[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
verdaccio (source)	6.10.6 → 7.0.2

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

verdaccio/verdaccio (verdaccio)

v7.0.2

Compare Source

Patch Changes

• c017767: Remove the HEALTHCHECK from the Docker image.

  The probe used localhost, which resolves to ::1 on Alpine, while the image listens on IPv4 only by default. The container was always reported as unhealthy even though it served requests normally. The image no longer declares a health check, as in 6.x.

  If you need one, add it yourself probing 127.0.0.1, for example in docker-compose.yaml:

  services:
    verdaccio:
      image: verdaccio/verdaccio
      healthcheck:
        test: ['CMD-SHELL', 'wget --quiet --tries=1 --spider http://127.0.0.1:4873/-/ping || exit 1']
        interval: 30s
        timeout: 5s
        start_period: 10s
        retries: 3

  See Health check in the Docker documentation for the docker run and HTTPS variants.

v7.0.1

Compare Source

Patch Changes

• 449ad6b: Restore the @verdaccio/package-filter plugin in the verdaccio 7 package so the filter configuration works again.

  Verdaccio 7.0.0 shipped a default config.yaml (also the one inside the verdaccio/verdaccio:7 Docker image) with the filters: '@verdaccio/package-filter' section enabled, but the package no longer declared the plugin as a dependency: it was dropped when the 7.x line moved to the published @verdaccio/* modules. On startup the plugin loader logged package not found, try to install @verdaccio/package-filter with a package manager and continued without it, so any minAgeDays, dateThreshold or block rules configured under filters were silently not enforced.

  The plugin is a dependency of verdaccio again, as it is on the 6.x line, and the startup error is gone. No configuration change is needed; installations that worked around the problem by commenting out the filters section can enable it again. Affected: verdaccio@7.0.0 and the verdaccio/verdaccio:7 Docker image.

• 14aaded: Show the verdaccio package version in the web UI footer instead of the internal module version.

  verdaccio@7.0.0 (and the verdaccio/verdaccio:7 Docker image) displayed 9.0.0-next-9.40 in the bottom-right corner of the web UI. The 7 binary is a thin layer over the published @verdaccio/* 9.x modules, and @verdaccio/server filled the version shown by the UI from its own package while the command line and the startup log already reported the right one.

  This release updates the @verdaccio/* modules to 9.0.0-next-9.41, whose @verdaccio/server lets the embedding binary set that value, and passes the verdaccio package version to it, so the UI now shows the same version as verdaccio --version. No configuration change is needed.

v7.0.0

Compare Source

Major Changes

• d33944c: Verdaccio 7.0.0 is the first stable release of the 7.x line. It is published to npm as latest and to Docker Hub as verdaccio/verdaccio:7, 7.0 and latest; the 6.x line continues under the latest-6 npm dist-tag and the 6 image tag. The release post is at https://verdaccio.org/blog/2026/10/25/verdaccio-7-release, the migration guide at https://verdaccio.org/blog/2026/09/27/verdaccio-6-to-7-migration, and the complete tracker with every pull request and backport at #​5680.

