fix(ng-dev): validate nvmrc-sourced Node.js version before fetch

[adilburaksen]

Summary

#75773923 added semver.valid() validation to the PNPM and TypeScript version strings before they are interpolated into registry fetch URLs (syncPnpm, syncTypeScript), but the Node.js version path was left unguarded.

In processNodeToolchainArgs (ng-dev/misc/sync-module-bazel/sync-module-bazel.ts), effectiveVersion can originate from the .nvmrc file (node_version_from_nvmrc) and is passed to getNodeJsRepositories, which interpolates it into:

fetch(`https://nodejs.org/dist/v${version}/SHASUMS256.txt`)

without the same validation, leaving the URL path open to manipulation via the version string.

Fix

Apply the existing semver.valid() guard to effectiveVersion before it is used, consistent with the PNPM and TypeScript checks added in #75773923.

[gemini-code-assist]

Code Review

This pull request introduces validation for the Node.js version using semver.valid in sync-module-bazel.ts to ensure only valid versions are processed. The reviewer identified an issue where using the original effectiveVersion instead of the normalized version returned by semver.valid could result in a double 'v' prefix (e.g., 'vv24.16.0') in URLs, and provided a code suggestion to fix this.

[gemini-code-assist]

While semver.valid() validates the version, it also returns the cleaned/normalized version string (e.g., stripping any leading v or whitespace). If effectiveVersion contains a leading v (for example, if manually specified in MODULE.bazel), using it directly in getNodeJsRepositories will result in a URL with a double v prefix (e.g., vv24.16.0), causing the fetch to fail.

To prevent this, we should assign the normalized version returned by semver.valid() back to effectiveVersion.

Suggested change

	if (!semver.valid(effectiveVersion)) {
	throw new Error(`Invalid Node.js version: ${effectiveVersion}`);
	}
	const validatedVersion = semver.valid(effectiveVersion);
	if (!validatedVersion) {
	throw new Error('Invalid Node.js version: ' + effectiveVersion);
	}
	effectiveVersion = validatedVersion;