chore: update versions (6-next) (#3249)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.babelrc

@@ -0,0 +1,14 @@
+{
+  "presets": [
+    [
+      "@babel/env",
+      {
+        "targets": {
+          "node": 16
+        }
+      }
+    ],
+    "@babel/typescript"
+  ],
+  "ignore": ["**/*.d.ts"]
+}

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/master/docs/common-questions.md)

.changeset/afraid-mice-obey.md

@@ -0,0 +1,15 @@
+---
+'@verdaccio/types': minor
+'@verdaccio/ui-theme': minor
+'@verdaccio/web': minor
+---
+
+allow disable login on ui and endpoints
+
+To be able disable the login, set `login: false`, anything else would enable login. This flag will disable access via UI and web endpoints.
+
+```yml
+web:
+  title: verdaccio
+  login: false
+```

.changeset/big-lobsters-sin.md

@@ -0,0 +1,23 @@
+---
+'@verdaccio/local-storage': major
+'@verdaccio/url': major
+'verdaccio-aws-s3-storage': major
+'verdaccio-google-cloud': major
+'verdaccio-memory': major
+'@verdaccio/store': major
+---
+
+# async storage plugin bootstrap
+
+Gives a storage plugin the ability to perform asynchronous tasks on initialization
+
+## Breaking change
+
+Plugin must have an init method in which asynchronous tasks can be executed
+
+```js
+public async init(): Promise<void> {
+   this.data = await this._fetchLocalPackages();
+   this._sync();
+}
+```

.changeset/bright-poems-obey.md

@@ -0,0 +1,37 @@
+---
+'@verdaccio/api': major
+'@verdaccio/fastify-migration': major
+'@verdaccio/tarball': major
+'@verdaccio/local-storage': major
+'verdaccio-memory': major
+'@verdaccio/server': major
+'@verdaccio/store': major
+'@verdaccio/utils': major
+---
+
+refactor: download manifest endpoint and integrate fastify
+
+Much simpler API for fetching a package
+
+```
+ const manifest = await storage.getPackageNext({
+      name,
+      uplinksLook: true,
+      req,
+      version: queryVersion,
+      requestOptions,
+ });
+```
+
+> not perfect, the `req` still is being passed to the proxy (this has to be refactored at proxy package) and then removed from here, in proxy we pass the request instance to the `request` library.
+
+### Details
+
+- `async/await` sugar for getPackage()
+- Improve and reuse code between current implementation and new fastify endpoint (add scaffolding for request manifest)
+- Improve performance
+- Add new tests
+
+### Breaking changes
+
+All storage plugins will stop to work since the storage uses `getPackageNext` method which is Promise based, I won't replace this now because will force me to update all plugins, I'll follow up in another PR. Currently will throw http 500

.changeset/brown-cycles-laugh.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/cli': patch
+---
+
+chore: improve error logger message

.changeset/brown-pandas-wink.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+add banner support ukraine

.changeset/calm-pants-impress.md

@@ -0,0 +1,5 @@
+---
+'verdaccio-aws-s3-storage': patch
+---
+
+Fix the prefix used to delete from s3 when unpublishing packages

.changeset/chilled-ways-fetch.md

@@ -0,0 +1,5 @@
+---
+'verdaccio-memory': patch
+---
+
+Fix storing tarballs with identical names from different packages in memory plugin

.changeset/config.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "linked": [],
+  "access": "public",
+  "baseBranch": "master",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/dry-planes-tap.md

@@ -0,0 +1,59 @@
+---
+'@verdaccio/api': major
+'@verdaccio/auth': major
+'@verdaccio/cli': major
+'@verdaccio/config': major
+'@verdaccio/commons-api': major
+'@verdaccio/core': major
+'@verdaccio/local-storage': major
+'@verdaccio/fastify-migration': major
+'@verdaccio/streams': major
+'@verdaccio/types': major
+'@verdaccio/hooks': major
+'verdaccio-audit': major
+'verdaccio-aws-s3-storage': major
+'verdaccio-google-cloud': major
+'verdaccio-memory': major
+'@verdaccio/ui-theme': major
+'@verdaccio/proxy': major
+'@verdaccio/server': major
+'@verdaccio/store': major
+'@verdaccio/eslint-config': major
+'@verdaccio/dev-types': major
+'@verdaccio/utils': major
+'verdaccio': major
+'@verdaccio/web': major
+---
+
+refactor: search v1 endpoint and local-database
+
+- refactor search `api v1` endpoint, improve performance
+- remove usage of `async` dependency https://github.com/verdaccio/verdaccio/issues/1225
+- refactor method storage class
+- create new module `core` to reduce the ammount of modules with utilities
+- use `undici` instead `node-fetch`
+- use `fastify` instead `express` for functional test
+
+### Breaking changes
+
+- plugin storage API changes
+- remove old search endpoint (return 404)
+- filter local private packages at plugin level
+
+The storage api changes for methods `get`, `add`, `remove` as promise base. The `search` methods also changes and recieves a `query` object that contains all query params from the client.
+
+```ts
+export interface IPluginStorage<T> extends IPlugin {
+  add(name: string): Promise<void>;
+  remove(name: string): Promise<void>;
+  get(): Promise<any>;
+  init(): Promise<void>;
+  getSecret(): Promise<string>;
+  setSecret(secret: string): Promise<any>;
+  getPackageStorage(packageInfo: string): IPackageStorage;
+  search(query: searchUtils.SearchQuery): Promise<searchUtils.SearchItem[]>;
+  saveToken(token: Token): Promise<any>;
+  deleteToken(user: string, tokenKey: string): Promise<any>;
+  readTokens(filter: TokenFilter): Promise<Token[]>;
+}
+```

.changeset/dull-monkeys-search.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+show verdaccio logo in the footer even when custom brand is set

.changeset/eleven-brooms-hunt.md

@@ -0,0 +1,11 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/core': minor
+'@verdaccio/tarball': minor
+'@verdaccio/middleware': minor
+'verdaccio-audit': minor
+'@verdaccio/utils': minor
+'@verdaccio/web': minor
+---
+
+refactor: improve docker image build with strict dependencies and prod build

.changeset/eleven-spoons-matter.md

@@ -0,0 +1,39 @@
+---
+'@verdaccio/api': major
+'@verdaccio/auth': major
+'@verdaccio/cli': major
+'@verdaccio/config': major
+'@verdaccio/core': major
+'@verdaccio/file-locking': major
+'verdaccio-htpasswd': major
+'@verdaccio/readme': major
+'@verdaccio/fastify-migration': major
+'@verdaccio/streams': major
+'@verdaccio/tarball': major
+'@verdaccio/types': major
+'@verdaccio/url': major
+'@verdaccio/hooks': major
+'@verdaccio/loaders': major
+'@verdaccio/logger': major
+'@verdaccio/middleware': major
+'@verdaccio/mock': major
+'@verdaccio/node-api': major
+'@verdaccio/active-directory': major
+'verdaccio-audit': major
+'verdaccio-auth-memory': major
+'verdaccio-aws-s3-storage': major
+'verdaccio-google-cloud': major
+'verdaccio-memory': major
+'@verdaccio/ui-theme': major
+'@verdaccio/server': major
+'@verdaccio/cli-standalone': major
+'@verdaccio/store': major
+'@verdaccio/dev-types': major
+'@verdaccio/utils': major
+'verdaccio': major
+'@verdaccio/web': major
+---
+
+Remove Node 12 support
+
+- We need move to the new `undici` and does not support Node.js 12

.changeset/fair-lemons-beam.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/logger-prettify': minor
+'@verdaccio/logger': patch
+---
+
+hydrate template placeholders in log messages when format is set to 'json'

.changeset/few-cooks-destroy.md

@@ -0,0 +1,46 @@
+---
+'@verdaccio/api': major
+'@verdaccio/auth': major
+'@verdaccio/cli': major
+'@verdaccio/config': major
+'@verdaccio/commons-api': major
+'@verdaccio/file-locking': major
+'verdaccio-htpasswd': major
+'@verdaccio/local-storage': major
+'@verdaccio/readme': major
+'@verdaccio/streams': major
+'@verdaccio/types': major
+'@verdaccio/hooks': major
+'@verdaccio/loaders': major
+'@verdaccio/logger': major
+'@verdaccio/logger-prettify': major
+'@verdaccio/middleware': major
+'@verdaccio/mock': major
+'@verdaccio/node-api': major
+'@verdaccio/active-directory': major
+'verdaccio-audit': major
+'verdaccio-auth-memory': major
+'verdaccio-aws-s3-storage': major
+'verdaccio-google-cloud': major
+'verdaccio-memory': major
+'@verdaccio/proxy': major
+'@verdaccio/server': major
+'@verdaccio/store': major
+'@verdaccio/dev-types': major
+'@verdaccio/utils': major
+'verdaccio': major
+'@verdaccio/web': major
+'@verdaccio/website': major
+---
+
+feat!: experiments config renamed to flags
+
+- The `experiments` configuration is renamed to `flags`. The functionality is exactly the same.
+
+```js
+flags: token: false;
+search: false;
+```
+
+- The `self_path` property from the config file is being removed in favor of `config_file` full path.
+- Refactor `config` module, better types and utilities