  Highlights

  • Staged publishing (experimental, flags.stage, npm 11.17 or newer): a pipeline uploads a version, a maintainer reviews it, and only then it becomes installable (#​6176). GET /-/package/{name}/version/{version}/status reports whether a version is published or staged (#​6365).
  • Two-factor authentication (experimental, flags.tfa): time-based one-time passwords for login, account operations and publishing (#​6176).
  • Ownership and unpublish checks on every change: publish.check_owners now covers npm deprecate, version unpublish and dist-tag changes (#​6219); removing a version requires the unpublish permission on its own route (#​6384); publish rejects invalid tarball attachment names before saving metadata and records an upload only after the tarball is fully written (#​6367).
  • Pure ESM plugins through async plugin loading, and a promise-based storage plugin API with a compatibility adapter for callback-based storage plugins (#​5933).
  • Web UI: dark mode, refreshed login, signup and password screens and SWR-based state (#​5563); packages sorted by update time (#​5659); web.assetFolder (#​5653); home toolbar to filter, scope and sort, onboarding guide for empty registries, web.footer, web.poweredBy and web.help, package tabs in the URL and bun among the package managers (#​6400); per-language translation progress with a single translation source (#​6395); password changes from the account menu (#​6366).
  • Package filter plugins with allow and block rules (#​5548), glob patterns (#​5872) and excludeDeprecated (#​6028); notification hooks for publish and unpublish (#​5920).
  • Configuration: ConfigBuilder covers web, listen, https, publish, flags, notify, middlewares, filters, maxBodySize, userRateLimit, urlPrefix and i18n (#​5805); new server.cors (#​6255), server.dotfiles, server.hideStaticLogs, server.hidePingLogs (#​6192) and server.legacyAuthCache (#​6133).
  • Authentication: htpasswd verify_cache_ms caches successful password verifications for clients that send credentials on every request (#​6351); npm login, yarn npm login and pnpm login keep working through the Basic exception on the login routes (#​6354).
  • Uplinks and search: @verdaccio/proxy on got (#​5646, #​5746) with upstream errors mapped to registry errors (#​6022); /-/v1/search with rate limits, bounded pagination and batched access checks, uplink results paginated before the client offset (#​6235), configured uplink subpaths and headers preserved (#​6209), ISO timestamps, version validation and original uplink errors preserved (#​6263, #​6264, #​6265).
  • Distribution: the server composition and CLI helpers are exported for downstream distributions (#​5932, #​6286), and the new experimental @verdaccio/admin-cli ships a verdaccio-admin storage command group (#​6231).

  Bug fixes

  • Tarball downloads: uplink selection by URL, cleanup of failed downloads, no client hangs and a correct content-length (#​6194, #​6234); client-controlled dist.tarball URLs are not fetched off-uplink (#​6225); the uplink cache is refreshed on 304 (#​6276).
  • Package access, publish and unpublish rules match case-insensitively (#​6091); package and token name validation aligned with npm (#​6309, #​6314); search validation (#​6306, #​6317); missing versions, dist-tags and packages return not found (#​6332); 401 for invalid credentials on GET /-/user/ (#​5844); local storage no longer uses uncontrolled data in paths (#​5847); the home directory resolves through HOME on Windows (#​6247); missing Host header handled (#​5641).
  • Web: scope validation on the web package endpoints (#​6202), search component fixes (#​5647), signup, error states, i18n and routing (#​6210, #​6213), password change validation (#​6326), English fallback for untranslated strings (#​6406), JSON viewer (#​5651).
  • Logger: JSON sync output honoured, unused pretty destinations removed and file destination errors handled (#​6242, #​6260).

  Breaking changes

  • Node.js 24 or newer is required (#​5615).
  • Express 5 (#​5524): middleware plugins must use named wildcards (/*splat, /{*splat}), res.sendFile(filename, { root }) for absolute paths, and req.body is already parsed when plugins run.
  • YAML configuration only (#​5851); config.self_path was replaced by config.configPath (#​5850).
  • Bearer tokens for the package API (#​6152): _auth entries in .npmrc must move to _authToken; 401 responses advertise only Bearer. The login routes accept Basic credentials while security.api.basicLogin is enabled (the default).
  • Removed: the /-/all search endpoint (use /-/v1/search), npm star/unstar (#​5930), the deprecated AES encryption helpers (#​5744), the searchRemote flag (#​5801) and the debug-only PUT /:package/:version/-tag/:tag route.
  • Programmatic API (#​5808): the default export is the asynchronous runServer, which no longer accepts { listenArg }; await runServer(config) then call .listen(). Import Config, ConfigBuilder, getDefaultConfig and parseConfigFile from @verdaccio/core.
  • Logger: @verdaccio/logger-commons and @verdaccio/logger-prettify are merged into @verdaccio/logger (#​5657).
  • Build: dual ESM/CJS output built with Vite (#​5643); package exports changed, so update deep imports.
  • Relocated plugins: verdaccio-aws-s3-storage, verdaccio-google-cloud and verdaccio-active-directory moved to their own repositories.
  • A server secret shorter than 32 characters stops the server, and .sinopia-db.json databases are no longer read.

