v1.1.12

[coreybutler]

What's Changed

• Fix symlink detect if it points to nothing by @Tester798 in Fix symlink detect if it points to nothing #963
• Update README.md by @coreybutler in Update README.md #1005
• Change Winget Releaser job to ubuntu-latest by @sitiom in Change Winget Releaser job to ubuntu-latest #1016
• Update README.md by @coreybutler in Update README.md #1034
• Modified folder detection code against Make the nvm list can detect the symlinks in the nvm-windows root directory #1031 by @Humbunklung in Modified folder detection code against #1031 #1032
• Update bug_report.yml by @coreybutler in Update bug_report.yml #1040
• Update bug_report.yml by @coreybutler in Update bug_report.yml #1041
• Update bug_report.yml by @coreybutler in Update bug_report.yml #1042
• Fix small typo in README.md by @acdvorak in Fix small typo in README.md #1048
• Avoid unnecessary byte/string conversion by @Juneezee in Avoid unnecessary byte/string conversion #1049
• fix issue Spaces in installation path are properly handled by nvm install, but not by nvm use #932 by @nineninesevenfour in fix issue #932 #965
• allow to run build.bat on paths with spaces by @nineninesevenfour in allow to run build.bat on paths with spaces #967

New Contributors

• @Tester798 made their first contribution in Fix symlink detect if it points to nothing #963
• @coreybutler made their first contribution in Update README.md #1005
• @Humbunklung made their first contribution in Modified folder detection code against #1031 #1032
• @acdvorak made their first contribution in Fix small typo in README.md #1048
• @Juneezee made their first contribution in Avoid unnecessary byte/string conversion #1049
• @nineninesevenfour made their first contribution in fix issue #932 #965

Full Changelog: 1.1.11...1.1.12

---

This discussion was created from the release v1.1.12.

[sitiom]

@coreybutler Winget releaser workflow failed due to the nvm-setup.exe installer not available in the releases: https://github.com/coreybutler/nvm-windows/actions/runs/6962150119/job/18945262798.

This seems to be a case of #885 (comment) again. Can you please upload it and rerun the workflow again? Thanks!

[sitiom]

No worries!

  Failed to create branch from upstream default branch
  node:internal/errors:866
    const err = new Error(message);

My guess is that either the token you provided has expired or does not have the proper public_repo scope. #1091 (comment)

[ezhupa99]

I just get the same issue as the first commenter when I ran the nvm-update.exe but then the version got updated

[coreybutler]

@ezhupa99 there is an open issue for this. For others coming across this via Google, just reinstall with the main installer.

[Ernest3688]

what should i type on my terminal when i want to use the latest nvm

[coreybutler]

There is no command to update to the latest nvm from the terminal. We don't have an auto-update service for this project. That is something we're working on for the commercial version of Runtime.

If you actually meant "what should I type on my terminal when I want to use the latest node", the answer is nvm use latest. That will use the latest version you have installed. If you want to install the latest version, run nvm install latest.

[frremu]

Please add .exe resource in Assets.

Freundliche Grüße.

[coreybutler]

[rchak007]

@coreybutler What are the steps to install?? do i download all assets?? its confusing. or just the zip. Do i get all the files.??

[coreybutler]

@rchak007 just download nvm-setup.exe. Then run the file. That's it. The installation wizard walks you through the rest. The other files aren't necessary for new installations.

The nvm-noinstall package is for people who want to install manually without the wizard (there is a guide in the wiki). The nvm-update package is for people updating to a new version of NVM for Windows... but all it does is reinstall with fewer prompts. All of the text files are just checksums... the majority of people won't need this since the purpose of checksums is just to validate the software is legit. Since we code-sign our executables, Windows itself verifies our code... so the checksums really aren't necessary.

[rchak007]

ok thx. i think i downloaded the zip but was able to run it and install.. thanks a lot!! was able to work it

[u561910]

What would really be great if you could create an installer that installs to the system instead of to a user profile. Currently our Devs are unable to use your application because it is blocked by security policies. As you probably know, installing EXEs and DLLS, etc.....can make it much easier for malicious code to launch from user profiles. User profile installers can be launched without admin rights

[coreybutler]

@u561910 I'm not sure I follow the logic here. Running the code at a system level grants all users access. It does not change the fact that Windows itself requires elevated permissions to create symlinks and access directories like C:\Program Files (if you choose to install it this way... you can use other directories). From what I can see, a system-level installation would increase the vulnerability surface area, not reduce it. It also makes it difficult to identify compromised accounts.

There are thousands of organizations deploying this to enterprise developers via profiles, for the reasons stated above. If you need a different installer to meet your firm's specific policies, there is a guide for manual installation in the wiki. Some companies use this to create their own installers.

Some firms need an MSI installer instead of the EXE, which helps control how the app is installed in private environments. If this is something you want, you'll need to wait for Runtime. Keep in mind, enterprise features will be part of a commercial offering.

That said, I'm not trying to dismiss your concerns... I just don't understand where the problem is.

[noodlescripter]

I just want to thank you for all you do. What you have developed is a life changing experience.

[samueloshio]

nvm-setup.exe v1.1.12 would not download. Please help check

[coreybutler]

The download works correctly.

Make sure your system is allowed to download .exe files. Tools like Windows Defender are often configured to block direct downloads of executables. That's why we offer a zip file version too.

[protypangel]

It's me or the nvm-setup.exe has a problem with the variable systeme ?
That create the variable "NVM_HOME" when the install.cmd need the variable system "NVM_PATH"

[coreybutler]

@protypangel - NVM_HOME is the correct variable used by NVM for Windows. NVM_PATH is used by nvm-sh. Maybe you're thinking of that project?

[RPWPA]

Why does virustotal say it has got malicious content in the setup.exe file?
https://www.virustotal.com/gui/url/870689a1d8da4b144b6599d2f0653deae9e2ec65d7cb1c4d18042f83d84b1eaa?nocache=1

[coreybutler]

@RPWPA First, two vendors out of 92 say there is malicious code, and one says suspicious. This happens every now and again. The most common reason is the antivirus vendors sometimes use unsophisticated ML to determine threat levels. It's not uncommon to see ALL Go apps falsely flagged.

I've worked with several major enterprises and governments who've provided Crowdstrike Falcon reports with the same flags. In every case, these antivirus tools have falsely assumed nvm-setup.exe is nvm.exe, and every flag is against nvm-setup.exe. Their logic is a program shouldn't be able to install anything, which is reasonable... unless you're treating the installer as a program!

Some of these tools also flag references to WMI/WMIC and RPC calls, which is done internally by Windows when an HTTP request is made (to download Node.js/npm).

The bottom line is there are false positives. I try to work with the AV vendors on these, but so many of them pop up and disappear before I can accomplish anything with them.

The guidance I provide to enterprise users is pretty basic... there are no credible threats. However; if you feel better not using the installer, the manual installation process provides an alternative that doesn't use nvm-setup.exe at all.

[RPWPA]

Thanks for the help @coreybutler.