.changeset/few-mangos-grow.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': minor
+---
+
+upgrade to react@17 and other dependencies

.changeset/fifty-jars-rest.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/middleware': patch
+'@verdaccio/web': patch
+---
+
+Remove @ts-ignore and any in packages/web/src/endpoint/package.ts

.changeset/fuzzy-drinks-taste.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': minor
+---
+
+fix: remove engines from ui-theme

.changeset/fuzzy-onions-draw.md

@@ -0,0 +1,10 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/fastify-migration': minor
+'@verdaccio/hooks': minor
+'@verdaccio/logger-prettify': minor
+'@verdaccio/proxy': minor
+'@verdaccio/store': minor
+---
+
+abort search request support for proxy

.changeset/gentle-parrots-lay.md

@@ -0,0 +1,11 @@
+---
+'@verdaccio/config': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/e2e-ui': minor
+---
+
+Some verdaccio modules depend on 'mkdirp' library which provides recursive directory creation functionality.
+NodeJS can do this out of the box since v.10.12. The last commit in 'mkdirp' was made in early 2016, and it's mid 2021 now.
+Time to stick with a built-in library solution!
+
+- All 'mkdirp' calls are replaced with appropriate 'fs' calls.

.changeset/gentle-trains-switch.md

@@ -0,0 +1,44 @@
+---
+'@verdaccio/api': major
+'@verdaccio/auth': major
+'@verdaccio/cli': major
+'@verdaccio/config': major
+'@verdaccio/commons-api': major
+'@verdaccio/file-locking': major
+'verdaccio-htpasswd': major
+'@verdaccio/local-storage': major
+'@verdaccio/readme': major
+'@verdaccio/streams': major
+'@verdaccio/types': major
+'@verdaccio/hooks': major
+'@verdaccio/loaders': major
+'@verdaccio/logger': major
+'@verdaccio/logger-prettify': major
+'@verdaccio/middleware': major
+'@verdaccio/mock': major
+'@verdaccio/node-api': major
+'@verdaccio/proxy': major
+'@verdaccio/server': major
+'@verdaccio/store': major
+'@verdaccio/dev-types': major
+'@verdaccio/utils': major
+'verdaccio': major
+'@verdaccio/web': major
+---
+
+- Replace signature handler for legacy tokens by removing deprecated crypto.createDecipher by createCipheriv
+- Introduce environment variables for legacy tokens
+
+### Code Improvements
+
+- Add debug library for improve developer experience
+
+### Breaking change
+
+- The new signature invalidates all previous tokens generated by Verdaccio 4 or previous versions.
+- The secret key must have 32 characters long.
+
+### New environment variables
+
+- `VERDACCIO_LEGACY_ALGORITHM`: Allows to define the specific algorithm for the token signature which by default is `aes-256-ctr`
+- `VERDACCIO_LEGACY_ENCRYPTION_KEY`: By default, the token stores in the database, but using this variable allows to get it from memory

.changeset/gold-vans-tease.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/utils': patch
+---
+
+Fixed the validation of the name when searching for a tarball that have scoped package name

.changeset/healthy-bikes-behave.md

@@ -0,0 +1,21 @@
+---
+'@verdaccio/cli': patch
+'@verdaccio/types': patch
+'@verdaccio/node-api': patch
+'@verdaccio/server': patch
+---
+
+fix: restore logger on init
+
+Enable logger after parse configuration and log the very first step on startup phase.
+
+```bash
+ warn --- experiments are enabled, it is recommended do not use experiments in production comment out this section to disable it
+ info --- support for experiment [token]  is disabled
+ info --- support for experiment [search]  is disabled
+(node:50831) Warning: config.logs is deprecated, rename configuration to "config.log"
+(Use `node --trace-warnings ...` to show where the warning was created)
+ info --- http address http://localhost:4873/
+ info --- version: 6.0.0-6-next.11
+ info --- server started
+```

.changeset/healthy-pants-smash.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/ui-theme': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/web': patch
+---
+
+fix: #3174 set correctly ui values to html render

.changeset/healthy-poets-compare.md

@@ -0,0 +1,11 @@
+---
+'@verdaccio/config': patch
+---
+
+Feature
+
+- add option to set storage from environment variable VERDACCIO_STORAGE_PATH
+
+#### Related tickets
+
+https://github.com/verdaccio/verdaccio/issues/1681

.changeset/heavy-ravens-lay.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/cli': minor
+'@verdaccio/fastify-migration': minor
+---
+
+[Fastify] Add ping endpoint

.changeset/hip-hounds-destroy.md

@@ -0,0 +1,39 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/ui-theme': patch
+'@verdaccio/server': patch
+'@verdaccio/api': patch
+'@verdaccio/auth': patch
+'@verdaccio/cli': patch
+'@verdaccio/config': patch
+'@verdaccio/commons-api': patch
+'@verdaccio/file-locking': patch
+'verdaccio-htpasswd': patch
+'@verdaccio/readme': patch
+'@verdaccio/streams': patch
+'@verdaccio/types': patch
+'@verdaccio/hooks': patch
+'@verdaccio/loaders': patch
+'@verdaccio/logger': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/middleware': patch
+'@verdaccio/mock': patch
+'@verdaccio/node-api': patch
+'@verdaccio/active-directory': patch
+'verdaccio-audit': patch
+'verdaccio-auth-memory': patch
+'verdaccio-aws-s3-storage': patch
+'verdaccio-google-cloud': patch
+'verdaccio-memory': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+'@verdaccio/dev-types': patch
+'@verdaccio/utils': patch
+'verdaccio': patch
+'@verdaccio/web': patch
+'@verdaccio/e2e-cli': patch
+'@verdaccio/e2e-ui': patch
+'@verdaccio/website': patch
+---
+
+chore: add release step to private regisry on merge changeset pr

.changeset/kind-bears-nail.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+feat: add types and package module icons on sidebar

.changeset/late-adults-love.md

@@ -0,0 +1,20 @@
+---
+'@verdaccio/api': minor
+'verdaccio-htpasswd': minor
+'@verdaccio/local-storage': minor
+---
+
+feat: remove level dependency by lowdb for npm token cli as storage
+
+### new npm token database
+
+There will be a new database located in your storage named `.token-db.json` which
+will store all references to created tokens, **it does not store tokens**, just
+mask of them and related metadata required to reference them.
+
+#### Breaking change
+
+If you were relying on `npm token` experiment. This PR will replace the
+used database (level) by a json plain based one (lowbd) which does not
+require Node.js C++ compilation step and has less dependencies. Since was
+a experiment there is no migration step.

