verdaccio/verdaccio v7.0.0

on GitHub

Major Changes

• d33944c: Verdaccio 7.0.0 is the first stable release of the 7.x line. It is published to npm as latest and to Docker Hub as verdaccio/verdaccio:7, 7.0 and latest; the 6.x line continues under the latest-6 npm dist-tag and the 6 image tag. The release post is at https://verdaccio.org/blog/2026/10/25/verdaccio-7-release, the migration guide at https://verdaccio.org/blog/2026/09/27/verdaccio-6-to-7-migration, and the complete tracker with every pull request and backport at #5680.

  Highlights

  • Staged publishing (experimental, flags.stage, npm 11.17 or newer): a pipeline uploads a version, a maintainer reviews it, and only then it becomes installable (#6176). GET /-/package/{name}/version/{version}/status reports whether a version is published or staged (#6365).
  • Two-factor authentication (experimental, flags.tfa): time-based one-time passwords for login, account operations and publishing (#6176).
  • Ownership and unpublish checks on every change: publish.check_owners now covers npm deprecate, version unpublish and dist-tag changes (#6219); removing a version requires the unpublish permission on its own route (#6384); publish rejects invalid tarball attachment names before saving metadata and records an upload only after the tarball is fully written (#6367).
  • Pure ESM plugins through async plugin loading, and a promise-based storage plugin API with a compatibility adapter for callback-based storage plugins (#5933).
  • Web UI: dark mode, refreshed login, signup and password screens and SWR-based state (#5563); packages sorted by update time (#5659); web.assetFolder (#5653); home toolbar to filter, scope and sort, onboarding guide for empty registries, web.footer, web.poweredBy and web.help, package tabs in the URL and bun among the package managers (#6400); per-language translation progress with a single translation source (#6395); password changes from the account menu (#6366).
  • Package filter plugins with allow and block rules (#5548), glob patterns (#5872) and excludeDeprecated (#6028); notification hooks for publish and unpublish (#5920).
  • Configuration: ConfigBuilder covers web, listen, https, publish, flags, notify, middlewares, filters, maxBodySize, userRateLimit, urlPrefix and i18n (#5805); new server.cors (#6255), server.dotfiles, server.hideStaticLogs, server.hidePingLogs (#6192) and server.legacyAuthCache (#6133).
  • Authentication: htpasswd verify_cache_ms caches successful password verifications for clients that send credentials on every request (#6351); npm login, yarn npm login and pnpm login keep working through the Basic exception on the login routes (#6354).
  • Uplinks and search: @verdaccio/proxy on got (#5646, #5746) with upstream errors mapped to registry errors (#6022); /-/v1/search with rate limits, bounded pagination and batched access checks, uplink results paginated before the client offset (#6235), configured uplink subpaths and headers preserved (#6209), ISO timestamps, version validation and original uplink errors preserved (#6263, #6264, #6265).
  • Distribution: the server composition and CLI helpers are exported for downstream distributions (#5932, #6286), and the new experimental @verdaccio/admin-cli ships a verdaccio-admin storage command group (#6231).

  Bug fixes

  • Tarball downloads: uplink selection by URL, cleanup of failed downloads, no client hangs and a correct content-length (#6194, #6234); client-controlled dist.tarball URLs are not fetched off-uplink (#6225); the uplink cache is refreshed on 304 (#6276).
  • Package access, publish and unpublish rules match case-insensitively (#6091); package and token name validation aligned with npm (#6309, #6314); search validation (#6306, #6317); missing versions, dist-tags and packages return not found (#6332); 401 for invalid credentials on GET /-/user/ (#5844); local storage no longer uses uncontrolled data in paths (#5847); the home directory resolves through HOME on Windows (#6247); missing Host header handled (#5641).
  • Web: scope validation on the web package endpoints (#6202), search component fixes (#5647), signup, error states, i18n and routing (#6210, #6213), password change validation (#6326), English fallback for untranslated strings (#6406), JSON viewer (#5651).
  • Logger: JSON sync output honoured, unused pretty destinations removed and file destination errors handled (#6242, #6260).

  Breaking changes

  • Node.js 24 or newer is required (#5615).
  • Express 5 (#5524): middleware plugins must use named wildcards (/*splat, /{*splat}), res.sendFile(filename, { root }) for absolute paths, and req.body is already parsed when plugins run.
  • YAML configuration only (#5851); config.self_path was replaced by config.configPath (#5850).
  • Bearer tokens for the package API (#6152): _auth entries in .npmrc must move to _authToken; 401 responses advertise only Bearer. The login routes accept Basic credentials while security.api.basicLogin is enabled (the default).
  • Removed: the /-/all search endpoint (use /-/v1/search), npm star/unstar (#5930), the deprecated AES encryption helpers (#5744), the searchRemote flag (#5801) and the debug-only PUT /:package/:version/-tag/:tag route.
  • Programmatic API (#5808): the default export is the asynchronous runServer, which no longer accepts { listenArg }; await runServer(config) then call .listen(). Import Config, ConfigBuilder, getDefaultConfig and parseConfigFile from @verdaccio/core.
  • Logger: @verdaccio/logger-commons and @verdaccio/logger-prettify are merged into @verdaccio/logger (#5657).
  • Build: dual ESM/CJS output built with Vite (#5643); package exports changed, so update deep imports.
  • Relocated plugins: verdaccio-aws-s3-storage, verdaccio-google-cloud and verdaccio-active-directory moved to their own repositories.
  • A server secret shorter than 32 characters stops the server, and .sinopia-db.json databases are no longer read.