  Also in 6.x

  Dual ESM/CJS output, the package filter plugin, publish and unpublish notifications, the bounded /-/v1/search, the @verdaccio/e2e-cli workflow, the shared @verdaccio/ui-theme Web UI, the htpasswd, name and search validation fixes and the new Web UI home were also backported to 6.x; the tracker lists the 6.x release that carries each one.

  Tooling and dependencies

  pnpm 12 replaces Yarn for the workspace and CI (#​5748, #​6216); CI runs on Windows (#​6248); end-to-end tests run through @verdaccio/e2e-cli (#​5678); the repository carries AGENTS.md and agent skills (#​6252). Runtime dependencies move to Express 5.3, got 15, js-yaml 5, TypeScript 7 and Vite 8, with the published advisories in body-parser, proxy-addr, compression, lodash-es, dompurify and fast-uri patched (#​6334, #​6388).

  Upgrading

  Back up the configuration, storage and .verdaccio-db.json, update the runtime to Node.js 24, convert any JSON or JS configuration to YAML and test with a copy of the storage before switching. Do not run 6.x and 7.x against the same storage at the same time.

  Thanks to @​juanpicado, @​mbtools, @​dianmorales, @​jotadeveloper, @​davidus27, @​koliveira15, @​moglerdev, @​pranshuchittora, @​ReemX, @​RuneStone0, @​tmota900 and @​vsugrob for the work in this release line.

Minor Changes

• ddf993c: Adopt @verdaccio/server and drop the local api/web/storage forks. A thin Storage wrapper is kept to support legacy callback-based storage plugins, and the unused helpers in src/lib/utils.ts were removed.

Patch Changes

• e404c82: Updates the runtime dependencies express to 5.3.0 and semver to 7.8.5, and moves body-parser (used by Express to read request bodies) to 2.4.0.

  body-parser 2.4.0 fixes a denial of service where trailing bytes after a compressed request body could keep the server busy (GHSA-27r3-jxmh-p828). Transitive dependencies with published advisories (fast-uri, qs, ip-address) are also moved to their patched releases. None of these change any API: no configuration or plugin changes are needed.

  The rest of the changes in this release only affect the development toolchain and the test suite (@cypress/request is no longer used by the tests).

• a307098: Migrate the 7.x release workflow to Changesets action v2 and CLI v3.

• 256fd40: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

  The Docker base image uses Node.js 24.15.0 for compatibility with the updated npm.

• f565393: Update the proxy address dependency to correctly match trusted proxy subnets when determining client IP addresses. Earlier 7.x prereleases using the affected dependency can misidentify clients with certain IPv6 trust configurations. No configuration migration is required.

  Update @verdaccio/e2e-cli to 4.0.0, which drops pnpm 10, and remove pnpm 10 from the CLI e2e matrix.

• 6fd3e8a: Make /-/v1/search work for storage plugins that still use the callback API.

  Verdaccio 7 keeps callback-based storage plugins running through a compatibility
  adapter. Its search collected whatever the plugin streamed and handed the list
  straight back, with two consequences for every such plugin.

  The search query was dropped before it reached the plugin, and the adapter passed a
  name predicate that always returned true, so the plugin emitted its whole catalogue and
  nothing ever filtered it. /-/v1/search answered with every package in the registry
  regardless of the text searched for, and paginated over that full list. It failed
  silently: the endpoint returned 200 and the npm client still found what it asked for,
  buried among everything else.

  The adapter also passed the items through unchanged. The legacy contract emits the
  package itself, while the store reads item.package.name, so a plugin following the
  documented contract made the endpoint fail with a 500 instead.

  The adapter now filters the collected results by the query text and wraps anything that
  is not already in the store's shape. The filtering is done on the emitted name, never on
  the name predicate a plugin is given: that one receives the basename, so rejecting there
  would drop scoped packages whose full name does match. Operators running a callback-based
  storage plugin get working search without touching the plugin; plugins already on the
  promise-based API were never wrapped and are unaffected.