.changeset/late-parents-act.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/hooks': patch
+'@verdaccio/proxy': patch
+---
+
+refactor: migrate request to node-fetch at hooks package

.changeset/light-walls-begin.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/ui-theme': minor
+'@verdaccio/server': minor
+'@verdaccio/web': minor
+---
+
+feat: align with v5 ui endpoints and ui small bugfix

.changeset/little-stingrays-rule.md

@@ -0,0 +1,5 @@
+---
+'verdaccio-audit': patch
+---
+
+fix: several issues which caused the audit to fail (#2335)

.changeset/loud-shoes-jog.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+chore: force publish

.changeset/lovely-drinks-argue.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/loaders': patch
+---
+
+always create plugin instance with new

.changeset/many-vans-care.md

@@ -0,0 +1,16 @@
+---
+'@verdaccio/tarball': patch
+'@verdaccio/mock': patch
+'@verdaccio/ui-theme': patch
+'@verdaccio/server': patch
+'@verdaccio/utils': patch
+'verdaccio': patch
+---
+
+Bug Fixes
+
+- fix escaped slash in namespaced packages
+
+#### Related tickets
+
+https://github.com/verdaccio/verdaccio/pull/2193

.changeset/modern-spies-tell.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/ui-theme': minor
+'verdaccio': minor
+---
+
+feat: ui theme plugin part of the application

.changeset/neat-toes-report.md

@@ -0,0 +1,51 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/auth': minor
+'@verdaccio/cli': minor
+'@verdaccio/config': minor
+'@verdaccio/commons-api': minor
+'@verdaccio/file-locking': minor
+'verdaccio-htpasswd': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/readme': minor
+'@verdaccio/streams': minor
+'@verdaccio/types': minor
+'@verdaccio/hooks': minor
+'@verdaccio/loaders': minor
+'@verdaccio/logger': minor
+'@verdaccio/logger-prettify': minor
+'@verdaccio/middleware': minor
+'@verdaccio/mock': minor
+'@verdaccio/node-api': minor
+'@verdaccio/active-directory': minor
+'verdaccio-audit': minor
+'verdaccio-auth-memory': minor
+'verdaccio-aws-s3-storage': minor
+'verdaccio-google-cloud': minor
+'verdaccio-memory': minor
+'@verdaccio/ui-theme': minor
+'@verdaccio/proxy': minor
+'@verdaccio/server': minor
+'@verdaccio/store': minor
+'@verdaccio/dev-types': minor
+'@verdaccio/utils': minor
+'verdaccio': minor
+'@verdaccio/web': minor
+---
+
+feat: add server rate limit protection to all request
+
+To modify custom values, use the server settings property.
+
+```markdown
+server:
+
+## https://www.npmjs.com/package/express-rate-limit#configuration-options
+
+rateLimit:
+windowMs: 1000
+max: 10000
+```
+
+The values are intended to be high, if you want to improve security of your server consider
+using different values.

.changeset/neat-toys-float.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+fix: replace ts icon by td and fix commonjs icon

.changeset/olive-candles-speak.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': minor
+---
+
+feat: integrate rematch for ui state storage

.changeset/orange-flowers-cover.md

@@ -0,0 +1,43 @@
+---
+'@verdaccio/config': minor
+'@verdaccio/types': minor
+'@verdaccio/ui-theme': minor
+---
+
+feat: rework web header for mobile, add new settings and raw manifest button
+
+### New set of variables to hide features
+
+Add set of new variables that allow hide different parts of the UI, buttons, footer or download tarballs. _All are
+enabled by default_.
+
+```yaml
+# login: true <-- already exist but worth the reminder
+# showInfo: true
+# showSettings: true
+# In combination with darkMode you can force specific theme
+# showThemeSwitch: true
+# showFooter: true
+# showSearch: true
+# showDownloadTarball: true
+```
+
+> If you disable `showThemeSwitch` and force `darkMode: true` the local storage settings would be
+> ignored and force all themes to the one in the configuration file.
+
+Future could be extended to
+
+### Raw button to display manifest package
+
+A new experimental feature (enabled by default), button named RAW to be able navigate on the package manifest directly on the ui, kudos to [react-json-view](https://www.npmjs.com/package/react-json-view) that allows an easy integration, not configurable yet until get more feedback.
+
+```yaml
+showRaw: true
+```
+
+#### Rework header buttons
+
+- The header has been rework, the mobile was not looking broken.
+- Removed info button in the header and moved to a dialog
+- Info dialog now contains more information about the project, license and the aid content for Ukrania now is inside of the info modal.
+- Separate settings and info to avoid collapse too much info (for mobile still need some work)

.changeset/perfect-candles-clap.md

@@ -0,0 +1,35 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/auth': minor
+'@verdaccio/cli': minor
+'@verdaccio/config': minor
+'@verdaccio/core': minor
+'verdaccio-htpasswd': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/fastify-migration': minor
+'@verdaccio/tarball': minor
+'@verdaccio/types': minor
+'@verdaccio/url': minor
+'@verdaccio/hooks': minor
+'@verdaccio/loaders': minor
+'@verdaccio/logger': minor
+'@verdaccio/middleware': minor
+'@verdaccio/mock': minor
+'@verdaccio/node-api': minor
+'@verdaccio/active-directory': minor
+'verdaccio-auth-memory': minor
+'verdaccio-aws-s3-storage': minor
+'verdaccio-google-cloud': minor
+'verdaccio-memory': minor
+'@verdaccio/ui-theme': minor
+'@verdaccio/proxy': minor
+'@verdaccio/server': minor
+'@verdaccio/cli-standalone': minor
+'@verdaccio/store': minor
+'@verdaccio/utils': minor
+'verdaccio': minor
+'@verdaccio/web': minor
+'@verdaccio/e2e-ui': minor
+---
+
+refactor: remove @verdaccio/commons-api in favor @verdaccio/core and remove duplications

.changeset/perfect-emus-clean.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/cli': major
+---
+
+feat: node 14 as minimum for running cli

.changeset/perfect-kangaroos-agree.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/cli': major
+---
+
+feat: use clipanion over commander

.changeset/plenty-news-remember.md

@@ -0,0 +1,30 @@
+---
+'@verdaccio/auth': major
+'verdaccio-htpasswd': major
+'verdaccio-audit': major
+'@verdaccio/server': major
+'@verdaccio/cli-standalone': major
+---
+
+feat: standalone registry with no dependencies
+
+## Usage
+
+To install a server with no dependencies
+
+```bash
+npm install -g @verdaccio/standalone
+```
+
+with no internet required
+
+```bash
+npm install -g ./tarball.tar.gz
+```
+
+Bundles htpasswd and audit plugins.
+
+### Breaking Change
+
+It does not allow anymore the `auth` and `middleware` property at config file empty,
+it will fallback to those plugins by default.

.changeset/plenty-spiders-melt.md

@@ -0,0 +1,36 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/auth': minor
+'@verdaccio/cli': minor
+'@verdaccio/config': minor
+'@verdaccio/commons-api': minor
+'@verdaccio/file-locking': minor
+'verdaccio-htpasswd': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/readme': minor
+'@verdaccio/streams': minor
+'@verdaccio/types': minor
+'@verdaccio/hooks': minor
+'@verdaccio/loaders': minor
+'@verdaccio/logger': minor
+'@verdaccio/logger-prettify': minor
+'@verdaccio/middleware': minor
+'@verdaccio/mock': minor
+'@verdaccio/node-api': minor
+'@verdaccio/proxy': minor
+'@verdaccio/server': minor
+'@verdaccio/store': minor
+'@verdaccio/dev-types': minor
+'@verdaccio/utils': minor
+'verdaccio': minor
+'@verdaccio/web': minor
+'@verdaccio/website': minor
+---
+
+feat: add typescript project references settings
+
+Reading https://ebaytech.berlin/optimizing-multi-package-apps-with-typescript-project-references-d5c57a3b4440 I realized I can use project references to solve the issue to pre-compile modules on develop mode.
+
+It allows to navigate (IDE) trough the packages without need compile the packages.
+
+Add two `tsconfig`, one using the previous existing configuration that is able to produce declaration files (`tsconfig.build`) and a new one `tsconfig` which is enables [_projects references_](https://www.typescriptlang.org/docs/handbook/project-references.html).

.changeset/plenty-tables-refuse.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/cli': minor
+'@verdaccio/node-api': minor
+---
+
+feat: improve cli loggin on start up

