[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
verdaccio (source)	^6.9.2 → ^7.0.2

---

Release Notes

verdaccio/verdaccio (verdaccio)

v7.0.2

Compare Source

Patch Changes

• c017767: Remove the HEALTHCHECK from the Docker image.

  The probe used localhost, which resolves to ::1 on Alpine, while the image listens on IPv4 only by default. The container was always reported as unhealthy even though it served requests normally. The image no longer declares a health check, as in 6.x.

  If you need one, add it yourself probing 127.0.0.1, for example in docker-compose.yaml:

  services:
    verdaccio:
      image: verdaccio/verdaccio
      healthcheck:
        test: ['CMD-SHELL', 'wget --quiet --tries=1 --spider http://127.0.0.1:4873/-/ping || exit 1']
        interval: 30s
        timeout: 5s
        start_period: 10s
        retries: 3

  See Health check in the Docker documentation for the docker run and HTTPS variants.

v7.0.1

Compare Source

Patch Changes

• 449ad6b: Restore the @verdaccio/package-filter plugin in the verdaccio 7 package so the filter configuration works again.

  Verdaccio 7.0.0 shipped a default config.yaml (also the one inside the verdaccio/verdaccio:7 Docker image) with the filters: '@verdaccio/package-filter' section enabled, but the package no longer declared the plugin as a dependency: it was dropped when the 7.x line moved to the published @verdaccio/* modules. On startup the plugin loader logged package not found, try to install @verdaccio/package-filter with a package manager and continued without it, so any minAgeDays, dateThreshold or block rules configured under filters were silently not enforced.

  The plugin is a dependency of verdaccio again, as it is on the 6.x line, and the startup error is gone. No configuration change is needed; installations that worked around the problem by commenting out the filters section can enable it again. Affected: verdaccio@7.0.0 and the verdaccio/verdaccio:7 Docker image.

• 14aaded: Show the verdaccio package version in the web UI footer instead of the internal module version.

  verdaccio@7.0.0 (and the verdaccio/verdaccio:7 Docker image) displayed 9.0.0-next-9.40 in the bottom-right corner of the web UI. The 7 binary is a thin layer over the published @verdaccio/* 9.x modules, and @verdaccio/server filled the version shown by the UI from its own package while the command line and the startup log already reported the right one.

  This release updates the @verdaccio/* modules to 9.0.0-next-9.41, whose @verdaccio/server lets the embedding binary set that value, and passes the verdaccio package version to it, so the UI now shows the same version as verdaccio --version. No configuration change is needed.

v7.0.0

Compare Source

Major Changes

• d33944c: Verdaccio 7.0.0 is the first stable release of the 7.x line. It is published to npm as latest and to Docker Hub as verdaccio/verdaccio:7, 7.0 and latest; the 6.x line continues under the latest-6 npm dist-tag and the 6 image tag. The release post is at https://verdaccio.org/blog/2026/10/25/verdaccio-7-release, the migration guide at https://verdaccio.org/blog/2026/09/27/verdaccio-6-to-7-migration, and the complete tracker with every pull request and backport at #​5680.

