Verdaccio - Package Updates

[Package Updates]

[1.83.2]

• Update verdaccio to 6.10.2
• Full Changelog
• fix: resolve fast-uri and brace-expansion security advisories
• fix: stop re-compressing tarballs for gzip-accepting clients
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• fix: validate the scope segment on the web package endpoints

[Package Updates]

[1.83.3]

• Update verdaccio to 6.10.3
• Full Changelog
• fix: do not fetch client-controlled dist.tarball urls off-uplink

[Package Updates]

[1.84.0]

• Update verdaccio-openid to 0.19.0

[Package Updates]

[1.84.1]

• Update verdaccio to 6.10.4
• Full Changelog
• 7730e60: Update express to 4.22.3 directly and through @verdaccio/middleware 8.1.4,
• verdaccio-audit 13.1.4 and @verdaccio/test-helper 4.1.4 so the registry's entire HTTP
• stack resolves qs 6.16.0, which fixes several denial-of-service advisories in query-string
• handling: a remotely triggerable crash in qs.stringify (TypeError on crafted input), an
• arrayLimit bypass through bracket-key comma parsing that allows memory exhaustion, and a
• DoS via an attacker-controlled isBuffer check (GHSA-4mjr-xmp4-gh2g). A body-parser/qs
• resolution covers the one remaining consumer that pins qs below the fix. Query-string
• parsing behaviour is otherwise unchanged and no configuration change is needed.
• aabb0b4: Fix npm publish failing with request size did not match content length when authenticating with a token created by npm token create.
• e2602b3: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.84.2]

• Update verdaccio to 6.10.5
• Full Changelog
• 2ccbacf: Migrate the 6.x release workflow to Changesets action v2 and CLI v3.
• c159460: Improve validation of Search v1 query parameters.
• ec341ee: Validate Search v1 query text before starting a search.
• 35e8373: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• 3d1ca06: Improve version validation in GET /<package>/<version>.

[Package Updates]

[1.84.3]

• Update verdaccio to 6.10.6
• Full Changelog
• Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• @verdaccio/ui-theme: 9.0.0-next-9.34 9.0.0-next-9.36
• Improve request validation when changing passwords and signing in through the web API.
• Password changes validate the supplied credential fields before invoking the authentication plugin. Existing passwords remain eligible for replacement even when they do not meet the current policy. The existing validation for new passwords and authentication plugin error handling remain unchanged. No configuration changes are required.
• Web sign-in requests now validate the supplied credential fields the same way as password changes. Requests that omit the username or password, send either with a type other than a string, or send a null body are rejected with HTTP 400 and the message username and password is required; a null body previously failed with an internal server error (HTTP 500), and the other cases reached the authentication plugin. Empty strings are still passed to the authentication plugin, which rejects them as before. The web UI always sends both fields, so signing in from it is unaffected.
• npm whoami and any other request to /-/whoami now answer 401 Unauthorized when the request carries no credentials or a token Verdaccio does not recognise.
• Until now the endpoint answered 200 with an empty body {} for anonymous requests, so clients that check the status code, rather than the username field, treated an expired or wrong token as a valid login. The npm public registry and Verdaccio 7 answer 401 in that case, and this release aligns 6.x with them. Requests with a valid token are unchanged and still return { "username": "<name>" }. No configuration change is required.
• proxy-addr, used by Express to decide which proxies are trusted when X-Forwarded-For is read, is pinned to 2.0.8 to fix an IP spoofing issue with IPv4-mapped IPv6 trusted subnets (GHSA-jqcg-44mw-7w3h).

[Package Updates]

[1.85.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[1.85.1]

• Update verdaccio to 6.10.7
• Full Changelog
• The Docker image no longer trusts certificates issued through the compromised eMudhra (emSign) intermediate CAs.
• In October 2026, eMudhra disclosed that the private keys of several of its intermediate certificate authorities had been compromised. Anyone holding those keys can issue a TLS certificate that a client trusting the eMudhra chain accepts as valid, for any host. Verdaccio connects to its uplinks (such as registry.npmjs.org) over HTTPS, so an attacker able to intercept that traffic could impersonate an uplink and serve tampered metadata or tarballs, which Verdaccio would then cache.
• The image is now built on node:24.22.1-alpine instead of node:24.15.0-alpine. Node.js 24.22.1 updates its bundled root certificates to NSS 3.131.1, which removes emSign ECC Root CA - G3, and rejects chains that contain the compromised public keys. Node.js uses that bundled store for outgoing HTTPS by default. The image also upgrades Alpine's ca-certificates package at build time. That package matters only if you make Node.js read the system store, for example with NODE_EXTRA_CA_CERTS or --use-system-ca.
• Every earlier verdaccio/verdaccio 6.x image is affected. To get the fix, pull the new image. If you install Verdaccio from npm instead of Docker, upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later.

[Package Updates]

[1.86.0]

• Update verdaccio to 6.11.1
• Full Changelog
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• web.showSearch: false now also disables the web search endpoint.
• Releases are published with npm provenance again.
• Update the bundled @verdaccio/* modules to their latest releases, which forward the new web UI options to the UI and fix a denial-of-service in request body parsing.

[Package Updates]

[1.87.0]

• Update verdaccio to 7.0.1
• Full Changelog
• Restore the @verdaccio/package-filter plugin in the verdaccio 7 package so the filter configuration works again.
• Show the verdaccio package version in the web UI footer instead of the internal module version.
• Verdaccio 7.0.0 is the first stable release of the 7.x line. It is published to npm as latest and to Docker Hub as verdaccio/verdaccio:7, 7.0 and latest; the 6.x line continues under the latest-6 npm dist-tag and the 6 image tag. The release post is at https://verdaccio.org/blog/2026/10/25/verdaccio-7-release, the migration guide at https://verdaccio.org/blog/2026/09/27/verdaccio-6-to-7-migration, and the complete tracker with every pull request and backport at #5680.
• Node.js 24 or newer is required (#5615).
• Express 5 (#5524 middleware plugins must use named wildcards (/*splat, /{*splat}), res.sendFile(filename, { root }) for absolute paths, and req.body is already parsed when plugins run.
• YAML configuration only (#5851); config.self_path was replaced by config.configPath (#5850).
• Bearer tokens for the package API (#6152 _auth entries in .npmrc must move to _authToken; 401 responses advertise only Bearer. The login routes accept Basic credentials while security.api.basicLogin is enabled (the default).
• Removed: the /-/all search endpoint (use /-/v1/search), npm star/unstar (#5930), the deprecated AES encryption helpers (#5744), the searchRemote flag (#5801) and the debug-only PUT /:package/:version/-tag/:tag route.
• Programmatic API (#5808 the default export is the asynchronous runServer, which no longer accepts { listenArg }; await runServer(config) then call .listen(). Import Config, ConfigBuilder, getDefaultConfig and parseConfigFile from @verdaccio/core.
• Updates the runtime dependencies express to 5.3.0 and semver to 7.8.5, and moves body-parser (used by Express to read request bodies) to 2.4.0.