Update dependency nvm-sh/nvm to v0.40.6

[renovate]

This PR contains the following updates:

Package	Update	Change
nvm-sh/nvm	patch	v0.40.3 → v0.40.6

---

Release Notes

nvm-sh/nvm (nvm-sh/nvm)

v0.40.6

Compare Source

New Stuff

• install: add support for loongarch64 architecture (#​3693)

Bug Fixes

• support arm64-musl on Alpine Linux (#​3845)
• nvm_ls_cached: include source-cached and io.js artifacts
• auth header: Add all valid base64 chars to sanitize function (#​3846)
• Parse commented nvmrc content in nvm_ls
• bypass aliased curl (#​2932)
• nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable
• use command to bypass curl/wget shell functions and aliases
• install: use darwin-x64 for all binary on mac for node < v16 (#​3709)
• nvm install: migrate packages/set alias when target is already installed
• focused error on missing/invalid args for several subcommands
• nvm_rc_version: clarify error when no version and no .nvmrc
• nvm exec/nvm run: warn when no version and no .nvmrc

Refactors

• nvm_alias: one-pass trailing whitespace strip
• nvm_alias: use [[:space:]] instead of literal tab
• nvm_alias, nvm_resolve_alias: use builtins

Robustness

• reject unsafe LTS alias names from a mirror's index.tab
• avoid a set -u error when $_ is unset (#​3845)
• nvm_get_arch: only apply the Alpine musl suffix when the OS is linux (#​3845)
• nvm_alias: explicitly succeed when the alias file is unreadable

Docs

• [readme] Docker: build time is "several" minutes, not 8 (#​3875)
• [readme] Docker: Just say "Ubuntu" (no version) for base image (#​3873)
• document nvm reinstall-packages as a standalone command
• document current and clarify .nvmrc fallback in help/README
• threat model: document the mirror payload/metadata trust boundary

Tests

• [actions] nodejs.org PR: sync the fork before branching, and surface create-ref errors
• [actions] nodejs.org PR: fix force boolean and grab the latest tag on dispatch
• [actions] fall back to the canonical nvmrc submodule when a fork lacks its own
• [actions] update workflows
• [actions] nvm-install-test: turn the expected v0.40.0 failures green
• [actions] add tests-alpine: a green fast suite and a musl-binary regression matrix (#​3845)
• make the fast suite pass on Alpine (#​3845)
• nvm_ls handles hash in pattern: fix cleanup, isolate NVM_DIR, cover the sed path (#​3854)
• installation_node: only match top-level global packages
• installation_node: use a published is-nan version
• run every remaining test file: exec bits, fixes; add check-exec to CI (#​2232)
• nvm_offline_version: make it executable; pin nvm_ls_cached cache visibility
• aliases: cover the regex-metachar cycle fix; clean up fixtures in teardown (#​3787)

v0.40.5

Compare Source

Security fix

Note this release addresses CVE-2026-10796.

New Stuff

• nvm install --offline: install from cache without network access

Bug Fixes

• nvm_download_artifact: reject version strings with disallowed characters
• nvm_get_checksum: pass the tarball name to awk as data, not program text
• nvm_download: avoid eval so mirror-supplied version strings can't inject commands
• nvm_download: send a well-formed Authorization header on the wget path
• avoid an unbound variable
• Add local for sanitized_header (#​3837)
• fix same owner for root when install from binary (#​3834)
• nvm_normalize_lts: only reject uppercase for LTS names, not regular aliases
• install.sh: check mkdir return codes
• install.sh: fix POSIX compliance, printf format strings, and profile detection
• nvm which: show alias name in infinite loop error message
• nvm uninstall: fix alias cleanup glob expansion
• nvm debug: use default empty values for potentially unset variables
• nvm_iojs_version_has_solaris_binary: fix comparison to detect non-iojs versions
• nvm_download_artifact: fix error propagation from subshells
• nvm_install_binary: return failure when binary download fails with -b
• nvm_get_arch: only apply musl suffix on x64 Alpine
• nvm_get_arch: add command prefix to uname call
• nvm_resolve_local_alias: avoid using variable as printf format string
• nvm_get_mirror: fix awk URL validation to actually reject invalid URLs
• nvm_ls_remote_combined: propagate iojs remote listing failures
• nvm install: fix nvm err typo to nvm_err for -s/-b conflict
• nvm alias: fix colors not showing by default

