[Fix] reject invalid semver ranges

ljharb · ljharb · commit b53b158b68f1 · 2025-11-24T22:37:00.000-08:00
Fixes #2
diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml
@@ -11,4 +11,4 @@ jobs:
     with:
       range: '^20 || >= 22'
       type: minors
-      command: npm run tests-only
+      command: npm run tests-only
diff --git a/nvmrc.mjs b/nvmrc.mjs
@@ -65,14 +65,21 @@ const optionsEntries = rawOptions.map((x) => ((/[=]/).test(x)
 
 const map = new Map(optionsEntries);
 
-if (map.size !== optionsEntries.length || !map.has('node') || rawOptions.filter((x) => !x.includes('=')).length !== 1) {
+if (
+	map.size !== optionsEntries.length
+	|| !map.has('node')
+	|| rawOptions.filter((x) => !x.includes('=')).length !== 1
+	|| (/^\s*[~^><=]/).test(map.get('node').trim())
+) {
 	console.error(`
 invalid .nvmrc!
 all non-commented content (anything after # is a comment) must be either:
   - a single bare nvm-recognized version-ish
   - or, multiple distinct key-value pairs, each key/value separated by a single equals sign (=)
 
 additionally, a single bare nvm-recognized version-ish must be present (after stripping comments).
+
+Note that nvm does not understand semver ranges.
 `);
 
 	console.warn(`
diff --git a/test/fixtures/invalid/caret/.nvmrc b/test/fixtures/invalid/caret/.nvmrc
@@ -0,0 +1 @@
+^22.18
diff --git a/test/fixtures/invalid/caret/expected.json b/test/fixtures/invalid/caret/expected.json
@@ -0,0 +1,3 @@
+[
+    "^22.18"
+]
diff --git a/test/fixtures/invalid/eq/.nvmrc b/test/fixtures/invalid/eq/.nvmrc
@@ -0,0 +1 @@
+=22.18.0
diff --git a/test/fixtures/invalid/eq/expected.json b/test/fixtures/invalid/eq/expected.json
@@ -0,0 +1,3 @@
+[
+    "=22.18.0"
+]
diff --git a/test/fixtures/invalid/gt/.nvmrc b/test/fixtures/invalid/gt/.nvmrc
@@ -0,0 +1 @@
+> 22.18
diff --git a/test/fixtures/invalid/gt/expected.json b/test/fixtures/invalid/gt/expected.json
@@ -0,0 +1,3 @@
+[
+    "> 22.18"
+]
diff --git a/test/fixtures/invalid/gte/.nvmrc b/test/fixtures/invalid/gte/.nvmrc
@@ -0,0 +1 @@
+ >= 22.18
diff --git a/test/fixtures/invalid/gte/expected.json b/test/fixtures/invalid/gte/expected.json
@@ -0,0 +1,3 @@
+[
+    ">= 22.18"
+]
diff --git a/test/fixtures/invalid/lt/.nvmrc b/test/fixtures/invalid/lt/.nvmrc
@@ -0,0 +1 @@
+< 22.18
diff --git a/test/fixtures/invalid/lt/expected.json b/test/fixtures/invalid/lt/expected.json
@@ -0,0 +1,3 @@
+[
+    "< 22.18"
+]
diff --git a/test/fixtures/invalid/lte/.nvmrc b/test/fixtures/invalid/lte/.nvmrc
@@ -0,0 +1 @@
+ <=22.18
diff --git a/test/fixtures/invalid/lte/expected.json b/test/fixtures/invalid/lte/expected.json
@@ -0,0 +1,3 @@
+[
+    "<=22.18"
+]
diff --git a/test/fixtures/invalid/tilde/.nvmrc b/test/fixtures/invalid/tilde/.nvmrc
@@ -0,0 +1 @@
+~22.18
diff --git a/test/fixtures/invalid/tilde/expected.json b/test/fixtures/invalid/tilde/expected.json
@@ -0,0 +1,3 @@
+[
+    "~22.18"
+]
diff --git a/test/index.mjs b/test/index.mjs
@@ -93,18 +93,21 @@ test('nvmrc', async (t) => {
 
 			const lines = stripped.split('\n').map((x) => x.trim()).filter(Boolean);
 
-			st.deepEqual(lines.slice(0, 6), [
+			const expectedLines = [
 				'invalid .nvmrc!',
 				'all non-commented content (anything after # is a comment) must be either:',
 				'- a single bare nvm-recognized version-ish',
 				'- or, multiple distinct key-value pairs, each key/value separated by a single equals sign (=)',
 				'additionally, a single bare nvm-recognized version-ish must be present (after stripping comments).',
+				'Note that nvm does not understand semver ranges.',
 				'non-commented content parsed:',
-			]);
+			];
+
+			st.deepEqual(lines.slice(0, expectedLines.length), expectedLines);
 
 			const expected = JSON.parse(`${readFileSync(join(cwd, 'expected.json'))}`);
 
-			st.deepEqual(lines.slice(6), expected, `fixture ${fixture} produces expected warning lines`);
+			st.deepEqual(lines.slice(expectedLines.length), expected, `fixture ${fixture} produces expected warning lines`);
 		});
 	}
 });