  Highlights

  • Staged publishing (experimental, flags.stage, npm 11.17 or newer): a pipeline uploads a version, a maintainer reviews it, and only then it becomes installable (#​6176). GET /-/package/{name}/version/{version}/status reports whether a version is published or staged (#​6365).
  • Two-factor authentication (experimental, flags.tfa): time-based one-time passwords for login, account operations and publishing (#​6176).
  • Ownership and unpublish checks on every change: publish.check_owners now covers npm deprecate, version unpublish and dist-tag changes (#​6219); removing a version requires the unpublish permission on its own route (#​6384); publish rejects invalid tarball attachment names before saving metadata and records an upload only after the tarball is fully written (#​6367).
  • Pure ESM plugins through async plugin loading, and a promise-based storage plugin API with a compatibility adapter for callback-based storage plugins (#​5933).
  • Web UI: dark mode, refreshed login, signup and password screens and SWR-based state (#​5563); packages sorted by update time (#​5659); web.assetFolder (#​5653); home toolbar to filter, scope and sort, onboarding guide for empty registries, web.footer, web.poweredBy and web.help, package tabs in the URL and bun among the package managers (#​6400); per-language translation progress with a single translation source (#​6395); password changes from the account menu (#​6366).
  • Package filter plugins with allow and block rules (#​5548), glob patterns (#​5872) and excludeDeprecated (#​6028); notification hooks for publish and unpublish (#​5920).
  • Configuration: ConfigBuilder covers web, listen, https, publish, flags, notify, middlewares, filters, maxBodySize, userRateLimit, urlPrefix and i18n (#​5805); new server.cors (#​6255), server.dotfiles, server.hideStaticLogs, server.hidePingLogs (#​6192) and server.legacyAuthCache (#​6133).
  • Authentication: htpasswd verify_cache_ms caches successful password verifications for clients that send credentials on every request (#​6351); npm login, yarn npm login and pnpm login keep working through the Basic exception on the login routes (#​6354).
  • Uplinks and search: @verdaccio/proxy on got (#​5646, #​5746) with upstream errors mapped to registry errors (#​6022); /-/v1/search with rate limits, bounded pagination and batched access checks, uplink results paginated before the client offset (#​6235), configured uplink subpaths and headers preserved (#​6209), ISO timestamps, version validation and original uplink errors preserved (#​6263, #​6264, #​6265).
  • Distribution: the server composition and CLI helpers are exported for downstream distributions (#​5932, #​6286), and the new experimental @verdaccio/admin-cli ships a verdaccio-admin storage command group (#​6231).

  Bug fixes

  • Tarball downloads: uplink selection by URL, cleanup of failed downloads, no client hangs and a correct content-length (#​6194, #​6234); client-controlled dist.tarball URLs are not fetched off-uplink (#​6225); the uplink cache is refreshed on 304 (#​6276).
  • Package access, publish and unpublish rules match case-insensitively (#​6091); package and token name validation aligned with npm (#​6309, #​6314); search validation (#​6306, #​6317); missing versions, dist-tags and packages return not found (#​6332); 401 for invalid credentials on GET /-/user/ (#​5844); local storage no longer uses uncontrolled data in paths (#​5847); the home directory resolves through HOME on Windows (#​6247); missing Host header handled (#​5641).
  • Web: scope validation on the web package endpoints (#​6202), search component fixes (#​5647), signup, error states, i18n and routing (#​6210, #​6213), password change validation (#​6326), English fallback for untranslated strings (#​6406), JSON viewer (#​5651).
  • Logger: JSON sync output honoured, unused pretty destinations removed and file destination errors handled (#​6242, #​6260).

  Breaking changes

  • Node.js 24 or newer is required (#​5615).
  • Express 5 (#​5524): middleware plugins must use named wildcards (/*splat, /{*splat}), res.sendFile(filename, { root }) for absolute paths, and req.body is already parsed when plugins run.
  • YAML configuration only (#​5851); config.self_path was replaced by config.configPath (#​5850).
  • Bearer tokens for the package API (#​6152): _auth entries in .npmrc must move to _authToken; 401 responses advertise only Bearer. The login routes accept Basic credentials while security.api.basicLogin is enabled (the default).
  • Removed: the /-/all search endpoint (use /-/v1/search), npm star/unstar (#​5930), the deprecated AES encryption helpers (#​5744), the searchRemote flag (#​5801) and the debug-only PUT /:package/:version/-tag/:tag route.
  • Programmatic API (#​5808): the default export is the asynchronous runServer, which no longer accepts { listenArg }; await runServer(config) then call .listen(). Import Config, ConfigBuilder, getDefaultConfig and parseConfigFile from @verdaccio/core.
  • Logger: @verdaccio/logger-commons and @verdaccio/logger-prettify are merged into @verdaccio/logger (#​5657).
  • Build: dual ESM/CJS output built with Vite (#​5643); package exports changed, so update deep imports.
  • Relocated plugins: verdaccio-aws-s3-storage, verdaccio-google-cloud and verdaccio-active-directory moved to their own repositories.
  • A server secret shorter than 32 characters stops the server, and .sinopia-db.json databases are no longer read.

