Verdaccio - Package Updates

[Package Updates]

[1.77.0]

• Update verdaccio to 6.5.2
• Full Changelog
• update ui to major (#5794) (b957c6f) @juanpicado
• Big UI refactoring #5563
• package-filter: fix O(n) complexity in cleanupDistFiles (b15f622) #5797 by @plottodev
• ui search returns no output #5798 (3edd3ee) @juanpicado

[Package Updates]

[1.78.0]

• Update verdaccio to 6.6.0
• Full Changelog
• feat: update core dependencies by @juanpicado in #5832
• fix(deps): update core verdaccio dependencies (6.x) by @renovate[bot] in #5865
• fix: migrate to run server internally by @juanpicado in #5868
• fix: tarball might fail #5829 by @juanpicado in #5869
• fix(deps): update dependency semver to v7.8.0 (6.x) by @renovate[bot] in #5867

[Package Updates]

[1.78.1]

• Update verdaccio to 6.6.2
• Full Changelog

[Package Updates]

[1.79.0]

• Update verdaccio to 6.7.1
• Full Changelog
• feat: update Node.js to 24
• Bumps the project's Node.js baseline to 24 across runtime and container, and adds a startup warning for users still on an older (but supported) Node.
• Node 24 bump: .nvmrc 22 24; Dockerfile base image node:22.22.1-alpine node:24.15.0-alpine (builder + runtime).
• Soft-deprecation warning: new RECOMMENDED_NODE_VERSION = '22' and isVersionRecommended() in src/lib/cli/utils.ts; the init command logs a warn at startup when Node is below the recommendation. MIN_NODE_VERSION stays at '18' no hard break.
• Tests: unit tests for isVersionRecommended and the init warning path.
• Compatibility: minimum supported Node remains 18 (warning only); recommended is 22+; Docker images ship Node 24.

[Package Updates]

[1.79.1]

• Update verdaccio to 6.7.2
• Full Changelog
• a28cf71: chore: add missing types #5889 by @mbtools

[Package Updates]

[1.79.2]

• Update verdaccio to 6.7.4
• Full Changelog
• fix: run jwt middleware before middleware plugins
• fix: enforce generated npm token metadata
• fix: allow npm token create without readonly/cidr_whitelist
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.79.3]

• Update verdaccio-openid to 0.17.2
• Full Changelog
• fix: add getFullUrl function to handle url_prefix correctly and updat by @kuoruan in #21

[Package Updates]

[1.80.0]

• Update verdaccio to 6.8.0
• Full Changelog
• feat: add unpublish notification hooks
• fix: return 403 to client when uplink responds with 403 for tarball requests
• fix: rate limit and bound the npm search v1 endpoint
• fix: pick the right uplink for tarballs and heal missing distfile records
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.81.0]

• Update verdaccio-openid to 0.18.0
• Full Changelog
• Peer dependencies ioredis and node-persist are no longer automatically installed. If you use store-type: redis or store-type: file, you must install the corresponding package(s) alongside the plugin:
• DynamoDB store backend new dynamodb store type for cloud-native multi-replica deployments. OIDC state, user info, groups, and WebAuthn tokens are persisted in a shared DynamoDB table. Configurable via store-type: dynamodb with tableName, region, and optional partitionKey. (#20) Thanks to @ederelias for contributing this feature!
• CLI port fallback CLI now tries port 8239 first, then falls back to 18239 if busy, instead of failing immediately. (#22)
• OIDC state round-trip CLI auth flow improved with server-side OIDC state tracking for better reliability. (#22)
• DynamoDB errors raw AWS SDK errors are now caught, classified (transient vs permanent), and wrapped before reaching the plugin layer.
• Store creation error handling added for store initialization failures.
• Status page HTML escaping removed from buildSuccessPage output.
• Code format minor formatting fix.

