Summary

Blocks malicious packages and hardens Node policy by default

NVM for Windows v2.1.0-beta.6

Authenticode-signed community build from cli/src/manifest.json version 2.1.0-beta.6.
Architectures: amd64, arm64.
Program root: per-user LocalAppData (unsupported outside that root may log NVM4101).
Org Program Files / MSI / Intune: use NVM for Windows Certified Builds.

Assets per arch: Inno Setup installer (*-setup.exe) and prebuilt sync.exe (*-sync.exe) for public -DownloadSync builds.

Prerelease stamp applied at build time via the Community Release workflow (manifest base left unchanged in git).

Commits

nvm-windows/nvm

d815db1 chore: update release docs (badges + contributors) (github-actions[bot])
33ac21f ci: auto-translate non-English issues, PRs, and discussions (coreybutler)
1bc0ab2 Merge pull request #1480 from nvm-windows/ci/translate (Corey Butler)
13c43ed ci: add dependency review and PR description checks (coreybutler)
454f0cc Merge pull request #1481 from nvm-windows/ci/pr-checks (Corey Butler)
c48e3e1 ci: require Signed-off-by (DCO) on pull request commits (coreybutler)
0f6a93b Merge pull request #1482 from nvm-windows/ci/dco (Corey Butler)
3b0d8f8 ci: reverse-translate English replies into the OP language (coreybutler)
513365d Merge pull request #1483 from nvm-windows/ci/reverse-translate (Corey Butler)
c6ab3a4 chore: pin common, cli, and shim for sign-script gate (coreybutler)
14392f0 Merge pull request #1484 from nvm-windows/fix/sign-script-proxy-auth (Corey Butler)
e8d78bb fix(installer): block unsafe Node storage paths (coreybutler)
1b76547 Merge pull request #1485 from nvm-windows/fix/nvm4313-install-root-guard (Corey Butler)
1cf34ab chore: pin common and sync for hotfix toasts (Corey Butler)
49b7d53 Merge pull request #1486 from nvm-windows/feat/hotfix-toast-collection (Corey Butler)
8d469f0 feat(release): require hotfix toast_summary (Corey Butler)
0104f5e chore: pin sync for hotfix toast summary (Corey Butler)
4f1b3c1 Merge pull request #1487 from nvm-windows/feat/hotfix-toast-summary (Corey Butler)
89fb264 chore: pin cli and sync for toast upgrade protocol (Corey Butler)
6833191 Merge pull request #1488 from nvm-windows/feat/release-toast-copy (Corey Butler)
05b832b chore: pin common, sync, shim for malware seed (Corey Butler)
ec51a13 Merge pull request #1489 from nvm-windows/feat/malware-db-seed (Corey Butler)
38d1965 chore: pin shim for verifycache LF fixtures (Corey Butler)
fafa989 Merge pull request #1490 from nvm-windows/chore/pin-verifycache-lf (Corey Butler)
89de84c feat(installer)!: adopt means copy and uninstall (coreybutler)
3d8701f fix(installer): accept only adopt and drop (coreybutler)
90a0bf7 Merge pull request #1492 from nvm-windows/feat/official-node-tokens (Corey Butler)
3f32243 fix(installer): pin HKCU .nodejs PATH to LocalAppData (Corey Butler)
58157f8 Merge pull request #1493 from nvm-windows/feat/localappdata-nodejs-path (Corey Butler)
9b10880 chore(shim): pin range resolution that keeps a satisfying default (Corey Butler)
410cf58 Merge pull request #1497 from nvm-windows/chore/pin-shim-prefer-default (Corey Butler)
2995c84 chore: pin common and cli for offline exact installs (Corey Butler)
5fd2a09 Merge pull request #1498 from nvm-windows/fix/offline-exact-install (Corey Butler)
415aa60 chore: pin shim so bare node skips -i on pipes (Corey Butler)
13ad2b9 Merge pull request #1500 from nvm-windows/chore/pin-shim-bare-node-tty (Corey Butler)
3be845d chore: pin common and shim for Policies-then-Preferences lookup (Corey Butler)
3dca9ab Merge pull request #1501 from nvm-windows/chore/pin-policy-then-pref (Corey Butler)
6c45570 chore: pin cli and shim for age default, firewall, PE (Corey Butler)
aceb502 Merge pull request #1502 from nvm-windows/chore/pin-age-firewall (Corey Butler)
6f277bf fix: drop invalid Inno userpics constants (Corey Butler)
14f9674 Merge pull request #1503 from nvm-windows/fix/inno-userpics (Corey Butler)
d58f6dd chore: pin shim for InstallRoot, TTY prompt, NVM4411 (Corey Butler)
87f6427 Merge pull request #1504 from nvm-windows/chore/pin-shim-leftovers (Corey Butler)
981eac0 chore: pin shim for HKLM --permission-audit strip (Corey Butler)
36777ae Merge pull request #1505 from nvm-windows/chore/pin-shim-permission-audit (Corey Butler)
abc5c60 chore: pin shim for NVM4412 lifecycle-script event (Corey Butler)
c4303e5 Merge pull request #1506 from nvm-windows/chore/pin-shim-lifecycle-siem (Corey Butler)
5dc9b0b chore: pin shim for install-class NVM4412 (Corey Butler)
919a46e Merge pull request #1507 from nvm-windows/chore/pin-shim-lifecycle-install-class (Corey Butler)
42418e1 chore: pin common/cli/shim for malware status (Corey Butler)
1337d83 Merge pull request #1508 from nvm-windows/chore/pin-malware-status (Corey Butler)
5bca8c5 docs: point README vendor links at current URLs (Corey Butler)
d896a70 Merge pull request #1509 from nvm-windows/docs/ms-google-readme-urls (Corey Butler)
7f8b608 chore: pin sync for local directory identity (Corey Butler)
deae0d2 Merge pull request #1510 from nvm-windows/chore/pin-sync-identity (Corey Butler)
2794aac chore: pin common for vlt default trust (Corey Butler)
7213b01 Merge pull request #1511 from nvm-windows/chore/pin-vlt-trust (Corey Butler)
8eeb182 chore: pin shim and common for lifecycle script flags (Corey Butler)
9515ddd Merge pull request #1512 from nvm-windows/chore/pin-lifecycle-script-flags (Corey Butler)
dcfcdb1 chore: pin shim for version firewall and npx cooldown (Corey Butler)
dff2681 Merge pull request #1513 from nvm-windows/chore/pin-firewall-npx (Corey Butler)
159890b chore: pin shim for NODE_OPTIONS permission-audit strip (Corey Butler)
fef07b0 Merge pull request #1514 from nvm-windows/chore/pin-node-options-audit (Corey Butler)
bb6f84e chore: pin shim for VerifyOutcome Zig 0.15 init (coreybutler)
126cb94 Merge pull request #1515 from nvm-windows/chore/pin-verifyoutcome-init (Corey Butler)