.changeset/pre.json

@@ -0,0 +1,120 @@
+{
+  "mode": "pre",
+  "tag": "6-next",
+  "initialVersions": {
+    "@verdaccio/api": "6.0.0-alpha.0",
+    "@verdaccio/auth": "6.0.0-alpha.0",
+    "@verdaccio/cli": "6.0.0-alpha.0",
+    "@verdaccio/config": "6.0.0-alpha.0",
+    "@verdaccio/file-locking": "11.0.0-alpha.0",
+    "verdaccio-htpasswd": "11.0.0-alpha.0",
+    "@verdaccio/local-storage": "11.0.0-alpha.0",
+    "@verdaccio/readme": "11.0.0-alpha.0",
+    "@verdaccio/streams": "11.0.0-alpha.0",
+    "@verdaccio/types": "11.0.0-alpha.0",
+    "@verdaccio/hooks": "6.0.0-alpha.0",
+    "@verdaccio/loaders": "6.0.0-alpha.0",
+    "@verdaccio/logger": "6.0.0-alpha.0",
+    "@verdaccio/logger-prettify": "6.0.0-alpha.0",
+    "@verdaccio/middleware": "6.0.0-alpha.0",
+    "@verdaccio/mock": "6.0.0-alpha.0",
+    "@verdaccio/node-api": "6.0.0-alpha.0",
+    "@verdaccio/proxy": "6.0.0-alpha.0",
+    "@verdaccio/server": "6.0.0-alpha.0",
+    "@verdaccio/store": "6.0.0-alpha.0",
+    "@verdaccio/dev-types": "6.0.0-alpha.0",
+    "@verdaccio/utils": "6.0.0-alpha.0",
+    "verdaccio": "6.0.0-alpha.0",
+    "@verdaccio/web": "6.0.0-alpha.0",
+    "@verdaccio/active-directory": "11.0.0-alpha.0",
+    "verdaccio-audit": "11.0.0-alpha.0",
+    "verdaccio-auth-memory": "11.0.0-alpha.0",
+    "verdaccio-aws-s3-storage": "11.0.0-alpha.0",
+    "verdaccio-google-cloud": "11.0.0-alpha.0",
+    "verdaccio-memory": "11.0.0-alpha.0",
+    "@verdaccio/ui-theme": "6.0.0-alpha.1",
+    "@verdaccio/e2e-cli": "1.0.0",
+    "@verdaccio/e2e-ui": "1.0.0",
+    "@verdaccio/cli-standalone": "6.0.0-alpha.3",
+    "@verdaccio/tarball": "11.0.0-alpha.3",
+    "@verdaccio/url": "11.0.0-alpha.3",
+    "@verdaccio/fastify-migration": "6.0.0-6-next.9",
+    "@verdaccio/eslint-config": "1.0.0",
+    "@verdaccio/benchmark": "1.0.0",
+    "@verdaccio/core": "6.0.0-next.0",
+    "@verdaccio/test-helper": "1.0.0",
+    "docusaurus-plugin-contributors": "1.0.0",
+    "@verdaccio/website": "5.4.0"
+  },
+  "changesets": [
+    "afraid-mice-obey",
+    "big-lobsters-sin",
+    "bright-poems-obey",
+    "brown-cycles-laugh",
+    "brown-pandas-wink",
+    "calm-pants-impress",
+    "chilled-ways-fetch",
+    "dry-planes-tap",
+    "dull-monkeys-search",
+    "eleven-brooms-hunt",
+    "eleven-spoons-matter",
+    "fair-lemons-beam",
+    "few-cooks-destroy",
+    "few-mangos-grow",
+    "fifty-jars-rest",
+    "fuzzy-drinks-taste",
+    "fuzzy-onions-draw",
+    "gentle-parrots-lay",
+    "gentle-trains-switch",
+    "gold-vans-tease",
+    "healthy-bikes-behave",
+    "healthy-pants-smash",
+    "healthy-poets-compare",
+    "heavy-ravens-lay",
+    "hip-hounds-destroy",
+    "kind-bears-nail",
+    "late-adults-love",
+    "late-parents-act",
+    "light-walls-begin",
+    "little-stingrays-rule",
+    "loud-shoes-jog",
+    "lovely-drinks-argue",
+    "many-vans-care",
+    "modern-spies-tell",
+    "neat-toes-report",
+    "neat-toys-float",
+    "olive-candles-speak",
+    "orange-flowers-cover",
+    "perfect-candles-clap",
+    "perfect-emus-clean",
+    "perfect-kangaroos-agree",
+    "plenty-news-remember",
+    "plenty-spiders-melt",
+    "plenty-tables-refuse",
+    "pretty-hounds-tap",
+    "proud-jeans-walk",
+    "proud-jobs-hope",
+    "red-chefs-float",
+    "red-yaks-sell",
+    "rich-ghosts-rule",
+    "shaggy-carrots-unite",
+    "shaggy-parrots-smash",
+    "shiny-chefs-heal",
+    "slow-carrots-relate",
+    "smart-apricots-kneel",
+    "smart-beds-cross",
+    "sour-buses-shout",
+    "spicy-frogs-press",
+    "spicy-snakes-sip",
+    "swift-pumpkins-knock",
+    "ten-parents-breathe",
+    "tender-bags-call",
+    "thick-countries-move",
+    "thick-readers-hang",
+    "three-moles-drop",
+    "three-pots-sit",
+    "tiny-seals-join",
+    "two-dolls-check",
+    "wild-jokes-beam"
+  ]
+}

.changeset/pretty-hounds-tap.md

@@ -0,0 +1,28 @@
+---
+'@verdaccio/api': patch
+'@verdaccio/auth': patch
+'@verdaccio/cli': patch
+'@verdaccio/config': patch
+'@verdaccio/commons-api': patch
+'@verdaccio/file-locking': patch
+'verdaccio-htpasswd': patch
+'@verdaccio/local-storage': patch
+'@verdaccio/readme': patch
+'@verdaccio/streams': patch
+'@verdaccio/types': patch
+'@verdaccio/hooks': patch
+'@verdaccio/loaders': patch
+'@verdaccio/logger': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/middleware': patch
+'@verdaccio/node-api': patch
+'@verdaccio/proxy': patch
+'@verdaccio/server': patch
+'@verdaccio/store': patch
+'@verdaccio/dev-types': patch
+'@verdaccio/utils': patch
+'verdaccio': patch
+'@verdaccio/web': patch
+---
+
+Enable prerelease mode with **changesets**

.changeset/proud-jeans-walk.md

@@ -0,0 +1,10 @@
+---
+'verdaccio-htpasswd': patch
+'@verdaccio/local-storage': patch
+'@verdaccio/fastify-migration': patch
+'@verdaccio/hooks': patch
+'@verdaccio/mock': patch
+'@verdaccio/node-api': patch
+---
+
+Added core-js missing from dependencies though referenced in .js sources

.changeset/proud-jobs-hope.md

@@ -0,0 +1,45 @@
+---
+'@verdaccio/api': major
+'@verdaccio/cli': major
+'@verdaccio/config': major
+'@verdaccio/core': major
+'@verdaccio/types': major
+'@verdaccio/logger': major
+'@verdaccio/node-api': major
+'verdaccio-aws-s3-storage': major
+'verdaccio-google-cloud': major
+'verdaccio-htpasswd': major
+'@verdaccio/local-storage': major
+'verdaccio-memory': major
+'@verdaccio/ui-theme': major
+'@verdaccio/proxy': major
+'@verdaccio/server': major
+'@verdaccio/mock': major
+'verdaccio': major
+'@verdaccio/web': major
+'@verdaccio/e2e-cli': major
+'@verdaccio/website': major
+---
+
+feat!: config.logs throw an error, logging config not longer accept array or logs property
+
+### 💥 Breaking change
+
+This is valid
+
+```yaml
+log: { type: stdout, format: pretty, level: http }
+```
+
+This is invalid
+
+```yaml
+logs: { type: stdout, format: pretty, level: http }
+```
+
+or
+
+```yaml
+logs:
+  - [{ type: stdout, format: pretty, level: http }]
+```

.changeset/red-chefs-float.md

@@ -0,0 +1,11 @@
+---
+'@verdaccio/store': patch
+'@verdaccio/web': patch
+---
+
+Fix the search by exact name of the package
+
+Full package name queries was not finding anithing. It was happening
+becouse of stemmer of [lunr.js](https://lunrjs.com/).
+
+To fix this, the stemmer of [lunr.js](https://lunrjs.com/) was removed from search pipeline.

.changeset/red-yaks-sell.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/logger': patch
+---
+
+Fix re-opening log files using SIGUSR2

.changeset/rich-ghosts-rule.md

@@ -0,0 +1,10 @@
+---
+'@verdaccio/types': major
+'@verdaccio/ui-theme': major
+'@verdaccio/dev-types': major
+'@verdaccio/web': major
+'@verdaccio/e2e-ui': major
+'@verdaccio/website': major
+---
+
+feat: upgrade to material ui 5

.changeset/shaggy-carrots-unite.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/logger': patch
+---
+
+do not show deprecation warning on default logger config

.changeset/shaggy-parrots-smash.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/cli': minor
+'@verdaccio/core': minor
+'@verdaccio/logger': minor
+'@verdaccio/node-api': minor
+---
+
+feat: use warning codes for deprecation warnings

.changeset/shiny-chefs-heal.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/api': patch
+---
+
+testing changesets

.changeset/slow-carrots-relate.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/config': minor
+'@verdaccio/web': minor
+---
+
+feat(web): add a config item to web，let the developer can select whet……her enable the html cache