  Also in 6.x

  Dual ESM/CJS output, the package filter plugin, publish and unpublish notifications, the bounded /-/v1/search, the @verdaccio/e2e-cli workflow, the shared @verdaccio/ui-theme Web UI, the htpasswd, name and search validation fixes and the new Web UI home were also backported to 6.x; the tracker lists the 6.x release that carries each one.

  Tooling and dependencies

  pnpm 12 replaces Yarn for the workspace and CI (#​5748, #​6216); CI runs on Windows (#​6248); end-to-end tests run through @verdaccio/e2e-cli (#​5678); the repository carries AGENTS.md and agent skills (#​6252). Runtime dependencies move to Express 5.3, got 15, js-yaml 5, TypeScript 7 and Vite 8, with the published advisories in body-parser, proxy-addr, compression, lodash-es, dompurify and fast-uri patched (#​6334, #​6388).

  Upgrading

  Back up the configuration, storage and .verdaccio-db.json, update the runtime to Node.js 24, convert any JSON or JS configuration to YAML and test with a copy of the storage before switching. Do not run 6.x and 7.x against the same storage at the same time.

  Thanks to @​juanpicado, @​mbtools, @​dianmorales, @​jotadeveloper, @​davidus27, @​koliveira15, @​moglerdev, @​pranshuchittora, @​ReemX, @​RuneStone0, @​tmota900 and @​vsugrob for the work in this release line.

Minor Changes

• ddf993c: Adopt @verdaccio/server and drop the local api/web/storage forks. A thin Storage wrapper is kept to support legacy callback-based storage plugins, and the unused helpers in src/lib/utils.ts were removed.

Patch Changes

• e404c82: Updates the runtime dependencies express to 5.3.0 and semver to 7.8.5, and moves body-parser (used by Express to read request bodies) to 2.4.0.

  body-parser 2.4.0 fixes a denial of service where trailing bytes after a compressed request body could keep the server busy (GHSA-27r3-jxmh-p828). Transitive dependencies with published advisories (fast-uri, qs, ip-address) are also moved to their patched releases. None of these change any API: no configuration or plugin changes are needed.

  The rest of the changes in this release only affect the development toolchain and the test suite (@cypress/request is no longer used by the tests).

• a307098: Migrate the 7.x release workflow to Changesets action v2 and CLI v3.

• 256fd40: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

  The Docker base image uses Node.js 24.15.0 for compatibility with the updated npm.

• f565393: Update the proxy address dependency to correctly match trusted proxy subnets when determining client IP addresses. Earlier 7.x prereleases using the affected dependency can misidentify clients with certain IPv6 trust configurations. No configuration migration is required.

  Update @verdaccio/e2e-cli to 4.0.0, which drops pnpm 10, and remove pnpm 10 from the CLI e2e matrix.

• 6fd3e8a: Make /-/v1/search work for storage plugins that still use the callback API.

  Verdaccio 7 keeps callback-based storage plugins running through a compatibility
  adapter. Its search collected whatever the plugin streamed and handed the list
  straight back, with two consequences for every such plugin.

  The search query was dropped before it reached the plugin, and the adapter passed a
  name predicate that always returned true, so the plugin emitted its whole catalogue and
  nothing ever filtered it. /-/v1/search answered with every package in the registry
  regardless of the text searched for, and paginated over that full list. It failed
  silently: the endpoint returned 200 and the npm client still found what it asked for,
  buried among everything else.

  The adapter also passed the items through unchanged. The legacy contract emits the
  package itself, while the store reads item.package.name, so a plugin following the
  documented contract made the endpoint fail with a 500 instead.

  The adapter now filters the collected results by the query text and wraps anything that
  is not already in the store's shape. The filtering is done on the emitted name, never on
  the name predicate a plugin is given: that one receives the basename, so rejecting there
  would drop scoped packages whose full name does match. Operators running a callback-based
  storage plugin get working search without touching the plugin; plugins already on the
  promise-based API were never wrapped and are unaffected.

