The NVM for Windows project has released version 2, a complete rewrite of the tool used to manage Node.js versions. The core engine is written in Go, while the shims responsible for intercepting process calls are built in Zig. This update introduces two operational modes: link, which maintains zero-latency performance, and shim, which enables advanced features like .nvmrc support and version integrity checks at the cost of approximately 25–35 ms of startup time.
The new architecture integrates directly with Windows infrastructure. Managed Node.js versions now appear in the 'Apps & Features' menu, and the tool logs events to the Windows Event Viewer, supports the Notification Center, and stores settings in the Windows Registry. These integrations allow for centralized management via Group Policy, Intune, and Active Directory, facilitating security audits and compliance monitoring.
The project has introduced a dual-distribution model. The Community build is available under an MIT license, while the Certified build includes enterprise-grade features such as advanced logging, governance tools, and air-gapped installation support. Certified builds also provide trust artifacts, including signed SBOMs and SLSA Level 3 build attestations.
Version 2 improves efficiency by using .7z archives, which reduce download sizes by approximately 40%. It also features a built-in malware blocker that checks packages against the OpenSSF Malicious Packages database. Additionally, the tool no longer requires administrative privileges for standard operations, as it handles permission requests through native Windows notifications.
