You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add support for .nvmrc lookup when running nvm use and no version is specified #1392
We considered this before release and had mixed views. We're seeking community feedback, so I'm switching this to a discussion.
Case For: Convenience
Obviously this would be convenient if you want to switch your default system version without knowing which version you're switching to. But how often are people doing this, and for what purposes?
Case Against: Security/Awareness
Scripts can manipulate .nvmrc files, which could allow an old compromised version to be configured as the default for the entire computer. An agent could specify a version with a known CVE/CWE, run nvm use, and execute against it. This is a bit of a strawman argument, since an agent could just run nvm use <version> too, which leads to awareness.
By requiring a version in the command, users know which version they're configuring. More importantly, logging nvm use <version> captures the explicit choice instead of inferring it from the .nvmrc, which can be modified after the fact.
Since this is a question of convenience and not function, we opted for the case against. Again though, we're open to community feedback.
Activity
coreybutler commentedon Sep 4, 2026
We considered this before release and had mixed views. We're seeking community feedback, so I'm switching this to a discussion.
Case For: Convenience
Obviously this would be convenient if you want to switch your default system version without knowing which version you're switching to. But how often are people doing this, and for what purposes?
Case Against: Security/Awareness
Scripts can manipulate .nvmrc files, which could allow an old compromised version to be configured as the default for the entire computer. An agent could specify a version with a known CVE/CWE, run
nvm use, and execute against it. This is a bit of a strawman argument, since an agent could just runnvm use <version>too, which leads to awareness.By requiring a version in the command, users know which version they're configuring. More importantly, logging
nvm use <version>captures the explicit choice instead of inferring it from the.nvmrc, which can be modified after the fact.Since this is a question of convenience and not function, we opted for the case against. Again though, we're open to community feedback.