v0.6.1

Caution

WITHDRAWN — do not install this release. The binaries and package
assets in v0.6.1 self-identify as 0.6.0 (the version bump commit was
missed before tagging), which breaks jarvy update with a perpetual
update loop. Use v0.6.2, the corrected re-release of exactly this
code: https://github.com/Cliftonz/jarvy/releases/tag/v0.6.2
Assets are left in place because releases are immutable by policy.

Fixes:

• nvm is now detected via its filesystem marker
  (${NVM_DIR:-$HOME/.nvm}/nvm.sh) instead of shell probes. nvm is a
  shell function, not a binary, so the previous PATH lookup and
  bash -lc probes could never see it — every jarvy setup with nvm
  in the config re-downloaded and re-ran the installer, and the version
  check reported nvm as needing install forever. Detection now converges
  after one install, and jarvy upgrade node correctly suggests
  nvm install when node is nvm-managed. (Windows is unaffected:
  nvm-windows is a real binary.)

Internal:

• CI action bumps (Dependabot): actions/checkout 4→7,
  actions/download-artifact 7→8, actions/setup-java 4→5,
  azure/setup-helm 4.3.0→5.0.1, docker/setup-buildx-action 3→4.
  The release-critical ones were smoke-validated by dispatch runs
  before this release.

This is also the first release upgradable to via
jarvy update --method binary from v0.6.0 — the redirect fix shipped in
v0.6.0 makes the updater work going forward (upgrading from v0.5.x
still requires the install script or a package manager).

Full Changelog: v0.6.0...v0.6.1

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.6.1-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.6.1
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.6.1

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.