• f1f5d34: chore: trigger release

• a768d16: chore: replace eslint and prettier with oxlint and oxfmt

• 594f438: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 88bd996: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 908ccbb: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• e862a9a: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 1aef95b: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 304f155: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• c461320: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• a4ced54: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

v6.11.1

Compare Source

Patch Changes

• 62d8556: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.39 → 9.0.0-next-9.40

v6.11.0

Compare Source

Minor Changes

• 93010b3: web.showSearch: false now also disables the web search endpoint.

  Until now the option only hid the search box in the header, while /-/verdaccio/data/search kept answering. With showSearch: false the endpoint is no longer registered and answers 404, the same way web.login: false removes the web login endpoints. The npm search API used by npm search (/-/v1/search) is not affected, and nothing changes for registries that leave showSearch unset or set it to true.

Patch Changes

• a3a664b: Releases are published with npm provenance again.

  verdaccio 6.10.5, 6.10.6 and 6.10.7 reached the npm registry without a provenance attestation, while every release from 6.9.0 to 6.10.4 had one. The release pipeline switched from npm publish to yarn npm publish, and yarn ignored the setting that requested provenance, so those versions were published through trusted publishing but without a signed SLSA statement. The package contents were not affected.

  Package managers that compare trust evidence between versions, such as pnpm with trustPolicy: no-downgrade, refuse to install those three versions with ERR_PNPM_TRUST_DOWNGRADE. This release carries provenance again, so upgrading to it, or pinning 6.10.4 or earlier, installs cleanly; nothing else needs to change on the operator side.

• 90fde27: Update the bundled @verdaccio/* modules to their latest releases, which forward the new web UI options to the UI and fix a denial-of-service in request body parsing.

  The web UI options web.footer, web.poweredBy, web.help and web.showPackageListToolbar now reach the UI (@verdaccio/ui-theme 9.0.0-next-9.39); before this update the server dropped them. showPackageListToolbar defaults to false, so the home page looks the same after upgrading unless you turn it on, and bun is now listed among the default package managers shown on a package page.

  body-parser moves to 1.20.9, fixing a denial of service where trailing bytes after a compressed request body could tie up the server (GHSA-27r3-jxmh-p828). All 6.x releases that use express 4.22.3 are affected; no configuration change is needed.

v6.10.7

Compare Source

Patch Changes

• 7bd480a: The Docker image no longer trusts certificates issued through the compromised eMudhra (emSign) intermediate CAs.

  In October 2026, eMudhra disclosed that the private keys of several of its intermediate certificate authorities had been compromised. Anyone holding those keys can issue a TLS certificate that a client trusting the eMudhra chain accepts as valid, for any host. Verdaccio connects to its uplinks (such as registry.npmjs.org) over HTTPS, so an attacker able to intercept that traffic could impersonate an uplink and serve tampered metadata or tarballs, which Verdaccio would then cache.

  The image is now built on node:24.22.1-alpine instead of node:24.15.0-alpine. Node.js 24.22.1 updates its bundled root certificates to NSS 3.131.1, which removes emSign ECC Root CA - G3, and rejects chains that contain the compromised public keys. Node.js uses that bundled store for outgoing HTTPS by default. The image also upgrades Alpine's ca-certificates package at build time. That package matters only if you make Node.js read the system store, for example with NODE_EXTRA_CA_CERTS or --use-system-ca.

  Every earlier verdaccio/verdaccio 6.x image is affected. To get the fix, pull the new image. If you install Verdaccio from npm instead of Docker, upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later.

v6.10.6

Compare Source

Patch Changes

• 56b6a85: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

• db47d78: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.34 → 9.0.0-next-9.36

• fdbfef9: Improve request validation when changing passwords and signing in through the web API.

  Password changes validate the supplied credential fields before invoking the authentication plugin. Existing passwords remain eligible for replacement even when they do not meet the current policy. The existing validation for new passwords and authentication plugin error handling remain unchanged. No configuration changes are required.