nvm-windows/cli

ea40394 fix: clone common beside cli workspace for go.mod replace (coreybutler)
fa7ac20 Merge pull request #13 from nvm-windows/feat/toast-collections (Corey Butler)
34b0b88 fix: stop false-red CI from team token and unsigned test node (coreybutler)
dfe9ce8 Merge pull request #14 from nvm-windows/fix/ci-signal (Corey Butler)
757cbd9 fix: allow same-repo PRs through github-guard (coreybutler)
f088eb9 Merge pull request #15 from nvm-windows/fix/github-guard-same-repo (Corey Butler)
e875923 ci: auto-translate non-English issues, PRs, and discussions (coreybutler)
2b454db Merge pull request #16 from nvm-windows/ci/translate (Corey Butler)
c7d66e9 ci: reverse-translate English replies into the OP language (coreybutler)
450f893 Merge pull request #17 from nvm-windows/ci/reverse-translate (Corey Butler)
9afa2a6 fix(cli): refuse sign-script argv paths (coreybutler)
f8580fc Merge pull request #18 from nvm-windows/fix/sign-script-proxy-auth (Corey Butler)
789d582 fix(cli): handle nvm://upgrade toast action (Corey Butler)
8f9182c Merge pull request #19 from nvm-windows/feat/release-toast-copy (Corey Butler)
ff77024 fix(cli): put expanded LocalAppData .nodejs on HKCU PATH (Corey Butler)
8bc41e1 Merge pull request #20 from nvm-windows/feat/hkcu-expanded-nodejs-path (Corey Butler)
23cb6ea fix(install): skip mirror SHASUM when local_install_only (Corey Butler)
55a4c66 Merge pull request #21 from nvm-windows/fix/local-only-skip-mirror (Corey Butler)
d8a4735 fix: enforce version firewall and PE on nvm use (Corey Butler)
495c874 Merge pull request #22 from nvm-windows/fix/version-firewall-use (Corey Butler)
be91611 feat: unhide nvm malware status (Corey Butler)
152e48d Merge pull request #23 from nvm-windows/feat/malware-status-verdicts (Corey Butler)

