Skip to content

Update verdaccio/verdaccio Docker tag to v6 - #13

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/verdaccio-verdaccio-6.x
Open

Update verdaccio/verdaccio Docker tag to v6#13
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/verdaccio-verdaccio-6.x

Conversation

@renovate

@renovate renovate Bot commented Sep 20, 2024 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
verdaccio/verdaccio final major 4.11.0 → 6.10.0

Release Notes

verdaccio/verdaccio (verdaccio/verdaccio)

v6.10.0

Compare Source

Minor Changes

  • 51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

    This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

    The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

    Enable it in config.yaml:

    server:
  legacyAuthCache:
    enabled: true
    ttlMs: 15000
    maxEntries: 1000

    Options:

    • enabled: enables the legacy token authentication cache. Default: false.
    • ttlMs: time in milliseconds before a cached validation expires. Default: 15000.
    • maxEntries: maximum number of cached legacy tokens. Default: 1000.

    See #​6147 and the original 8.x backport in #​6143.

v6.9.3

Compare Source

Patch Changes

  • 3c8f391: Reject wildcard characters in package and tarball path validation.

  • ebc08ba: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    This dependency refresh includes @verdaccio/package-filter 13.2.0 with excludeDeprecated support from #​6142 by @​jotadeveloper, based on the original work by @​davidus27. It also includes the @verdaccio/ui-theme update containing the homepage action hover fix from #​6135 by @​pranshuchittora.

    • @verdaccio/auth: 8.1.1 → 8.1.2
    • @verdaccio/config: 8.2.1 → 8.2.2
    • @verdaccio/core: 8.2.1 → 8.2.2
    • @verdaccio/hooks: 8.1.2 → 8.1.3
    • @verdaccio/loaders: 8.1.1 → 8.1.2
    • @verdaccio/local-storage-legacy: 11.4.1 → 11.4.2
    • @verdaccio/logger: 8.1.1 → 8.1.2
    • @verdaccio/middleware: 8.1.1 → 8.1.2
    • @verdaccio/package-filter: 13.1.1 → 13.2.0
    • @verdaccio/signature: 8.1.1 → 8.1.2
    • @verdaccio/tarball: 13.1.1 → 13.1.2
    • @verdaccio/ui-theme: 9.0.0-next-9.23 → 9.0.0-next-9.26
    • @verdaccio/url: 13.1.1 → 13.1.2
    • @verdaccio/utils: 8.2.1 → 8.2.2
    • verdaccio-audit: 13.1.1 → 13.1.2
    • verdaccio-htpasswd: 13.1.1 → 13.1.2

v6.9.2

Compare Source

Patch Changes

  • 297dc43: fix: apply package access controls to the starredByUser endpoint

    The GET /-/_view/starredByUser view did not enforce the configured package
    access policy when listing a user's starred packages. Results are now filtered
    through auth.allow_access, so the response only includes packages the
    requesting client is authorized to see.

  • 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

v6.9.0

Compare Source

Minor Changes

  • b67a665: feat: require Node.js 22 as the minimum supported version

    Node.js 22 or higher is now required (previously the CLI still accepted Node.js 18,
    while engines already demanded 20). The CLI refuses to start on older runtimes and
    engines is set to >=22; Node.js 24 is the recommended version. CI, e2e, and smoke
    test matrices now cover Node.js 22, 24, and 26. Registry operators on Node.js 18 or 20
    must upgrade the runtime before taking this release.

  • b67a665: feat: dual CJS + ESM build with exports field, migrate build from babel to vite 8

    Native ESM support. The package now ships both CommonJS (build/**/*.js) and ESM
    (build/**/*.mjs) outputs and declares an exports field, so
    import { runServer } from 'verdaccio' resolves a real ES module instead of the
    CommonJS interop. require('verdaccio') keeps working exactly as before. The
    verdaccio CLI now runs on the ESM build, which means ESM-only dependencies can be
    loaded at runtime on every supported Node.js version.

    Build toolchain. Babel has been replaced by vite 8 (rolldown) for transpilation;
    type declarations are still emitted by TypeScript. This is not observable in the
    registry behavior, but local workflows changed: yarn start and the debug/ bootstrap
    scripts now use tsx instead of babel-node/@babel/register.

Patch Changes

  • b67a665: fix(deps): update @​verdaccio/hooks to 8.1.1

    Restores publish/unpublish webhook notifications when running on the ESM build: hooks
    8.1.0 could not send them (the notify client failed silently on every call). The new
    version replaces the frozen got-cjs fork with got 15 loaded in a way that works
    from both the ESM and CommonJS builds, and reports delivery failures based on the real
    HTTP response status.