• f1f5d34: chore: trigger release

• a768d16: chore: replace eslint and prettier with oxlint and oxfmt

• 594f438: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 88bd996: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 908ccbb: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• e862a9a: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 1aef95b: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 304f155: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• c461320: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• a4ced54: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

v6.11.1

Compare Source

Patch Changes

• 62d8556: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.39 → 9.0.0-next-9.40

v6.11.0

Compare Source

Minor Changes

• 93010b3: web.showSearch: false now also disables the web search endpoint.

  Until now the option only hid the search box in the header, while /-/verdaccio/data/search kept answering. With showSearch: false the endpoint is no longer registered and answers 404, the same way web.login: false removes the web login endpoints. The npm search API used by npm search (/-/v1/search) is not affected, and nothing changes for registries that leave showSearch unset or set it to true.

Patch Changes

• a3a664b: Releases are published with npm provenance again.

  verdaccio 6.10.5, 6.10.6 and 6.10.7 reached the npm registry without a provenance attestation, while every release from 6.9.0 to 6.10.4 had one. The release pipeline switched from npm publish to yarn npm publish, and yarn ignored the setting that requested provenance, so those versions were published through trusted publishing but without a signed SLSA statement. The package contents were not affected.

  Package managers that compare trust evidence between versions, such as pnpm with trustPolicy: no-downgrade, refuse to install those three versions with ERR_PNPM_TRUST_DOWNGRADE. This release carries provenance again, so upgrading to it, or pinning 6.10.4 or earlier, installs cleanly; nothing else needs to change on the operator side.

• 90fde27: Update the bundled @verdaccio/* modules to their latest releases, which forward the new web UI options to the UI and fix a denial-of-service in request body parsing.

  The web UI options web.footer, web.poweredBy, web.help and web.showPackageListToolbar now reach the UI (@verdaccio/ui-theme 9.0.0-next-9.39); before this update the server dropped them. showPackageListToolbar defaults to false, so the home page looks the same after upgrading unless you turn it on, and bun is now listed among the default package managers shown on a package page.

  body-parser moves to 1.20.9, fixing a denial of service where trailing bytes after a compressed request body could tie up the server (GHSA-27r3-jxmh-p828). All 6.x releases that use express 4.22.3 are affected; no configuration change is needed.

v6.10.7

Compare Source

Patch Changes

• 7bd480a: The Docker image no longer trusts certificates issued through the compromised eMudhra (emSign) intermediate CAs.

  In October 2026, eMudhra disclosed that the private keys of several of its intermediate certificate authorities had been compromised. Anyone holding those keys can issue a TLS certificate that a client trusting the eMudhra chain accepts as valid, for any host. Verdaccio connects to its uplinks (such as registry.npmjs.org) over HTTPS, so an attacker able to intercept that traffic could impersonate an uplink and serve tampered metadata or tarballs, which Verdaccio would then cache.

  The image is now built on node:24.22.1-alpine instead of node:24.15.0-alpine. Node.js 24.22.1 updates its bundled root certificates to NSS 3.131.1, which removes emSign ECC Root CA - G3, and rejects chains that contain the compromised public keys. Node.js uses that bundled store for outgoing HTTPS by default. The image also upgrades Alpine's ca-certificates package at build time. That package matters only if you make Node.js read the system store, for example with NODE_EXTRA_CA_CERTS or --use-system-ca.

  Every earlier verdaccio/verdaccio 6.x image is affected. To get the fix, pull the new image. If you install Verdaccio from npm instead of Docker, upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later.

[gemini-code-assist]

Code Review

This pull request updates the 'verdaccio' dependency in package.json from version 6.10.6 to 7.0.2. The review feedback highlights that this major version upgrade introduces breaking changes, specifically requiring '_auth' entries in configuration files to be migrated to '_authToken', which will cause the end-to-end test suite to fail unless updated.

[gemini-code-assist]

The update to Verdaccio 7 introduces breaking changes. Specifically, _auth entries in .npmrc and .yarnrc must be migrated to _authToken. Please ensure the test suite is updated to reflect these changes, as the current implementation in tests/e2e/utils/registry.ts using _auth will likely fail.

[angular-robot]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 7.x releases. But if you manually upgrade to 7.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.