  Web sign-in requests now validate the supplied credential fields the same way as password changes. Requests that omit the username or password, send either with a type other than a string, or send a null body are rejected with HTTP 400 and the message username and password is required; a null body previously failed with an internal server error (HTTP 500), and the other cases reached the authentication plugin. Empty strings are still passed to the authentication plugin, which rejects them as before. The web UI always sends both fields, so signing in from it is unaffected.

  This release also updates the internal @verdaccio/* modules and the bundled verdaccio-htpasswd and verdaccio-audit plugins to their latest 6.x-compatible versions. The shared password validator now accepts input of any type and rejects anything that is not a string, and the webhook notification templates use Handlebars 4.7.10, which includes a security fix. proxy-addr, which Express uses to resolve client addresses when server.trustProxy is configured, is updated to 2.0.8, which includes a security fix for trusted-subnet matching of IPv4-mapped IPv6 addresses.

• abced78: npm whoami and any other request to /-/whoami now answer 401 Unauthorized when the request carries no credentials or a token Verdaccio does not recognise.

  Until now the endpoint answered 200 with an empty body {} for anonymous requests, so clients that check the status code, rather than the username field, treated an expired or wrong token as a valid login. The npm public registry and Verdaccio 7 answer 401 in that case, and this release aligns 6.x with them. Requests with a valid token are unchanged and still return { "username": "<name>" }. No configuration change is required.

  This release also updates the internal @verdaccio/* modules to their latest 8.x patches. @verdaccio/core 8.3.3 corrects the input type of the shared password validator, without changing which passwords are accepted. @verdaccio/hooks 8.1.7 brings handlebars 4.7.10, which fixes several template injection advisories in the library that renders notification templates.

  proxy-addr, used by Express to decide which proxies are trusted when X-Forwarded-For is read, is pinned to 2.0.8 to fix an IP spoofing issue with IPv4-mapped IPv6 trusted subnets (GHSA-jqcg-44mw-7w3h).

v6.10.5

Compare Source

Patch Changes

• 2ccbacf: Migrate the 6.x release workflow to Changesets action v2 and CLI v3.

• c159460: Improve validation of Search v1 query parameters.

  size and from now accept only plain string values; anything else falls back to the default page size and offset, as other non-numeric values already did. Only plain string parameters are forwarded to uplinks. An uplink search response that cannot be read now ends that uplink's results, and local results are still returned. Unexpected errors in the search endpoint are reported through the regular error handler. Registry configuration does not need to change.

• ec341ee: Validate Search v1 query text before starting a search.

  Search requests must provide a single, non-blank text string. Missing or invalid search text now receives HTTP 400 with the JSON error code ERR_TEXT_MISSING, before searching local packages or uplinks.

  Earlier 6.x releases could accept searches without text. Clients that call the search API directly must now supply a non-blank query. Valid query text is preserved, and searches with no matching packages continue to return HTTP 200 with an empty results array.

• 35e8373: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.4 → 8.1.5
  • @verdaccio/config: 8.3.1 → 8.3.2
  • @verdaccio/core: 8.3.1 → 8.3.2
  • @verdaccio/hooks: 8.1.5 → 8.1.6
  • @verdaccio/loaders: 8.1.4 → 8.1.5
  • @verdaccio/local-storage-legacy: 11.4.4 → 11.4.5
  • @verdaccio/logger: 8.1.4 → 8.1.5
  • @verdaccio/middleware: 8.1.5 → 8.1.6
  • @verdaccio/package-filter: 13.2.2 → 13.2.3
  • @verdaccio/signature: 8.1.4 → 8.1.5
  • @verdaccio/tarball: 13.1.4 → 13.1.5
  • @verdaccio/ui-theme: 9.0.0-next-9.31 → 9.0.0-next-9.33
  • @verdaccio/url: 13.1.4 → 13.1.5
  • verdaccio-audit: 13.1.5 → 13.1.6
  • verdaccio-htpasswd: 13.1.4 → 13.1.5

  Package name validation now follows the npm rules for existing packages: names that start with an underscore, use @ without a scope, or contain characters that are not URL-friendly are rejected with HTTP 400 instead of being looked up. Packages whose names cannot be stored as a directory of the same name on every platform (for example nul or aux.js) are still served from uplinks, but are not cached locally and cannot be published to local storage; a warning is logged when one is requested. Rename any private package with such a name before upgrading. Registry configuration does not need to change.