  • b67a665: fix(deps): update @​verdaccio/* packages to the 2026-07-25 release batch

    Updates all @verdaccio/* and verdaccio-* dependencies (config 8.1.4, core 8.1.4,
    auth 8.0.6, middleware 8.0.7, htpasswd/audit 13.0.5, among others). Notably
    @verdaccio/config 8.1.4 moves to js-yaml 4.3.0, resolving the high-severity
    advisory GHSA-52cp-r559-cp3m
    (YAML merge-key chains forcing quadratic CPU consumption).

  • 2969ec8: fix: migrate uplink/storage URL parsing to the WHATWG URL API

    Removes the [DEP0169] DeprecationWarning: url.parse() printed at startup on
    Node.js 22+. The proxy and local-storage layers no longer use the legacy url.parse()
    / url.format() helpers; uplink URL validation, distfile filename extraction, and the
    remote-protocol tarball rewrite now go through the standardized URL API. Behavior is
    unchanged for the absolute HTTP(S) URLs used in practice — the default HTTPS port :443
    still normalizes to a match, and invalid uplink URLs are treated as not-valid instead of
    being parsed leniently.

    Because the WHATWG URL constructor throws on malformed input (unlike the lenient legacy
    url.parse()), a misconfigured uplink url now fails fast at startup with a clear,
    credential-redacted error, and a malformed dist.tarball returned by an upstream registry
    is skipped (with a warning) instead of aborting the package update. Uplink URL validation
    also now compares the uplink's own port when deciding whether to ignore the default HTTPS
    port, so an HTTPS uplink on a non-default port no longer matches a default-port tarball.

v6.8.0

Compare Source

Minor Changes

  • 962fba8: feat: add unpublish notification hooks

    Port of #​5920 (ref #​5328). The notify webhook now also fires when a package is unpublished entirely and when a single version (tarball) is removed, not only on publish. Notification templates can distinguish the event through the new {{ publishType }} (publish | unpublish) and {{ publishedPackage }} variables, and the {{ publisher }} object exposes only name, groups and real_groups, so the remote user auth token can never leak to the notification endpoint (via @verdaccio/hooks 8.0.4).

Patch Changes

  • f0684dc: fix: return 403 to client when uplink responds with 403 for tarball requests

    Previously, any non-200/404 response from an uplink (e.g. a security proxy blocking a package download) would result in a generic 500 error being returned to the client. This change propagates 403 responses from the uplink through to the client, including any error detail from the response body, so callers can distinguish authorization failures from other upstream errors.

  • 3a84578: chore: refactor eslint

  • b7a5db1: fix: rate limit and bound the npm search v1 endpoint

    The /-/v1/search endpoint now applies the userRateLimit rate limiting middleware (matching the login, token and profile endpoints), clamps the size (max 250, like the public npm registry) and from (max 10000) pagination parameters, and stops evaluating package access as soon as the requested page is filled instead of running an auth check over the entire result set. The clamped values are also what gets forwarded to uplink registries (the raw request URL is no longer passed through), so the bounds hold end-to-end. This prevents cheap anonymous requests from triggering unbounded full-catalog scans. As part of this, pagination is fixed: results were sliced with slice(from, size) instead of slice(from, from + size), so pages beyond the first were wrong.

    Search results for local packages also emit npm-search-compatible maintainers ({ username, email }) — npm 11 on Node 24 crashes rendering entries without username (The "str" argument must be of type string. Received undefined) — and the publisher field is now populated from _npmUser when the publishing client provided it, falling back to the first maintainer, so the npm CLI shows the publishing user instead of by ???.

  • 808d916: fix: pick the right uplink for tarballs and heal missing distfile records

    Uplink selection. With several uplinks configured for a package, tarball downloads used the last uplink whose package pattern matched, even when the tarball url belongs to a different one, which could make downloads fail against registries that require authentication. The uplink is now selected by matching the tarball url: the registry recorded on the distfile wins, then the uplink whose url serves the file; when none matches, an autogenerated uplink with default settings is used. Single-uplink setups keep the previous behavior for tarballs hosted on another host (a CDN).

    Missing distfile records. Storages written by other verdaccio versions can carry cached versions without their _distfiles records, which made those tarballs permanently return 404 no such file available. The tarball location is now resolved from the version's dist.tarball metadata when the record is missing, and the record is restored when the tarball is cached.

  • a2de1d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.20 → 9.0.0-next-9.21

v6.7.4

Compare Source

Patch Changes

  • 0205c78: fix: run jwt middleware before middleware plugins

    Register the JWT middleware before middleware plugins are loaded so that
    req.remote_user (anonymous by default) is available inside a plugin's
    register_middlewares. The API router keeps its own JWT middleware behind a
    guard so it is not executed twice.

