err` typo to `nvm_err` for `-s`/`-b` conflict
 - `nvm alias`: fix colors not showing by default

Refactors
 - `nvm_rc_version`: use fd 3 instead of exported env var for multiple return

Docs
 - fix `--offline` help line alignment
 - Clean up wording in docs and shell comments (nvm-sh#3806)
 - fix CONTRIBUTING grammar (nvm-sh#3804)
 - do not use tilde expansion in ENV of Dockerfile (nvm-sh#3821)
 - [readme] use tilde expansion instead of "$HOME" for consistency (nvm-sh#3799)
 - [readme] use "$HOME" instead of hardcoded "/home/user"
 - [readme] Revise Node.js version usage examples (nvm-sh#3802)

Misc

 - [meta] Update .gitmodules with relative submodule path (nvm-sh#3839)
 - [meta] Submodule nvmrc update protocol from git to https (nvm-sh#3839)
 - [meta] Align and enhance AGENTS.md instructions (nvm-sh#3774)

Tests

 - `install_nvm_from_git`: stop git background gc/maintenance racing with cleanup
 - `install_nvm_from_git`: fix malformed test command (missing space before `]`)
 - reduce CI flakiness from transient Docker registry failures
 - remove double-substitution in assert_ok and assert_not_ok (nvm-sh#3826)
 - fix 4 test failures
 - add `try`/`try_err` helpers; convert tests to use them
 - [actions] add workflow to update nodejs.org nvm version
 - [actions] set per-job permissions in the `nvm install` workflow
 - [actions] allow DockerHub's CloudFront CDN so image pulls aren't blocked
 - [actions] upgrade vampire/setup-wsl (nvm-sh#3775)

v0.40.4

Bug Fixes

 - sanitize `NVM_AUTH_HEADER` in `wget` path
 - `nvm_has_colors`: also check if stdout is a terminal
 - `nvm_strip_path`: avoid gawk-specific `RT` variable for mawk compatibility
 - `nvm_get_default_packages`: use portable awk patterns
 - `nvm_install_source`: explicitly set SHELL=/bin/sh for make
 - `install.sh`: do not log when user has requested no profile modifications (nvm-sh#2131)
 - `nvm exec`: Do a version check on `nvm-exec` (nvm-sh#3308)
 - Reject bare LTS codenames in nvm install (nvm-sh#3718)
 - prevent sed errors when pattern contains `#`
 - install.sh: Force remote name of cloned repo to be 'origin' (nvm-sh#3654)
 - `sh` lacks `-O`; thanks shellcheck
 - show system Node.js version in nvm ls (nvm-sh#1287)

Docs

 - [readme] add missing colon (nvm-sh#3516)
 - [readme] add background on io.js (nvm-sh#3641)
 - [readme] fix typo (nvm-sh#3687)
 - [readme] update installation by docker to v0.40.3 (nvm-sh#3590)

Tests

 - [actions] add permissions to GHA workflow
 - Improve uninstall error message for missing versions (nvm-sh#3768)
 - [Tests] add retry logic (nvm-sh#2232)
 - [Tests] add a timeout
 - [actions] add a finisher to lint
 - [actions] migrate Travis CI tests to GitHub Actions
 - [Tests] mock `node` in `nvm_die_on_prefix` test
 - [Tests] clean up .nvmrc after nvm-exec test
 - [Tests] set `$_` before sourcing `nvm.sh` in fast tests
 - [actions] update outdated GitHub Actions versions (nvm-sh#3762)
 - [actions] fix WSL tests: properly handle Debian apt sources issue
 - [actions] fix workflow permissions; add codeQL
 - [actions] temporary fix for WSL issue
 - [actions] add new github asset domain to harden-runner
 - [actions] Fix Cygwin workflow HOME variable and add debug output (nvm-sh#3611)

Misc
 - Migrate GitHub Copilot instructions to AGENTS.md and CLAUDE.md (nvm-sh#3655)
 - [security] add security escalation policy (nvm-sh#3658)
 - [meta] Add comprehensive .github/copilot-instructions.md for better AI code assistance (nvm-sh#3609)
 - [meta] update security policy; add IRP
 - [Dev Deps] update `markdown-link-check`, `semver`

v0.40.3

Fixes
 - `nvm_install_latest_npm`: fix node version detection (nvm-sh#3564)

v0.40.2

New Stuff
 - `install.sh`: add `$ZDOTDIR` to zsh search (nvm-sh#3458)

Fixes
 - `reinstall-packages`: do not reinstall corepack (nvm-sh#3544)
 - avoid bash-specific syntax (nvm-sh#3499)
 - `install-latest-npm`: npm v11 is out
 - `nvm_install_latest_npm`: avoid unbound variable (nvm-sh#3447)
 - give a more helpful message when `lts` alias is mistakenly used (nvm-sh#3441)
 - `nvm ls`, `nvm alias`, `nvm install`: error when an LTS name is invalid
 - `nvm_normalize_lts`: error when an LTS name is not lowercase (nvm-sh#3417)

Documentation
 - [readme] update link
 - [readme] fix `--no-use` example (nvm-sh#3479)
 - [readme] update copyright notice (nvm-sh#3507)
 - [readme] note zsh-nvm's AUTO_USE option (nvm-sh#2670)
 - [readme] add note about reloading zshrc after editing (nvm-sh#3052)
 - [readme] Update shell profile file install notes (nvm-sh#2241)
 - [readme] add docker tips (nvm-sh#2318)
 - [readme] remove `avn` from readme (nvm-sh#3469)
 - [readme] fnm -> nvm.fish (nvm-sh#2541)