nvm-windows/common

5a3eb05 Merge pull request #13 from nvm-windows/feat/toast-collections (Corey Butler)
e831b54 ci: auto-translate non-English issues, PRs, and discussions (coreybutler)
8d9a9d4 Merge pull request #14 from nvm-windows/ci/translate (Corey Butler)
84de22f ci: reverse-translate English replies into the OP language (coreybutler)
a9615e5 Merge pull request #15 from nvm-windows/ci/reverse-translate (Corey Butler)
7b732c1 fix(verifycache): gate sign-script to signed proxy pipe (coreybutler)
5d861fa Merge pull request #16 from nvm-windows/fix/sign-script-proxy-auth (Corey Butler)
74a5c8a fix(fs): refuse unsafe Node.js storage paths (coreybutler)
c0c55be Merge pull request #17 from nvm-windows/fix/nvm4313-install-root-guard (Corey Butler)
12e22d6 feat(notify): add Hotfixes toast collection (coreybutler)
fbb8754 Merge pull request #18 from nvm-windows/feat/hotfix-toast-collection (Corey Butler)
c39eae9 fix(config): reject blank root before NVM4313 (Corey Butler)
d649907 Merge pull request #20 from nvm-windows/fix/empty-root-message (Corey Butler)
a73b5e0 feat(malwaredb): verify feed head and persist pair (Corey Butler)
15b2ef3 Merge pull request #21 from nvm-windows/feat/malware-db-seed (Corey Butler)
52efeb1 fix(resolver): skip index.tab for exact versions (Corey Butler)
466bfea Merge pull request #22 from nvm-windows/fix/exact-version-skip-catalog (Corey Butler)
5811b7d fix: ROOTS order is Policies then Preferences per hive (Corey Butler)
5006246 Merge pull request #23 from nvm-windows/fix/policy-then-pref (Corey Butler)
0d725db feat(malwaredb): local verdicts with grant names (Corey Butler)
fb22236 Merge pull request #24 from nvm-windows/feat/malware-status-verdicts (Corey Butler)
07efbd2 fix(trust): add vlt to default TrustedModules (Corey Butler)
fa1048e Merge pull request #25 from nvm-windows/fix/vlt-default-trust (Corey Butler)
ebc1025 docs: note npm script inheritance for permission/V8 flags (Corey Butler)
d53e738 Merge pull request #26 from nvm-windows/docs/lifecycle-script-node-options (Corey Butler)

nvm-windows/shim

f404f6f ci: auto-translate non-English issues, PRs, and discussions (coreybutler)
cae6868 Merge pull request #16 from nvm-windows/ci/translate (Corey Butler)
9904941 ci: reverse-translate English replies into the OP language (coreybutler)
8cfc2b2 Merge pull request #17 from nvm-windows/ci/reverse-translate (Corey Butler)
f972f7a fix(proxy): pass sign-script path on stdin pipe (coreybutler)
c0131ea Merge pull request #18 from nvm-windows/fix/sign-script-proxy-auth (Corey Butler)
79b790d feat(proxy): trust malware.db via COSE pair (Corey Butler)
65bae81 Merge pull request #19 from nvm-windows/feat/malware-db-seed (Corey Butler)
7831c3c fix(test): keep verifycache payload.txt as LF (Corey Butler)
9849ca2 Merge pull request #20 from nvm-windows/fix/verifycache-payload-lf (Corey Butler)
453660e fix(resolver): keep default when it satisfies a version range (Corey Butler)
7e6f26e Merge pull request #21 from nvm-windows/fix/prefer-default-when-range-satisfied (Corey Butler)
28e581d fix(node): skip -i when stdin is not a console (Corey Butler)
ff89da3 Merge pull request #22 from nvm-windows/fix/bare-node-repl-tty (Corey Butler)
87549c7 fix: read Policies before Preferences in each hive (Corey Butler)
82ccd5f Merge pull request #23 from nvm-windows/fix/policy-then-pref (Corey Butler)
4585253 fix: Certified age default, firewall, PE check (Corey Butler)
a917a43 Merge pull request #24 from nvm-windows/fix/certified-age-default (Corey Butler)
71f248c fix: InstallRoot policy lookup and TTY auto-install (Corey Butler)
f4e6795 Merge pull request #25 from nvm-windows/fix/installroot-and-tty (Corey Butler)
6bedf63 fix: strip --permission-audit when HKLM forces enforce (Corey Butler)
21518bd Merge pull request #26 from nvm-windows/fix/permission-audit-hklm (Corey Butler)
e6ffbab fix: log lifecycle-script lock on Certified Advanced Logging (Corey Butler)
df8395c Merge pull request #27 from nvm-windows/fix/lifecycle-siem (Corey Butler)
f16870a fix: log NVM4412 only for install-class commands (Corey Butler)
9924205 Merge pull request #28 from nvm-windows/fix/lifecycle-siem-install-class (Corey Butler)
37adacf feat: per-package NVM4602 with source and reason (Corey Butler)
0279114 Merge pull request #29 from nvm-windows/feat/malware-status-verdicts (Corey Butler)
2849cd7 fix: apply Governance node flags to npm lifecycle scripts (Corey Butler)
1d33eb1 Merge pull request #30 from nvm-windows/fix/lifecycle-script-node-options (Corey Butler)
737b01b fix: pair version firewall allow/block lists (Corey Butler)
4e87ce3 fix: apply npm cooldown env to npx (Corey Butler)
9f15bbb Merge pull request #31 from nvm-windows/fix/version-firewall-paired-lists (Corey Butler)
e5786ae fix: strip NODE_OPTIONS --permission-audit under HKLM (Corey Butler)
fb488c2 Merge pull request #32 from nvm-windows/fix/node-options-permission-audit (Corey Butler)
720f71a fix: initialize VerifyOutcome.result for Zig 0.15 (coreybutler)
07ea83c Merge pull request #33 from nvm-windows/fix/verifyoutcome-init (Corey Butler)

Contributors

VirusTotal

Important

sync.exe is only necessary when building from source.

nvm-windows/nvm v2.1.0-beta.6 on GitHub