    Backport of #​5697

    Closes #​5167

v6.7.3

Compare Source

Patch Changes

  • f8fdfc2: fix: enforce generated npm token metadata

    Generated npm tokens (POST /-/npm/v1/tokens) stored their readonly and
    cidr_whitelist restrictions but never enforced them, and deleting a token did
    not revoke it for the package APIs. A token marked read-only or pinned to a CIDR
    range could still publish packages and change dist-tags, and a deleted token
    remained usable.

    Generated tokens now embed a server-issued key (in the JWT claim, or in the
    encrypted legacy AES payload) and a new enforceGeneratedTokenMetadata
    middleware looks that key up on each request, rejecting the token when it is
    missing/revoked, used outside its CIDR whitelist, or used for a write while
    read-only. Enforcement applies to both AES and JWT API-token modes.

    Note: tokens issued before upgrading carry no key and are not retroactively
    constrained — regenerate them to apply the restrictions.

  • be80623: fix: allow npm token create without readonly/cidr_whitelist

    npm token create in npm >= 11 (and the npm 12 prereleases) rewrote the
    request body: it no longer sends readonly and only sends cidr_whitelist
    when --cidr is passed. The POST /-/npm/v1/tokens endpoint required both,
    so modern npm clients failed with 422 the parameters are not valid.

    The endpoint now defaults readonly to false and cidr_whitelist to []
    when they are absent, while still rejecting values of the wrong type.

  • 75c85d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.19 → 9.0.0-next-9.20

  • d5e5332: chore: update dependencies

    Updates runtime dependencies @verdaccio/ui-theme (9.0.0-next-9.19) and
    semver (7.8.2), along with development dependencies: Babel 7.29.7,
    @changesets/cli 2.31.0, ESLint 10.4.1, Vitest 4.1.8, Cypress 15.16.0,
    Prettier 3.8.3, @verdaccio/test-helper 4.0.4, @verdaccio/eslint-config
    13.1.2, and assorted type definitions.

v6.7.2

Compare Source

Patch Changes

v6.7.1

Compare Source

Patch Changes
  • a75f9bb: chore: refactor docker publish pipeline

v6.6.0

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.5.2...v6.6.0

v6.5.2

Compare Source

6.5.2 (2026-04-19)
Bug Fixes

v6.5.1

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.5.0...v6.5.1

v6.5.0

Compare Source

Features
Bug Fixes

v6.4.0

Compare Source

Features

Package Filter Plugins (#​5786, #​5548) by @​vsugrob, @​pyhp2017 @​juanpicado

⚠️ Please help us to test this feature (it is pretty new and might be not perfect) ref https://redirect.github.com/orgs/verdaccio/discussions/5796
The @verdaccio/package-filter package is bundled by default but must be enabled by the user.

@verdaccio/package-filter is a built-in plugin that intercepts package metadata from uplinks and removes versions matching configurable rules. With no rules configured, it acts as a no-op passthrough.

Block a compromised package version
filters:
  '@verdaccio/package-filter':
    block:
      - package: 'event-stream'
        versions: '3.3.6'
Block an entire malicious scope
filters:
  '@verdaccio/package-filter':
    block:
      - scope: '@malicious'
Quarantine recently published versions

Hide versions published less than 7 days ago, giving time for review before adoption:

filters:
  '@verdaccio/package-filter':
    minAgeDays: 7
Freeze registry to a point in time

Only serve versions published before a specific date:

filters:
  '@verdaccio/package-filter':
    dateThreshold: '2025-01-01'
Whitelist trusted packages within blocked rules
filters:
  '@verdaccio/package-filter':
    minAgeDays: 30
    allow:
      - scope: '@my-company'
      - package: 'trusted-pkg'
Replace instead of remove

Substitute a blocked version with the nearest older safe version, useful when removing it would break transitive dependencies:

filters:
  '@verdaccio/package-filter':
    block:
      - package: 'compromised-lib'
        versions: '>=3.0.0'
        strategy: replace
Full example
filters:
  '@verdaccio/package-filter':
    minAgeDays: 7
    block:
      - scope: '@malicious'
      - package: 'typosquat-pkg'
      - package: 'compromised-lib'
        versions: '>=3.0.0'
        strategy: replace
    allow:
      - scope: '@my-org'
      - package: 'compromised-lib'
        versions: '3.0.1'

Bug Fixes

Full Changelog: verdaccio/verdaccio@v6.3.2...v6.4.0

v6.3.2

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.3.1...v6.3.2

v6.3.1

Compare Source

  • No changes
  • Only to create new docker latest image

Full Changelog: verdaccio/verdaccio@v6.3.0...v6.3.1

v6.2.9

Compare Source

Full Changelog: verdaccio/verdaccio@v6.2.8...v6.2.9

  • No changes in the source code
  • Fixed docker publish build wasn't correctly pushing the latest and semantic version tags

Reference: https://redirect.github.com/orgs/verdaccio/discussions/5582

v6.2.5

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.2.4...v6.2.5

v6.2.4

Compare Source

What's Changed

VERDACCIO_ADDRESS Environment Variable for Docker

You can now set the VERDACCIO_ADDRESS environment variable to control Verdaccio’s network bind address.