Refactors

• nvm_rc_version: use fd 3 instead of exported env var for multiple return

Docs

• fix --offline help line alignment
• Clean up wording in docs and shell comments (#​3806)
• fix CONTRIBUTING grammar (#​3804)
• do not use tilde expansion in ENV of Dockerfile (#​3821)
• [readme] use tilde expansion instead of "$HOME" for consistency (#​3799)
• [readme] use "$HOME" instead of hardcoded "/home/user"
• [readme] Revise Node.js version usage examples (#​3802)

Misc

• [meta] Update .gitmodules with relative submodule path (#​3839)
• [meta] Submodule nvmrc update protocol from git to https (#​3839)
• [meta] Align and enhance AGENTS.md instructions (#​3774)

Tests

• install_nvm_from_git: stop git background gc/maintenance racing with cleanup
• install_nvm_from_git: fix malformed test command (missing space before ])
• reduce CI flakiness from transient Docker registry failures
• remove double-substitution in assert_ok and assert_not_ok (#​3826)
• fix 4 test failures
• add try/try_err helpers; convert tests to use them
• [actions] add workflow to update nodejs.org nvm version
• [actions] set per-job permissions in the nvm install workflow
• [actions] allow DockerHub's CloudFront CDN so image pulls aren't blocked
• [actions] upgrade vampire/setup-wsl (#​3775)

v0.40.4

Compare Source

Bug Fixes

• sanitize NVM_AUTH_HEADER in wget path
• nvm_has_colors: also check if stdout is a terminal
• nvm_strip_path: avoid gawk-specific RT variable for mawk compatibility
• nvm_get_default_packages: use portable awk patterns
• nvm_install_source: explicitly set SHELL=/bin/sh for make
• install.sh: do not log when user has requested no profile modifications (#​2131)
• nvm exec: Do a version check on nvm-exec (#​3308)
• Reject bare LTS codenames in nvm install (#​3718)
• prevent sed errors when pattern contains #
• install.sh: Force remote name of cloned repo to be 'origin' (#​3654)
• sh lacks -O; thanks shellcheck
• show system Node.js version in nvm ls (#​1287)

Docs

• [readme] add missing colon (#​3516)
• [readme] add background on io.js (#​3641)
• [readme] fix typo (#​3687)
• [readme] update installation by docker to v0.40.3 (#​3590)

Tests

• [actions] add permissions to GHA workflow
• Improve uninstall error message for missing versions (#​3768)
• [Tests] add retry logic (#​2232)
• [Tests] add a timeout
• [actions] add a finisher to lint
• [actions] migrate Travis CI tests to GitHub Actions
• [Tests] mock node in nvm_die_on_prefix test
• [Tests] clean up .nvmrc after nvm-exec test
• [Tests] set $_ before sourcing nvm.sh in fast tests
• [actions] update outdated GitHub Actions versions (#​3762)
• [actions] fix WSL tests: properly handle Debian apt sources issue
• [actions] fix workflow permissions; add codeQL
• [actions] temporary fix for WSL issue
• [actions] add new github asset domain to harden-runner
• [actions] Fix Cygwin workflow HOME variable and add debug output (#​3611)

Misc

• Migrate GitHub Copilot instructions to AGENTS.md and CLAUDE.md (#​3655)
• [security] add security escalation policy (#​3658)
• [meta] Add comprehensive .github/copilot-instructions.md for better AI code assistance (#​3609)
• [meta] update security policy; add IRP
• [Dev Deps] update markdown-link-check, semver

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.