.changeset/smart-apricots-kneel.md

@@ -0,0 +1,79 @@
+---
+'@verdaccio/ui-theme': major
+'@verdaccio/cli-standalone': major
+'@verdaccio/web': major
+---
+
+feat: flexible user interface generator
+
+**breaking change**
+
+The UI does not provide a pre-generated `index.html`, instead the server generates
+the body of the web application based in few parameters:
+
+- Webpack manifest
+- User configuration details
+
+It allows inject html tags, javascript and new CSS to make the page even more flexible.
+
+### Web new properties for dynamic template
+
+The new set of properties are made in order allow inject _html_ and _JavaScript_ scripts within the template. This
+might be useful for scenarios like Google Analytics scripts or custom html in any part of the body.
+
+- metaScripts: html injected before close the `head` element.
+- scriptsBodyAfter: html injected before close the `body` element.
+- bodyAfter: html injected after _verdaccio_ JS scripts.
+
+```yaml
+web:
+  scriptsBodyAfter:
+    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
+  metaScripts:
+    - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
+    - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
+    - '<meta name="robots" content="noindex" />'
+  bodyBefore:
+    - '<div id="myId">html before webpack scripts</div>'
+  bodyAfter:
+    - '<div id="myId">html after webpack scripts</div>'
+```
+
+### UI plugin changes
+
+- `index.html` is not longer used, template is generated based on `manifest.json` generated by webpack.
+- Plugin must export:
+  - the manifest file.
+  - the manifest files: matcher (array of id that generates required scripts to run the ui)
+  - static path: The absolute path where the files are located in `node_modules`
+
+```
+exports.staticPath = path.join(__dirname, 'static');
+exports.manifest = require('./static/manifest.json');
+exports.manifestFiles = {
+  js: ['runtime.js', 'vendors.js', 'main.js'],
+  css: [],
+  ico: 'favicon.ico',
+};
+```
+
+- Remove font files
+- CSS is inline on JS (this will help with #2046)
+
+### Docker v5 Examples
+
+- Move all current examples to v4 folder
+- Remove any v3 example
+- Create v5 folder with Nginx Example
+
+#### Related tickets
+
+https://github.com/verdaccio/verdaccio/issues/1523
+https://github.com/verdaccio/verdaccio/issues/1297
+https://github.com/verdaccio/verdaccio/issues/1593
+https://github.com/verdaccio/verdaccio/discussions/1539
+https://github.com/verdaccio/website/issues/264
+https://github.com/verdaccio/verdaccio/issues/1565
+https://github.com/verdaccio/verdaccio/issues/1251
+https://github.com/verdaccio/verdaccio/issues/2029
+https://github.com/verdaccio/docker-examples/issues/29

.changeset/smart-beds-cross.md

@@ -0,0 +1,20 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/config': minor
+'@verdaccio/core': minor
+'@verdaccio/types': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/ui-theme': minor
+'@verdaccio/proxy': minor
+'@verdaccio/server': minor
+'@verdaccio/store': minor
+'@verdaccio/test-helper': minor
+'@verdaccio/web': minor
+---
+
+feat: ui search support for remote, local and private packages
+
+The command `npm search` search globally and return all matches, with this improvement the user interface
+is powered with the same capabilities.
+
+The UI also tag where is the origin the package with a tag, also provide the latest version and description of the package.

.changeset/sour-buses-shout.md

@@ -0,0 +1,11 @@
+---
+'@verdaccio/fastify-migration': minor
+'@verdaccio/store': minor
+'@verdaccio/utils': minor
+'@verdaccio/web': minor
+'@verdaccio/website': minor
+---
+
+feat: migrate web sidebar endpoint to fastify
+
+reuse utils methods between packages

.changeset/spicy-frogs-press.md

@@ -0,0 +1,32 @@
+---
+'verdaccio-htpasswd': major
+---
+
+feat: allow other password hashing algorithms (#1917)
+
+**breaking change**
+
+The current implementation of the `htpasswd` module supports multiple hash formats on verify, but only `crypt` on sign in.
+`crypt` is an insecure old format, so to improve the security of the new `verdaccio` release we introduce the support of multiple hash algorithms on sign in step.
+
+### New hashing algorithms
+
+The new possible hash algorithms to use are `bcrypt`, `md5`, `sha1`. `bcrypt` is chosen as a default, because of its customizable complexity and overall reliability. You can read more about them [here](https://httpd.apache.org/docs/2.4/misc/password_encryptions.html).
+
+Two new properties are added to `auth` section in the configuration file:
+
+- `algorithm` to choose the way you want to hash passwords.
+- `rounds` is used to determine `bcrypt` complexity. So one can improve security according to increasing computational power.
+
+Example of the new `auth` config file section:
+
+```yaml
+auth:
+htpasswd:
+  file: ./htpasswd
+  max_users: 1000
+  # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
+  algorithm: bcrypt
+  # Rounds number for "bcrypt", will be ignored for other algorithms.
+  rounds: 10
+```

.changeset/spicy-snakes-sip.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+fix: specific version package detail page not showing

.changeset/swift-pumpkins-knock.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/auth': patch
+'verdaccio-htpasswd': patch
+---
+
+Refactor htpasswd plugin to use the bcryptjs 'compare' api call instead of 'comparSync'. Add a new configuration value named 'slow_verify_ms' to the htpasswd plugin that when exceeded during password verification will log a warning message.

.changeset/ten-parents-breathe.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/auth': minor
+'@verdaccio/fastify-migration': minor
+'@verdaccio/web': minor
+---
+
+dist tags Implementation on Fastify

.changeset/tender-bags-call.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/logger': major
+---
+
+logging prettifier only in development mode
+
+- Verdaccio prettify `@verdaccio/logger-prettify` the logging which looks beautiful. But there are scenarios which does not make sense in production. This feature enables disable by default the prettifies if production `NODE_ENV` is enabled.
+- Updates pino.js to `^6.7.0`.
+- Suppress the warning when prettifier is enabled `suppressFlushSyncWarning`

.changeset/thick-countries-move.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/logger': major
+'@verdaccio/logger-prettify': major
+---
+
+feat: upgrade to pino v7

.changeset/thick-readers-hang.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+fix: fixes some style issues on mobile, particularly related to the Ukraine support message - [@s-h-a-d-o-w](https://github.com/s-h-a-d-o-w)

.changeset/three-moles-drop.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/store': minor
+'@verdaccio/utils': minor
+---
+
+refactor: improve versions and dist-tag filters

.changeset/three-pots-sit.md

@@ -0,0 +1,33 @@
+---
+'@verdaccio/api': patch
+'@verdaccio/auth': patch
+'@verdaccio/cli': patch
+'@verdaccio/config': patch
+'@verdaccio/commons-api': patch
+'@verdaccio/file-locking': patch
+'verdaccio-htpasswd': patch
+'@verdaccio/local-storage': patch
+'@verdaccio/readme': patch
+'@verdaccio/types': patch
+'@verdaccio/hooks': patch
+'@verdaccio/loaders': patch
+'@verdaccio/logger': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/middleware': patch
+'@verdaccio/mock': patch
+'@verdaccio/node-api': patch
+'@verdaccio/proxy': patch
+'@verdaccio/server': patch
+'@verdaccio/store': patch
+'@verdaccio/dev-types': patch
+'@verdaccio/utils': patch
+'verdaccio': patch
+---
+
+ESLint Warnings Fixed
+
+Related to issue #1461
+
+- max-len: most of the sensible max-len errors are fixed
+- no-unused-vars: most of these types of errors are fixed by deleting not needed declarations
+- @typescript-eslint/no-unused-vars: same as above

.changeset/tiny-seals-join.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': minor
+---
+
+feat: improve registry info dialog and language switch

.changeset/two-dolls-check.md

@@ -0,0 +1,28 @@
+---
+'@verdaccio/cli': major
+'@verdaccio/config': major
+'@verdaccio/types': major
+'@verdaccio/logger': major
+'@verdaccio/node-api': major
+'verdaccio-google-cloud': major
+'verdaccio': major
+---
+
+feat: node api new structure based on promise
+
+```js
+import { runServer } from '@verdaccio/node-api';
+// or
+import { runServer } from 'verdaccio';
+
+const app = await runServer(); // default configuration
+const app = await runServer('./config/config.yaml');
+const app = await runServer({ configuration });
+app.listen(4000, (event) => {
+  // do something
+});
+```
+
+### Breaking Change
+
+If you are using the node-api, the new structure is Promise based and less arguments.