• 3d1ca06: Improve version validation in GET /<package>/<version>.

  The endpoint now resolves only versions and dist-tags that the package actually defines. A version or tag name that the package does not define now returns HTTP 404 (version not found) in every case, instead of an internal server error for some names. Requests for existing versions, ranges and dist-tags behave as before, and registry configuration does not need to change.

  Update the internal @verdaccio/* modules to their latest 8.x releases (@verdaccio/core and @verdaccio/config 8.3.1, @verdaccio/auth 8.1.4, @verdaccio/middleware 8.1.5, verdaccio-htpasswd 13.1.4, @verdaccio/local-storage-legacy 11.4.4, verdaccio-auth-memory 13.1.4, verdaccio-memory 10.5.4, verdaccio-audit 13.1.5 and the rest of the set), which improve validation of user registration, authentication, API tokens and request parameters. When the htpasswd file is reloaded, users removed from it now stop authenticating without a restart.

  Update brace-expansion and ignore two advisories without a published fix (braces, http-cache-semantics) that are not reachable from the registry code paths.

v6.10.4

Compare Source

Patch Changes

• 7730e60: Update express to 4.22.3 — directly and through @verdaccio/middleware 8.1.4,
  verdaccio-audit 13.1.4 and @verdaccio/test-helper 4.1.4 — so the registry's entire HTTP
  stack resolves qs 6.16.0, which fixes several denial-of-service advisories in query-string
  handling: a remotely triggerable crash in qs.stringify (TypeError on crafted input), an
  arrayLimit bypass through bracket-key comma parsing that allows memory exhaustion, and a
  DoS via an attacker-controlled isBuffer check (GHSA-4mjr-xmp4-gh2g). A body-parser/qs
  resolution covers the one remaining consumer that pins qs below the fix. Query-string
  parsing behaviour is otherwise unchanged and no configuration change is needed.

  The same update refreshes the development dependency tree, clearing every high-severity
  yarn npm audit finding (stale transitive resolutions of tar, minimatch, socks/ip, js-yaml,
  form-data, nanoid, postcss, picomatch, tmp and systeminformation, plus vitest 4.1.11 for the
  @vitest/mocker path-traversal advisory) — none of these ship in the published package.

• aabb0b4: Fix npm publish failing with request size did not match content length when authenticating with a token created by npm token create.

  The JSON body parser was registered by the API router, which runs after apiJWTmiddleware() and after enforceGeneratedTokenMetadata(). The latter awaits a storage lookup for tokens that carry a server-issued key, so the request body was partially consumed before the parser attached. It is now registered before both, as it already is on master.

• e2602b3: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.30 → 9.0.0-next-9.31

v6.10.3

Compare Source

Patch Changes

• 98b58ef: fix: do not fetch client-controlled dist.tarball urls off-uplink @​cOmrade3267

  Only fetch a tarball url that a configured uplink actually serves. Off-uplink urls are
  fetched without uplink credentials and only for uplink-synced packages (recorded in
  _distfiles); a locally published package returns 404 instead of being fetched. Prevents
  sending an uplink Authorization header to an unrelated host.

v6.10.2

Compare Source

Patch Changes

• 6d972d1: fix: resolve fast-uri and brace-expansion security advisories

  fast-uri 3.1.6. Bumps the ajv/fast-uri resolution from 3.1.5 to 3.1.6, which
  fixes four high-severity advisories in the URI parser used by ajv for schema
  format validation: host confusion via skipped IDN canonicalization
  (GHSA-5jgf-p345-68v8),
  SSRF via malformed IPv6 normalization
  (GHSA-f65p-4m7j-42xc),
  SSRF via repeated hostname percent-decoding
  (GHSA-fph4-wmhf-6fwf),
  and host confusion via percent-encoded scheme normalization
  (GHSA-jqff-g426-hqxp).

