Repository navigation
Zip 9 deflate only - #1611
Open
mentenaz wants to merge 4 commits into
Open
Zip 9 deflate only#1611mentenaz wants to merge 4 commits into
mentenaz wants to merge 4 commits into
Conversation
The crate now has a library target. `fnm::Fnm` covers listing installed and downloadable versions, reading the version a directory asks for, installing, uninstalling, setting the default, and building the PATH for running a child process under a version. Its functions return values instead of printing and never exit the process, so another Rust application can manage Node.js versions without fnm being installed. The `fnm` program is unchanged and is now a thin layer over the library. It and the dependencies only it needs (progress bars, shell detection, completions, the Windows manifest) are behind a `cli` feature that is on by default. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`Fnm::resolve_for` and `Fnm::install_for` take a directory and work from its `.nvmrc`, `.node-version` or `package.json` directly. A `package.json` version range such as `>=20` can't be written as a single version to ask for, so it couldn't be passed to `resolve` or `install` by name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fnm unpacked whatever the mirror sent. Before unpacking, it now fetches the release's SHASUMS256.txt from the same mirror, downloads the archive into a temporary file while hashing it, and unpacks it only if the SHA-256 matches. A mismatch, or a mirror that publishes no checksum for the file, stops the install with an error naming the file and both checksums. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
zip 2.6.1 has three advisories (RUSTSEC-2026-0367, -0368, -0369) and its default zstd feature pulls in zstd and zstd-safe, which have three more (RUSTSEC-2026-0391, -0398, -0403). Node.js release zips are deflate, so the other compression features are not needed. zip 9 returns a Result from mangled_name() and name(); propagate it.
Author
|
Thanks @michaljuris , glad the checksum commit was useful! Happy to help with #1613. I can review or test it, including on Windows, if that's helpful. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UPdated vuln