[Package Updates]

[1.82.0]

• Update verdaccio to 6.9.0
• Full Changelog
• feat: require Node.js 22 as the minimum supported version
• feat: dual CJS + ESM build with exports field, migrate build from babel to vite 8
• fix(deps): update @verdaccio/hooks to 8.1.1
• fix(deps): update @verdaccio/* packages to the 2026-07-25 release batch
• fix: migrate uplink/storage URL parsing to the WHATWG URL API

[Package Updates]

[1.82.1]

• Update verdaccio to 6.9.2
• Full Changelog
• fix: apply package access controls to the starredByUser endpoint
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.82.2]

• Update verdaccio to 6.9.3
• Full Changelog
• 3c8f391: Reject wildcard characters in package and tarball path validation.
• ebc08ba: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.83.0]

• Update verdaccio to 6.10.0
• Full Changelog
• Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.
• This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.
• The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.
• See #6147 and the original 8.x backport in #6143.

[Package Updates]

[1.83.1]

• Update verdaccio to 6.10.1
• Full Changelog
• Import shared helpers from @verdaccio/core and drop the deprecated @verdaccio/utils dependency
• Limit web UI search responses to 20 packages.
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.83.2]

• Update verdaccio to 6.10.2
• Full Changelog
• fix: resolve fast-uri and brace-expansion security advisories
• fix: stop re-compressing tarballs for gzip-accepting clients
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• fix: validate the scope segment on the web package endpoints

[Package Updates]

[1.83.3]

• Update verdaccio to 6.10.3
• Full Changelog
• fix: do not fetch client-controlled dist.tarball urls off-uplink

[Package Updates]

[1.84.0]

• Update verdaccio-openid to 0.19.0

[Package Updates]

[1.84.1]

• Update verdaccio to 6.10.4
• Full Changelog
• 7730e60: Update express to 4.22.3 directly and through @verdaccio/middleware 8.1.4,
• verdaccio-audit 13.1.4 and @verdaccio/test-helper 4.1.4 so the registry's entire HTTP
• stack resolves qs 6.16.0, which fixes several denial-of-service advisories in query-string
• handling: a remotely triggerable crash in qs.stringify (TypeError on crafted input), an
• arrayLimit bypass through bracket-key comma parsing that allows memory exhaustion, and a
• DoS via an attacker-controlled isBuffer check (GHSA-4mjr-xmp4-gh2g). A body-parser/qs
• resolution covers the one remaining consumer that pins qs below the fix. Query-string
• parsing behaviour is otherwise unchanged and no configuration change is needed.
• aabb0b4: Fix npm publish failing with request size did not match content length when authenticating with a token created by npm token create.
• e2602b3: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9

[Package Updates]

[1.84.2]

• Update verdaccio to 6.10.5
• Full Changelog
• 2ccbacf: Migrate the 6.x release workflow to Changesets action v2 and CLI v3.
• c159460: Improve validation of Search v1 query parameters.
• ec341ee: Validate Search v1 query text before starting a search.
• 35e8373: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• 3d1ca06: Improve version validation in GET /<package>/<version>.

[Package Updates]

[1.84.3]

• Update verdaccio to 6.10.6
• Full Changelog
• Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.
• Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9
• @verdaccio/ui-theme: 9.0.0-next-9.34 9.0.0-next-9.36
• Improve request validation when changing passwords and signing in through the web API.
• Password changes validate the supplied credential fields before invoking the authentication plugin. Existing passwords remain eligible for replacement even when they do not meet the current policy. The existing validation for new passwords and authentication plugin error handling remain unchanged. No configuration changes are required.
• Web sign-in requests now validate the supplied credential fields the same way as password changes. Requests that omit the username or password, send either with a type other than a string, or send a null body are rejected with HTTP 400 and the message username and password is required; a null body previously failed with an internal server error (HTTP 500), and the other cases reached the authentication plugin. Empty strings are still passed to the authentication plugin, which rejects them as before. The web UI always sends both fields, so signing in from it is unaffected.
• npm whoami and any other request to /-/whoami now answer 401 Unauthorized when the request carries no credentials or a token Verdaccio does not recognise.
• Until now the endpoint answered 200 with an empty body {} for anonymous requests, so clients that check the status code, rather than the username field, treated an expired or wrong token as a valid login. The npm public registry and Verdaccio 7 answer 401 in that case, and this release aligns 6.x with them. Requests with a valid token are unchanged and still return { "username": "<name>" }. No configuration change is required.
• proxy-addr, used by Express to decide which proxies are trusted when X-Forwarded-For is read, is pinned to 2.0.8 to fix an IP spoofing issue with IPv4-mapped IPv6 trusted subnets (GHSA-jqcg-44mw-7w3h).