  brace-expansion DoS cleanup. Updates the remaining vulnerable
  brace-expansion trees (1.1.11 → 1.1.18, 2.0.1 → 2.1.4) for
  GHSA-mh99-v99m-4gvg and
  drops the temporary audit ignores that covered them while the patched
  releases were still quarantined by the minimal-age gate.

• 6d972d1: chore: update e2e library

• ca00ee0: fix: stop re-compressing tarballs for gzip-accepting clients

  mime-db marks application/octet-stream as compressible, so the compression
  middleware re-gzipped every (already gzipped) .tgz download for clients
  that accept gzip — npm and undici do by default — wasting CPU on every
  download and stripping the Content-Length header. Tarball responses are
  now excluded from compression; JSON metadata responses stay compressed.

  Measured on a 30 MB tarball: ~18x less server CPU and ~20x faster downloads,
  with slightly fewer bytes on the wire (gzip over gzip nets negative).

• d4b8199: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.28 → 9.0.0-next-9.30

• d94ebff: fix: validate the scope segment on the web package endpoints

  The readme and sidebar web endpoints now validate the :scope route segment
  and return 404 for malformed requests.

v6.10.1

Compare Source

Patch Changes

• 90d5c20: Import shared helpers from @verdaccio/core and drop the deprecated @verdaccio/utils dependency

  All internal usages of @verdaccio/utils now resolve the same helpers from
  @verdaccio/core (validation, auth, crypto, package and author utilities), and
  the @verdaccio/utils dependency has been removed.

• 7805d50: Limit web UI search responses to 20 packages.

• c84070b: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.27 → 9.0.0-next-9.28

v6.10.0

Compare Source

Minor Changes

• 51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

  This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

  The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

  Enable it in config.yaml:

  server:
    legacyAuthCache:
      enabled: true
      ttlMs: 15000
      maxEntries: 1000

  Options:

  • enabled: enables the legacy token authentication cache. Default: false.
  • ttlMs: time in milliseconds before a cached validation expires. Default: 15000.
  • maxEntries: maximum number of cached legacy tokens. Default: 1000.

  See #​6147 and the original 8.x backport in #​6143.

v6.9.3

Compare Source

Patch Changes

• 3c8f391: Reject wildcard characters in package and tarball path validation.

• ebc08ba: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  This dependency refresh includes @verdaccio/package-filter 13.2.0 with excludeDeprecated support from #​6142 by @​jotadeveloper, based on the original work by @​davidus27. It also includes the @verdaccio/ui-theme update containing the homepage action hover fix from #​6135 by @​pranshuchittora.

  • @verdaccio/auth: 8.1.1 → 8.1.2
  • @verdaccio/config: 8.2.1 → 8.2.2
  • @verdaccio/core: 8.2.1 → 8.2.2
  • @verdaccio/hooks: 8.1.2 → 8.1.3
  • @verdaccio/loaders: 8.1.1 → 8.1.2
  • @verdaccio/local-storage-legacy: 11.4.1 → 11.4.2
  • @verdaccio/logger: 8.1.1 → 8.1.2
  • @verdaccio/middleware: 8.1.1 → 8.1.2
  • @verdaccio/package-filter: 13.1.1 → 13.2.0
  • @verdaccio/signature: 8.1.1 → 8.1.2
  • @verdaccio/tarball: 13.1.1 → 13.1.2
  • @verdaccio/ui-theme: 9.0.0-next-9.23 → 9.0.0-next-9.26
  • @verdaccio/url: 13.1.1 → 13.1.2
  • @verdaccio/utils: 8.2.1 → 8.2.2
  • verdaccio-audit: 13.1.1 → 13.1.2
  • verdaccio-htpasswd: 13.1.1 → 13.1.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.