.changeset/wild-jokes-beam.md

@@ -0,0 +1,32 @@
+---
+'@verdaccio/types': minor
+'@verdaccio/ui-theme': minor
+'@verdaccio/web': minor
+---
+
+web: allow ui hide package managers on sidebar
+
+If there is a package manager of preference over others, you can define the package managers to be displayed on the detail page and sidebar, just define in the `config.yaml` and web section the list of package managers to be displayed.
+
+```
+web:
+  title: Verdaccio
+  sort_packages: asc
+  primary_color: #cccccc
+  pkgManagers:
+    - pnpm
+    - yarn
+    # - npm
+```
+
+To disable all package managers, just define empty:
+
+```
+web:
+  title: Verdaccio
+  sort_packages: asc
+  primary_color: #cccccc
+  pkgManagers:
+```
+
+and the section would be hidden.

.dockerignore

@@ -0,0 +1,39 @@
+# we try to avoid adding files to the docker images that change often
+# or that are not needed for running the docker image
+# this greatly reduces the amount of times we need to rerun `npm install` when building image locally
+# https://codefresh.io/blog/not-ignore-dockerignore/
+# https://docs.docker.com/engine/reference/builder/#dockerignore-file
+
+# consider them hidden
+.*
+# you can add exceptions like in .gitignore to maintain a whitelist:
+# e.g.
+!.babelrc
+!.eslintrc
+!.prettierrc.json
+!.prettierignore
+!.eslintignore
+!.stylelintrc
+
+# do not copy over node_modules we will run `pnpm install` anyway
+node_modules
+website
+jest
+docs
+contrib
+docker-examples
+website
+systemd
+
+# output from test runs and similar things
+*.log
+coverage/
+.vscode/
+
+# IDE config files
+jsconfig.json
+*.iml
+
+# let's not get too recursive ;)
+Dockerfile*
+docker-compose*.yaml

.editorconfig

@@ -0,0 +1,13 @@
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+
+# 2 space indentation
+[{.,}*.{ts,tsx,js,jsx,yml,yaml}]
+indent_style = space
+indent_size = 2
+quote_type = single

.env

@@ -0,0 +1,2 @@
+# default values for docker-compose
+PORT=4873

.eslintignore

@@ -0,0 +1,14 @@
+**/fixtures/**
+**/mock/store/**
+**/partials/**
+**/types/custom.d.ts
+build/
+coverage/
+node_modules/
+static/
+website/
+wiki/
+dist/
+docs/
+test/functional/store/*
+docker-examples/**/lib/**/*.js

.eslintrc.js

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: ['@verdaccio/eslint-config'],
+};

.gitattributes

@@ -0,0 +1,199 @@
+## GITATTRIBUTES FOR WEB PROJECTS
+#
+# These settings are for any web project.
+#
+# Details per file setting:
+#   text    These files should be normalized (i.e. convert CRLF to LF).
+#   binary  These files are binary and should be left untouched.
+#
+# Note that binary is a macro for -text -diff.
+######################################################################
+
+# Auto detect
+##   Handle line endings automatically for files detected as
+##   text and leave all files detected as binary untouched.
+##   This will handle all files NOT defined below.
+*                 text=lf
+
+# Source code
+*.bash            text eol=lf
+*.bat             text eol=crlf
+*.cmd             text eol=crlf
+*.coffee          text eol=lf
+*.css             text eol=lf
+*.htm             text diff=html
+*.html            text diff=html
+*.inc             text eol=lf
+*.ini             text eol=lf
+*.js              text eol=lf
+*.json            text eol=lf
+*.jsx             text eol=lf
+*.less            text eol=lf
+*.ls              text eol=lf
+*.map             text -diff
+*.od              text eol=lf
+*.onlydata        text eol=lf
+*.php             text diff=php
+*.pl              text eol=lf
+*.ps1             text eol=crlf
+*.py              text diff=python
+*.rb              text diff=ruby
+*.sass            text eol=lf
+*.scm             text eol=lf
+*.scss            text diff=css
+*.sh              text eol=lf
+*.sql             text eol=lf
+*.styl            text eol=lf
+*.tag             text eol=lf
+*.ts              text eol=lf
+*.tsx             text eol=lf
+*.xml             text eol=lf
+*.xhtml           text diff=html
+
+# Docker
+Dockerfile        text eol=lf
+
+# Documentation
+*.ipynb           text eol=lf
+*.markdown        text eol=lf
+*.md              text eol=lf
+*.mdwn            text eol=lf
+*.mdown           text eol=lf
+*.mkd             text eol=lf
+*.mkdn            text eol=lf
+*.mdtxt           text eol=lf
+*.mdtext          text eol=lf
+*.txt             text eol=lf
+AUTHORS           text eol=lf
+CHANGELOG         text eol=lf
+CHANGES           text eol=lf
+CONTRIBUTING      text eol=lf
+COPYING           text eol=lf
+copyright         text eol=lf
+*COPYRIGHT*       text eol=lf
+INSTALL           text eol=lf
+license           text eol=lf
+LICENSE           text eol=lf
+NEWS              text eol=lf
+readme            text eol=lf
+*README*          text eol=lf
+TODO              text eol=lf
+
+# Templates
+*.dot             text eol=lf
+*.ejs             text eol=lf
+*.haml            text eol=lf
+*.handlebars      text eol=lf
+*.hbs             text eol=lf
+*.hbt             text eol=lf
+*.jade            text eol=lf
+*.latte           text eol=lf
+*.mustache        text eol=lf
+*.njk             text eol=lf
+*.phtml           text eol=lf
+*.tmpl            text eol=lf
+*.tpl             text eol=lf
+*.twig            text eol=lf
+*.vue             text eol=lf
+
+# Configs
+*.cnf             text eol=lf
+*.conf            text eol=lf
+*.config          text eol=lf
+.editorconfig     text eol=lf
+.env              text eol=lf
+.gitattributes    text eol=lf
+.gitconfig        text eol=lf
+.htaccess         text eol=lf
+*.lock            text -diff
+package-lock.json text -diff
+*.toml            text eol=lf
+*.yaml            text eol=lf
+*.yml             text eol=lf
+browserslist      text eol=lf
+Makefile          text eol=lf
+makefile          text eol=lf
+
+# Heroku
+Procfile          text eol=lf
+
+# Graphics
+*.ai              binary
+*.bmp             binary
+*.eps             binary
+*.gif             binary
+*.gifv            binary
+*.ico             binary
+*.jng             binary
+*.jp2             binary
+*.jpg             binary
+*.jpeg            binary
+*.jpx             binary
+*.jxr             binary
+*.pdf             binary
+*.png             binary
+*.psb             binary
+*.psd             binary
+# SVG treated as an asset (binary) by default.
+*.svg             text eol=lf
+# If you want to treat it as binary,
+# use the following line instead.
+# *.svg           binary
+*.svgz            binary
+*.tif             binary
+*.tiff            binary
+*.wbmp            binary
+*.webp            binary
+
+# Audio
+*.kar             binary
+*.m4a             binary
+*.mid             binary
+*.midi            binary
+*.mp3             binary
+*.ogg             binary
+*.ra              binary
+
+# Video
+*.3gpp            binary
+*.3gp             binary
+*.as              binary
+*.asf             binary
+*.asx             binary
+*.fla             binary
+*.flv             binary
+*.m4v             binary
+*.mng             binary
+*.mov             binary
+*.mp4             binary
+*.mpeg            binary
+*.mpg             binary
+*.ogv             binary
+*.swc             binary
+*.swf             binary
+*.webm            binary
+
+# Archives
+*.7z              binary
+*.gz              binary
+*.jar             binary
+*.rar             binary
+*.tar             binary
+*.zip             binary
+
+# Fonts
+*.ttf             binary
+*.eot             binary
+*.otf             binary
+*.woff            binary
+*.woff2           binary
+
+# Executables
+*.exe             binary
+*.pyc             binary
+
+# RC files (like .babelrc or .eslintrc)
+*.*rc             text eol=lf
+
+# Ignore files (like .npmignore or .gitignore)
+*.*ignore         text eol=lf

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+open_collective: verdaccio
+github: verdaccio