  Also in 6.x

  Dual ESM/CJS output, the package filter plugin, publish and unpublish notifications, the bounded /-/v1/search, the @verdaccio/e2e-cli workflow, the shared @verdaccio/ui-theme Web UI, the htpasswd, name and search validation fixes and the new Web UI home were also backported to 6.x; the tracker lists the 6.x release that carries each one.

  Tooling and dependencies

  pnpm 12 replaces Yarn for the workspace and CI (#5748, #6216); CI runs on Windows (#6248); end-to-end tests run through @verdaccio/e2e-cli (#5678); the repository carries AGENTS.md and agent skills (#6252). Runtime dependencies move to Express 5.3, got 15, js-yaml 5, TypeScript 7 and Vite 8, with the published advisories in body-parser, proxy-addr, compression, lodash-es, dompurify and fast-uri patched (#6334, #6388).

  Upgrading

  Back up the configuration, storage and .verdaccio-db.json, update the runtime to Node.js 24, convert any JSON or JS configuration to YAML and test with a copy of the storage before switching. Do not run 6.x and 7.x against the same storage at the same time.

  Thanks to @juanpicado, @mbtools, @dianmorales, @jotadeveloper, @davidus27, @koliveira15, @moglerdev, @pranshuchittora, @ReemX, @RuneStone0, @tmota900 and @vsugrob for the work in this release line.

Minor Changes

• ddf993c: Adopt @verdaccio/server and drop the local api/web/storage forks. A thin Storage wrapper is kept to support legacy callback-based storage plugins, and the unused helpers in src/lib/utils.ts were removed.

Patch Changes

• e404c82: Updates the runtime dependencies express to 5.3.0 and semver to 7.8.5, and moves body-parser (used by Express to read request bodies) to 2.4.0.

  body-parser 2.4.0 fixes a denial of service where trailing bytes after a compressed request body could keep the server busy (GHSA-27r3-jxmh-p828). Transitive dependencies with published advisories (fast-uri, qs, ip-address) are also moved to their patched releases. None of these change any API: no configuration or plugin changes are needed.

  The rest of the changes in this release only affect the development toolchain and the test suite (@cypress/request is no longer used by the tests).

• a307098: Migrate the 7.x release workflow to Changesets action v2 and CLI v3.

• 256fd40: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

  The Docker base image uses Node.js 24.15.0 for compatibility with the updated npm.

• f565393: Update the proxy address dependency to correctly match trusted proxy subnets when determining client IP addresses. Earlier 7.x prereleases using the affected dependency can misidentify clients with certain IPv6 trust configurations. No configuration migration is required.

  Update @verdaccio/e2e-cli to 4.0.0, which drops pnpm 10, and remove pnpm 10 from the CLI e2e matrix.

• 6fd3e8a: Make /-/v1/search work for storage plugins that still use the callback API.

  Verdaccio 7 keeps callback-based storage plugins running through a compatibility
  adapter. Its search collected whatever the plugin streamed and handed the list
  straight back, with two consequences for every such plugin.

  The search query was dropped before it reached the plugin, and the adapter passed a
  name predicate that always returned true, so the plugin emitted its whole catalogue and
  nothing ever filtered it. /-/v1/search answered with every package in the registry
  regardless of the text searched for, and paginated over that full list. It failed
  silently: the endpoint returned 200 and the npm client still found what it asked for,
  buried among everything else.

  The adapter also passed the items through unchanged. The legacy contract emits the
  package itself, while the store reads item.package.name, so a plugin following the
  documented contract made the endpoint fail with a 500 instead.

  The adapter now filters the collected results by the query text and wraps anything that
  is not already in the store's shape. The filtering is done on the emitted name, never on
  the name predicate a plugin is given: that one receives the basename, so rejecting there
  would drop scoped packages whose full name does match. Operators running a callback-based
  storage plugin get working search without touching the plugin; plugins already on the
  promise-based API were never wrapped and are unaffected.

• f1f5d34: chore: trigger release

• a768d16: chore: replace eslint and prettier with oxlint and oxfmt

• 594f438: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 88bd996: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 908ccbb: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• e862a9a: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 1aef95b: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 304f155: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• c461320: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• a4ced54: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.