Refactors
 - prefer `case` over if/else chains
 - combine `sed -e` invocations/arguments

Tests
 - `nvm exec`/`nvm run`: add `--silent` tests (nvm-sh#1259)
 - [actions] release test needs git tags
 - migrate `installation_iojs` test suite to GitHub Actions (nvm-sh#3476)
 - Migrate slow test suite from Travis CI (nvm-sh#3470)
 - temporarily skip this failing travis test to unblock progress
 - [actions] TOC: use latest LTS node
 - `install.sh`: clean up `nvm_detect_profile` tests
 - `nvm_detect_profile`: refactor (nvm-sh#3467)
 - run urchin tests on pull requests (nvm-sh#3466)
 - update mocks
 - ensure that unit tests use only mocked LTS names
 - [actions] use `node/install` instead of `node/run`

Meta
 - disable blank issues
 - update issue template
 - add DCO (nvm-sh#3456)
 - Rename .github/ISSUE_TEMPLATE.md to .github/ISSUE_TEMPLATE/ISSUE_TEMPLATE.md (nvm-sh#3454)

v0.40.1

Fixes
 - `nvm_download`: ensure all args are quoted
 - `--save`: avoid a conflict with `set -e`
 - `nvm_has_colors`: avoid an aliased `tput`
 - declare an unbound variable
 - `nvm install -b`: do not attempt to download source on a failed binary download with `-b`
 - `nvm install -b`: when no binary is available, fail and output a clear message

Refactors
 - `--save`: clean up some usage
 - `install.sh`: fix node capitalization

Tests
 - set proper permissions on test files
 - move sourcing suite to GHA
 - fix `nvm ls-remote` unit test

v0.40.0

New Stuff
 - `nvm use`/`nvm install`: add `--save` option (nvm-sh#2869)
 - Add support for `NVM_AUTH_HEADER` env var (nvm-sh#3380)
 - allow `.nvmrc` files to support comments

Fixes
 - `nvm_get_default_packages`: use `awk` for more reliable file processing
 - Fix issue where zsh global aliases would break nvm help (nvm-sh#3394)
 - `install-latest-npm`: npm ^8.7 breaks `npm ls` with file: deps

Refactors
 - `nvm_has_colors`: also check the env var

Docs
 - [readme] add OpenJS Ecosystem Sustainability Program partner (nvm-sh#2232)
 - [readme] update CII badge URLs
 - [readme] Fix uninstall instructions (nvm-sh#3286)
 - [readme] Fix typo in WSL section of README (nvm-sh#3295)
 - [Docs] add `nvm unload` to uninstall nvm instructions (nvm-sh#3267)
 - [security] fix typo in threat model

Tests
 - ignore travis-ci env vars; improve debug output
 - [debug] adding logging to makefile
 - only install python 2.7 if not already installed
 - use a better JSON parsing implementation
 - ensure travis can access public repo submodules
 - [actions] improve default action permissions
 - [actions] update vampire/setup-wsl action
 - [actions] finisher tweaks
 - [actions] update action versions to use node 20 (nvm-sh#3299)
 - [Dev Deps] update `markdown-link-check`, `semver`

v0.39.7

Fixes

 - use `\hash` instead of `command hash` for `zsh` (nvm-sh#3239, nvm-sh#3247, nvm-sh#3246)

v0.39.6

New Stuff
 - `nvm_resolve_alias`: only resolve one line of a multiline alias file
 - aliases: skip leading blank lines in alias file

Fixes
 - `nvm_get_mirror`: ensure only a valid URL is allowed
 - avoid overridden `hash`
 - `install.sh`: when `NVM_INSTALL_GITHUB_REPO` is set, issue a warning (nvm-sh#2868)
 - `nvm_get_mirror`: disallow some non-URL characters
 - `nvm_get_arch`: proper value for alpine linux (nvm-sh#3212)
 - `nvm_normalize_lts`: switch from expr to case

Robustness
 - `nvm_list_aliases`: avoid overwritten sort

Performance
 - `nvm_check_file_permissions`: do not traverse into symlinks

Dockerfile
 - Remove apt src disabling, no longer needed (nvm-sh#3199)
 - [Fix] add missing leading slash in path (nvm-sh#3195)

Documentation
 - [readme] fix level of headings (nvm-sh#3230)
 - [readme] add section on bare `nvm install` (nvm-sh#3221)
 - [readme] missing parenthesis (nvm-sh#3215)
 - [readme] update M1 to “Apple Silicon” because of M2 and M3; fix typos (nvm-sh#3242)
 - [readme] rearrange install args (nvm-sh#3222)
 - [readme] reorganize “deeper shell integration” instructions (nvm-sh#1569)
 - [security] add prose explaining OpenSSF CII Best Practices badge results
 - [security] add threat model

Tests
 - temporarily allow  cygwin tests to fail
 - temporarily allow WSL tests to fail
 - ensure windows tests install a node that actually works
 - update test mocks (new LTS, iron)
 - switch cygwin mirror
 - fix filename typo (nvm-sh#3217)

v0.39.5

Fixes
 - `nvm_strip_path`: Preserve leading/trailing colons (nvm-sh#3145)
 - allow checksums to pass with a leading backslash
 - `nvm install-latest-npm`: ensure npm 10 does not install on unsupported nodes

Docs
 - [readme] add examples of setting specific versions as default (nvm-sh#3151)

Tests
 - add some `nvm_do_install` tests
 - a cleaner name for the windows tests