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,71 @@
+---
+name: Bug report 🐛
+about: A feature is not working as is expected, I want to report a bug
+labels: 'issue: needs triage'
+title: ''
+assignees: ''
+---
+
+<!-- PLEASE READ THIS:  
+ - If you are not sure is a bug, OPEN a DISCUSSION, if is a legitimate bug, is easy to create a bug from a discussion.
+ - Empty reports won't be considered and eventually be closed by a bot.
+ - Include debugging notes will help to fix it faster, HOW TO: https://github.com/verdaccio/verdaccio/wiki/Debugging-Verdaccio 
+ - If you remove this template, ticket will be closed immediately.
+ - No English perfect is required, use public translators if is need it, we will do our best to help you.
+ - Extra bonus: The most complete this report is delivered, the faster you will get a response.
+ - Extra bonus: include screenshots, logs (remove sensitive data).
+ - If you are willing to fix it, there is a checkbox at the bottom.
+-->
+
+**Your Environment**
+  <!-- bug below the version 5.x will be closed, see SECURITY.md for more details -->
+ * **verdaccio version**: 5.x.x
+ * **node version** [12.x.x, 14.x.x]:
+ * **package manager**: [npm@7, pnpm@6, yarn@2]
+ * **os**: [mac, windows@10, linux]
+ * **platform**: [npm, docker, helm, other]
+
+**Describe the bug**
+
+<!-- A clear and concise description of what the bug is. -->
+
+**To Reproduce**
+
+<!-- IMPORTANT:
+ - How to reproduce the issue
+ - Steps to reproduce the issue
+
+Be aware, the lack of reproducible steps the issue might cause your ticket to be closed.
+-->
+
+**Expected behavior**
+
+<!-- A clear and concise description of what you expected to happen. -->
+
+**Screenshots, server logs, package manager log**
+
+<!-- If applicable, add screenshots to help explain your problem.  -->
+
+**Configuration File (cat ~/.config/verdaccio/config.yaml)**
+
+<!-- Please be careful do not leak any sensitive information, remove tokens -->
+
+**Environment information**
+
+<!-- Please paste the results of running `verdaccio --info` -->
+
+**Debugging output**
+
+- `$ NODE_DEBUG=request verdaccio` display request calls (verdaccio <--> uplinks)
+- `$ DEBUG=verdaccio* verdaccio` enable extreme verdaccio debug mode (verdaccio api)
+- `$ npm -ddd` prints:
+- `$ npm config get registry` prints:
+
+**Contribute to Verdaccio**
+
+- [ ] I'm willing to fix this bug 🥇 
+
+<!--
+
+IMPORTANT: please do not attach external files, all content should be visible from any device.
+-->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question 🤷🏻‍♂️
+    url: https://github.com/verdaccio/verdaccio/discussions/new?category=q-a
+    about: 🆕 Open a new Q&A discussion 🙏
+  - name: Security Report 🛡
+    url: https://github.com/verdaccio/verdaccio/security/policy
+    about: I want to report a security vulnerability
+  - name: Chat 🏘
+    url: https://discord.gg/7qWJxBf
+    about: For a quick question you should do it through our community chat
+  - name: User Interface Report 👩🏼‍🎨👨🏼‍🎨
+    url: https://github.com/verdaccio/ui/issues/new/choose
+    about: Any report related with the User Interface should be posted in another repository

.github/ISSUE_TEMPLATE/feature.md

@@ -0,0 +1,36 @@
+---
+name: 'Feature Request 🔮'
+about: You want a feature request.
+title: ''
+labels: 'topic: feature request'
+assignees: ''
+---
+
+<!--
+IMPORTANT: If you don't have an action plan, please consider create a DISCUSSION (idea) instead for an open a feature request issue.
+
+https://github.com/verdaccio/verdaccio/discussions/new
+
+Verdaccio is a project addressed for voluntaries, if you appreciate this project consider to donate.
+1$/5$ or custom amount single contribution
+
+or monthly
+1$/month - minimal contribution
+5$/month - nice contribution
+
+https://github.com/sponsors/verdaccio
+
+As reminder, the Open Source must be sustainable.
+-->
+
+**Is your feature request related to a problem?**
+Please describe a clear and concise description of what the problem is. E.g. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+
+  # Maintain dependencies for npm
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    allow:
+      - dependency-name: '@verdaccio/*'
+      - dependency-name: 'verdaccio-*'
+    assignees:
+      - 'verdacciobot'
+    labels:
+      - 'bot: dependencies'

.github/disabled/e2e-angular-cli-workflow.yml

@@ -0,0 +1,131 @@
+on:
+  schedule:
+    - cron: '0 3 * * 5'
+  pull_request:
+    branches:
+      - '**'
+
+name: 'E2E Angular CLI with verdaccio'
+jobs:
+  # todo: fix yarn global issue, cannot find ng
+  #  yarn:
+  #    strategy:
+  #      fail-fast: false
+  #      matrix:
+  #        os: [ubuntu-latest, windows-latest]
+  #
+  #    name: '${{ matrix.os }} / yarn:angular example'
+  #    runs-on: ${{ matrix.os }}
+  #
+  #    steps:
+  #      - uses: actions/checkout@v2.3.1
+  #
+  #      - name: 'Use Node.js 10.x'
+  #        uses: actions/setup-node@v2.1.1
+  #        with:
+  #          node-version: 10.x
+  #      - name: Install Dependencies
+  #        run: yarn install --pure-lockfile
+  #      - name: 'Run verdaccio in the background'
+  #        run: |
+  #          nohup node ./scripts/run-verdaccio.js &
+  #      - name: 'Ping to verdaccio'
+  #        run: |
+  #          npm ping --registry http://localhost:4873
+  #      - name: 'Running the integration test'
+  #        run: |
+  #          source scripts/e2e-setup-ci.sh
+  #          yarn init --yes
+  #
+  #          yarn global add @angular/cli
+  #          which nodemon
+  #          ng new verdaccio-angular --interactive=false
+  #
+  #          cd verdaccio-angular
+  #          echo "registry=http://localhost:4873" > ~/.npmrc
+  #          yarn add @angular-devkit/core@next @babel/preset-env @babel/core -D
+  #
+  #          ng build --aot
+  npm:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    name: '${{ matrix.os }} / npm:angular example'
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v2.3.1
+
+      - name: 'Use Node.js 10.x'
+        uses: actions/setup-node@v2.1.1
+        with:
+          node-version: 10.x
+      - name: 'install latest npm'
+        run: npm i -g npm
+      - name: Install Dependencies
+        run: yarn install --pure-lockfile
+      - name: 'Run verdaccio in the background'
+        run: |
+          nohup node ./scripts/run-verdaccio.js &
+      - name: 'Ping to verdaccio'
+        run: |
+          npm ping --registry http://localhost:4873
+      - name: 'Running the integration test'
+        run: |
+          source scripts/e2e-setup-ci.sh
+          echo "registry=http://localhost:4873" > ~/.npmrc
+          npm config set loglevel="http"
+          npm config set fetch-retries="5"
+          npm config set fetch-retry-factor="50"
+          npm config set fetch-retry-mintimeout="20000"
+          npm config set fetch-retry-maxtimeout="80000"
+          npm install -g @angular/cli
+          ng new verdaccio-angular --interactive=false
+
+          cd verdaccio-angular
+          npm install @angular-devkit/core@next @babel/preset-env @babel/core -D
+
+          npm run ng build --aot
+
+#  pnpm throws errors worth to check why
+#  pnpm:
+#    strategy:
+#      fail-fast: false
+#      matrix:
+#        os: [ubuntu-latest, windows-latest]
+#
+#    name: '${{ matrix.os }} / pnpm:angular example'
+#    runs-on: ${{ matrix.os }}
+#
+#    steps:
+#      - uses: actions/checkout@v2.3.1
+#
+#      - name: 'Use Node.js 10.x'
+#        uses: actions/setup-node@v2.1.1
+#        with:
+#          node-version: 10.x
+#      - name: 'install latest pnpm'
+#        run: npm i -g pnpm
+#      - name: Install Dependencies
+#        run: yarn install --pure-lockfile
+#      - name: 'Run verdaccio in the background'
+#        run: |
+#          nohup node ./scripts/run-verdaccio.js &
+#      - name: 'Ping to verdaccio'
+#        run: |
+#          pnpm ping --registry http://localhost:4873
+#      - name: 'Running the integration test'
+#        run: |
+#          source scripts/e2e-setup-ci.sh
+#          pnpm init --force
+#
+#          pnpm install -g @angular/cli
+#          ng new verdaccio-angular --interactive=false
+#
+#          cd verdaccio-angular
+#          echo "registry=http://localhost:4873" > ~/.npmrc
+#          pnpm install @angular-devkit/core@next @babel/preset-env @babel/core -D
+#
+#          pnpm run ng build --aot