  • Choose IPv4 (0.0.0.0), IPv6 ([::]), or a specific interface.
  • Improves compatibility for dual-stack and custom environments.

Example:

docker run -e VERDACCIO_ADDRESS=0.0.0.0 ...
docker run -e VERDACCIO_ADDRESS='[::]' ...

More info at : https://verdaccio.org/docs/env/

Full Changelog: verdaccio/verdaccio@v6.2.3...v6.2.4

v6.2.3

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.2.2...v6.2.3

v6.2.2

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.2.1...v6.2.2

v6.2.1

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.2.0...v6.2.1

v6.2.0

Compare Source

What's Changed

also includes improvements from master branch from @​mbtools (I will expand on this later)

New Contributors

Full Changelog: verdaccio/verdaccio@v6.1.6...v6.2.0

v6.1.6

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.1.5...v6.1.6

v6.1.5

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.1.4...v6.1.5

v6.1.4

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.1.3...v6.1.4

v6.1.3

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.1.2...v6.1.3

v6.1.2

Compare Source

6.1.2 (2025-04-01)
Bug Fixes

v6.1.1

Compare Source

6.1.1 (2025-03-30)
Reported Bugs (fixed at v6.1.2)
Bug Fixes

v6.1.0

Compare Source

Reported bugs from this version (fixed at v6.1.2)

What's Changed

Big thanks to @​mbtools for the last three months of remarkable improvements (which are behind the core dev updates, mostly on the master branch)

Improvements

Improved logging for plugins

Before

info --- plugin successfully loaded: verdaccio-htpasswd
info --- plugin successfully loaded: verdaccio-audit

New

info --- plugin verdaccio-htpasswd successfully loaded (authentication)
info --- plugin verdaccio-audit successfully loaded (middleware)
info --- plugin @verdaccio/ui-theme successfully loaded (theme)
Other improvements

Full Changelog: verdaccio/verdaccio@v6.0.5...v6.1.0

v6.0.5

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.0.4...v6.0.5

v6.0.4

Compare Source

v6.0.4

What's Changed

Full Changelog: verdaccio/verdaccio@v6.0.3...v6.0.4

v6.0.3

Compare Source

What's Changed

Full Changelog: verdaccio/verdaccio@v6.0.2...v6.0.3

v6.0.2

Compare Source

6.0.2 (2024-11-17)

What's Changed

Full Changelog: verdaccio/verdaccio@v6.0.1...v6.0.2

v6.0.1

Compare Source

6.0.1 (2024-10-16)
Bug Fixes

v6.0.0

Compare Source

Update notes, no considerable changes on this major release, for npm.js users only dropping Node.js, 14 and 16 support, minimum now is Node.js 18 and no changes for Docker users.

Bug Fixes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from c4d73aa to 0c4418e Compare October 16, 2024 20:49
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 0c4418e to 99383b2 Compare November 17, 2024 16:43
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 3 times, most recently from fc1e1ff to 14ea053 Compare December 21, 2024 11:08
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 14ea053 to fb6f8cf Compare April 20, 2025 23:43
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from 7fe2f5b to a9632ea Compare June 17, 2025 23:27
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from a9632ea to 22565db Compare June 29, 2025 13:39
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 22565db to fbc9519 Compare July 25, 2025 11:54
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from fbc9519 to c565085 Compare September 30, 2025 01:54
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from c565085 to 61181f0 Compare October 24, 2025 16:50
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from 388c44f to 1605170 Compare November 27, 2025 21:52
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 1605170 to 42b0d52 Compare December 2, 2025 20:49
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 42b0d52 to f206d78 Compare January 31, 2026 20:50
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from f206d78 to 200fea3 Compare February 26, 2026 11:18
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from 986d3ab to 29c6f73 Compare March 15, 2026 00:46
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from a916671 to eb11855 Compare April 11, 2026 12:36
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from 2f7de09 to 74726dc Compare April 19, 2026 14:27
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from 87cfe59 to a21c618 Compare May 16, 2026 17:07
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from a21c618 to 6d7990f Compare May 25, 2026 17:42
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch 2 times, most recently from 4af5b79 to 57759a1 Compare June 21, 2026 13:43
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 57759a1 to 569a668 Compare July 13, 2026 23:34
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 569a668 to da3a31a Compare July 27, 2026 02:13
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from da3a31a to cff4997 Compare August 2, 2026 21:33
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from cff4997 to 664ccb9 Compare August 18, 2026 02:08
@renovate
renovate Bot force-pushed the renovate/verdaccio-verdaccio-6.x branch from 664ccb9 to 3b1b3b5 Compare August 18, 2026 16:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants