chore(devdeps): update dependency verdaccio to v6.8.0 - #736
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
|
|
View your CI Pipeline Execution ↗ for commit 40a649a
💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗. ☁️ Nx Cloud last updated this comment at |
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (23.26%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #736 +/- ##
==========================================
+ Coverage 18.07% 23.26% +5.18%
==========================================
Files 155 161 +6
Lines 24398 25661 +1263
Branches 1203 1626 +423
==========================================
+ Hits 4410 5970 +1560
+ Misses 19988 19691 -297 🚀 New features to boost your workflow:
|
@forgerock/davinci-client
@forgerock/device-client
@forgerock/journey-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
|
Deployed 0381e05 to https://ForgeRock.github.io/ping-javascript-sdk/pr-736/0381e05ff778224f95fa420e0d42eb76d452e492 branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis🆕 New Packages🆕 @forgerock/journey-client - 92.6 KB (new) ➖ No Changes➖ @forgerock/davinci-client - 55.2 KB 14 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
40a649a to
6e48ffe
Compare
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nx Cloud has identified a flaky task in your failed CI:
🔂 Since the failure was identified as flaky, we triggered a CI rerun by adding an empty commit to this branch.
🔔 Heads up, your workspace has pending recommendations ↗ to auto-apply fixes for similar failures.
🎓 Learn more about Self-Healing CI on nx.dev
1 participant
This PR contains the following updates:
6.5.2→6.8.0Release Notes
verdaccio/verdaccio (verdaccio)
v6.8.0Compare Source
Minor Changes
962fba8: feat: add unpublish notification hooksPort of #5920 (ref #5328). The
notifywebhook now also fires when a package is unpublished entirely and when a single version (tarball) is removed, not only on publish. Notification templates can distinguish the event through the new{{ publishType }}(publish|unpublish) and{{ publishedPackage }}variables, and the{{ publisher }}object exposes onlyname,groupsandreal_groups, so the remote user auth token can never leak to the notification endpoint (via@verdaccio/hooks8.0.4).Patch Changes
f0684dc: fix: return 403 to client when uplink responds with 403 for tarball requestsPreviously, any non-200/404 response from an uplink (e.g. a security proxy blocking a package download) would result in a generic 500 error being returned to the client. This change propagates 403 responses from the uplink through to the client, including any error detail from the response body, so callers can distinguish authorization failures from other upstream errors.
3a84578: chore: refactor eslintb7a5db1: fix: rate limit and bound the npm search v1 endpointThe
/-/v1/searchendpoint now applies theuserRateLimitrate limiting middleware (matching the login, token and profile endpoints), clamps thesize(max 250, like the public npm registry) andfrom(max 10000) pagination parameters, and stops evaluating package access as soon as the requested page is filled instead of running an auth check over the entire result set. The clamped values are also what gets forwarded to uplink registries (the raw request URL is no longer passed through), so the bounds hold end-to-end. This prevents cheap anonymous requests from triggering unbounded full-catalog scans. As part of this, pagination is fixed: results were sliced withslice(from, size)instead ofslice(from, from + size), so pages beyond the first were wrong.Search results for local packages also emit npm-search-compatible maintainers (
{ username, email }) — npm 11 on Node 24 crashes rendering entries withoutusername(The "str" argument must be of type string. Received undefined) — and thepublisherfield is now populated from_npmUserwhen the publishing client provided it, falling back to the first maintainer, so the npm CLI shows the publishing user instead ofby ???.808d916: fix: pick the right uplink for tarballs and heal missing distfile recordsUplink selection. With several uplinks configured for a package, tarball downloads used the last uplink whose package pattern matched, even when the tarball url belongs to a different one, which could make downloads fail against registries that require authentication. The uplink is now selected by matching the tarball url: the
registryrecorded on the distfile wins, then the uplink whose url serves the file; when none matches, an autogenerated uplink with default settings is used. Single-uplink setups keep the previous behavior for tarballs hosted on another host (a CDN).Missing distfile records. Storages written by other verdaccio versions can carry cached versions without their
_distfilesrecords, which made those tarballs permanently return404 no such file available. The tarball location is now resolved from the version'sdist.tarballmetadata when the record is missing, and the record is restored when the tarball is cached.a2de1d5: Update verdaccio dependencies to thelatestnpm dist-tag (@verdaccio/ui-themetracksnext-9):@verdaccio/ui-theme:9.0.0-next-9.20→9.0.0-next-9.21v6.7.4Compare Source
Patch Changes
0205c78: fix: run jwt middleware before middleware pluginsRegister the JWT middleware before middleware plugins are loaded so that
req.remote_user(anonymous by default) is available inside a plugin'sregister_middlewares. The API router keeps its own JWT middleware behind aguard so it is not executed twice.
Backport of #5697
Closes #5167
v6.7.3Compare Source
Patch Changes
f8fdfc2: fix: enforce generated npm token metadataGenerated npm tokens (
POST /-/npm/v1/tokens) stored theirreadonlyandcidr_whitelistrestrictions but never enforced them, and deleting a token didnot revoke it for the package APIs. A token marked read-only or pinned to a CIDR
range could still publish packages and change dist-tags, and a deleted token
remained usable.
Generated tokens now embed a server-issued key (in the JWT claim, or in the
encrypted legacy AES payload) and a new
enforceGeneratedTokenMetadatamiddleware looks that key up on each request, rejecting the token when it is
missing/revoked, used outside its CIDR whitelist, or used for a write while
read-only. Enforcement applies to both AES and JWT API-token modes.
Note: tokens issued before upgrading carry no key and are not retroactively
constrained — regenerate them to apply the restrictions.
be80623: fix: allow npm token create without readonly/cidr_whitelistnpm token createin npm >= 11 (and the npm 12 prereleases) rewrote therequest body: it no longer sends
readonlyand only sendscidr_whitelistwhen
--cidris passed. ThePOST /-/npm/v1/tokensendpoint required both,so modern npm clients failed with
422 the parameters are not valid.The endpoint now defaults
readonlytofalseandcidr_whitelistto[]when they are absent, while still rejecting values of the wrong type.
75c85d5: Update verdaccio dependencies to thelatestnpm dist-tag (@verdaccio/ui-themetracksnext-9):@verdaccio/ui-theme:9.0.0-next-9.19→9.0.0-next-9.20d5e5332: chore: update dependenciesUpdates runtime dependencies
@verdaccio/ui-theme(9.0.0-next-9.19) andsemver(7.8.2), along with development dependencies: Babel7.29.7,@changesets/cli2.31.0, ESLint10.4.1, Vitest4.1.8, Cypress15.16.0,Prettier
3.8.3,@verdaccio/test-helper4.0.4,@verdaccio/eslint-config13.1.2, and assorted type definitions.v6.7.2Compare Source
Patch Changes
a89aca1: chore: fix unit testa28cf71: chore: add missing types #5889 by @mbtoolsv6.7.1Compare Source
Patch Changes
a75f9bb: chore: refactor docker publish pipelinev6.7.0Compare Source
Minor Changes
9f1bcc5: feat: update Node.js to 24Bumps the project's Node.js baseline to 24 across runtime and container, and adds a startup warning for users still on an older (but supported) Node.
.nvmrc22→24;Dockerfilebase imagenode:22.22.1-alpine→node:24.15.0-alpine(builder + runtime).RECOMMENDED_NODE_VERSION = '22'andisVersionRecommended()insrc/lib/cli/utils.ts; theinitcommand logs awarnat startup when Node is below the recommendation.MIN_NODE_VERSIONstays at'18'— no hard break.isVersionRecommendedand the init warning path.Compatibility: minimum supported Node remains 18 (warning only); recommended is 22+; Docker images ship Node 24.
v6.6.2Compare Source
6.6.2
Patch Changes
7f7bbde: chore: bump up package test (testing publish provenance)v6.6.0Compare Source
What's Changed
Full Changelog: verdaccio/verdaccio@v6.5.2...v6.6.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.