.github/disabled/e2e-gatsbyjs-cli-workflow.yml

@@ -0,0 +1,49 @@
+on:
+  schedule:
+    - cron: '0 3 * * 5'
+  pull_request:
+    branches:
+      - '**'
+
+name: 'E2E Gatsby.js CLI with verdaccio'
+jobs:
+  npm:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    name: '${{ matrix.os }} / npm:gatsby example'
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: 'Use Node.js 14.x'
+        uses: actions/setup-node@v2.1.5
+        with:
+          node-version: 14.x
+      - name: 'install latest npm'
+        run: npm i -g npm@latest-6
+      - name: Install Dependencies
+        run: yarn install
+      - name: 'Run verdaccio in the background'
+        run: |
+          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
+      - name: 'Ping to verdaccio'
+        run: |
+          npm ping --registry http://localhost:4873
+      - name: 'Running the integration test'
+        run: |
+          source scripts/e2e-setup-ci.sh
+          echo "registry=http://localhost:4873
+          loglevel="silent"
+          fetch-retries=10
+          fetch-retry-factor=2
+          fetch-retry-mintimeout=10000
+          fetch-retry-maxtimeout=80000" > ~/.npmrc
+          npm config list
+          npm i -g gatsby
+          gatsby new my-gatsby
+          cd my-gatsby
+          npm run build

.github/disabled/e2e-jest-workflow.yml

@@ -0,0 +1,121 @@
+on:
+  schedule:
+    - cron: '0 3 * * 5'
+  pull_request:
+    branches:
+      - '**'
+
+name: 'E2E Jest with verdaccio'
+jobs:
+  yarn:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    name: '${{ matrix.os }} / yarn:jest example'
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v2.3.1
+
+      - name: 'Use Node.js 10.x'
+        uses: actions/setup-node@v2.1.1
+        with:
+          node-version: 10.x
+      - name: Install Dependencies
+        run: yarn install --pure-lockfile
+      - name: 'Run verdaccio in the background'
+        run: |
+          nohup node ./scripts/run-verdaccio.js &
+      - name: 'Ping to verdaccio'
+        run: |
+          npm ping --registry http://localhost:4873
+      - name: 'Running the integration test'
+        run: |
+          source scripts/e2e-setup-ci.sh
+          yarn init --yes
+          yarn add jest --registry http://localhost:4873
+
+          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
+          yarn jest pass.test.js
+
+          yarn add left-pad --registry http://localhost:4873 --verbose
+          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
+          yarn jest module.test.js
+  npm:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    name: '${{ matrix.os }} / npm:jest example'
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v2.3.1
+
+      - name: 'Use Node.js 10.x'
+        uses: actions/setup-node@v2.1.1
+        with:
+          node-version: 10.x
+      - name: 'install latest npm'
+        run: npm i -g npm
+      - name: Install Dependencies
+        run: yarn install --pure-lockfile
+      - name: 'Run verdaccio in the background'
+        run: |
+          nohup node ./scripts/run-verdaccio.js &
+      - name: 'Ping to verdaccio'
+        run: |
+          npm ping --registry http://localhost:4873
+      - name: 'Running the integration test'
+        run: |
+          source scripts/e2e-setup-ci.sh
+          npm init --force
+          npm install jest --registry http://localhost:4873
+
+          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
+          yarn jest pass.test.js
+
+          yarn add left-pad --registry http://localhost:4873 --verbose
+          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
+          yarn jest module.test.js
+  pnpm:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    name: '${{ matrix.os }} / pnpm:jest example'
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v2.3.1
+
+      - name: 'Use Node.js 10.x'
+        uses: actions/setup-node@v2.1.1
+        with:
+          node-version: 10.x
+      - name: 'install latest pnpm'
+        run: npm i -g pnpm
+      - name: Install Dependencies
+        run: yarn install --pure-lockfile
+      - name: 'Run verdaccio in the background'
+        run: |
+          nohup node ./scripts/run-verdaccio.js &
+      - name: 'Ping to verdaccio'
+        run: |
+          pnpm ping --registry http://localhost:4873
+      - name: 'Running the integration test'
+        run: |
+          source scripts/e2e-setup-ci.sh
+          pnpm init --force
+          pnpm install jest --registry http://localhost:4873
+
+          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
+          yarn jest pass.test.js
+
+          yarn add left-pad --registry http://localhost:4873 --verbose
+          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
+          yarn jest module.test.js

.github/disabled/registry.yml

@@ -0,0 +1,13 @@
+name: Test local registry for js vulnerabilities
+
+on:
+  schedule:
+    - cron: '0 4 * * 4'
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Test for public javascript library vulnerabilities
+        uses: lirantal/is-website-vulnerable@1.15.10
+        with:
+          scan-url: 'https://registry.verdaccio.org'

.github/disabled/release-canary.yml

@@ -0,0 +1,35 @@
+name: Canary Release to Verdaccio
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/release-canary.yml
+      - 'packages/**'
+      - 'package.json'
+      - 'lerna.json'
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Use Node (latest)
+        uses: actions/setup-node@v1
+        with:
+          node_version: 13
+      - name: Install
+        run: yarn --frozen-lockfile
+      - name: Clean
+        run: yarn clean
+      - name: Lint
+        run: yarn lint
+      - name: Build
+        run: yarn build
+      - name: Test
+        run: yarn test
+      - name: Publish
+        run: |
+          echo "//registry.verdaccio.org/:_authToken=${{ secrets.VERDACCIO_TOKEN }}" > .npmrc
+          git update-index --assume-unchanged .npmrc
+          yarn publish:canary

.github/lock.yml

@@ -0,0 +1,35 @@
+# Configuration for lock-threads - https://github.com/dessant/lock-threads
+
+# Number of days of inactivity before a closed issue or pull request is locked
+daysUntilLock: 90
+
+# Issues and pull requests with these labels will not be locked. Set to `[]` to disable
+exemptLabels: []
+
+# Label to add before locking, such as `outdated`. Set to `false` to disable
+lockLabel: false
+
+# Comment to post before locking. Set to `false` to disable
+lockComment: >
+  🤖This thread has been automatically locked 🔒 since there has not been
+  any recent activity after it was closed. 
+
+  We lock tickets after 90 days with the idea to encourage you to open a ticket with new fresh data 
+  and to provide you better feedback 🤝and better visibility 👀. 
+
+  If you consider, you can attach this ticket 📨 to the new one as a reference for better context.
+
+  Thanks for being a part of the Verdaccio community! 💘
+
+# Limit to only `issues` or `pulls`
+# only: issues
+
+# Optionally, specify configuration settings just for `issues` or `pulls`
+issues:
+  exemptLabels:
+    - help-wanted
+  lockLabel: outdated
+
+pulls:
+  daysUntilLock: 90
+  lockLabel: outdated

.github/stale.yml

@@ -0,0 +1,26 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 365
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 500
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - dev: high priority
+  - topic: feature request
+  - issue: need verification
+  - issue: bug
+  - dev: discuss
+# Label to use when marking an issue as stale
+staleLabel: 'issue: wontfix'
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  Hi pal 👋🏼!
+
+  This issue has gone quiet 😶.
+
+   We get a lot of issues, so we currently close issues after 180 days of inactivity. It’s been at least 90c days since the last update here.
+   If we missed this issue or if you want to keep it open, please reply here. You can also add/suggest the label "discuss" to keep this issue open!
+   As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out [https://github.com/verdaccio/contributing](https://github.com/verdaccio/contributing) for more information about opening PRs, triaging issues, and contributing!
+
+   Thanks for being a part of the Verdaccio community! 💘
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false

.github/workflows/benchmark.yml

@@ -0,0 +1,174 @@
+---
+name: ci - benchmark
+
+on:
+  workflow_dispatch:
+  schedule:
+    # 1 time peer week
+    # collecting enough data to draw some graphics
+    - cron: '0 1 * * 1'
+  # push:
+  #   branches:
+  #     - master
+permissions:
+  contents: read
+
+jobs:
+  prepare: 
+    name: Prepare build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: install pnpm
+        run: sudo npm i pnpm@latest-6 -g
+      - name: set store
+        run: | 
+          mkdir ~/.pnpm-store
+          pnpm config set store-dir ~/.pnpm-store     
+      - name: setup pnpm config registry
+        run: pnpm config set registry https://registry.verdaccio.org
+      - name: install dependencies
+        run: pnpm install
+      - name: Cache .pnpm-store
+        uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-              
+      - name: build
+        run: pnpm build
+      - name: tar packages
+        run: |      
+          tar -czvf ${{ github.workspace }}/pkg.tar.gz -C ${{ github.workspace }}/packages .
+      - uses: actions/upload-artifact@v3
+        with:
+          name: verdaccio-artifact
+          path: pkg.tar.gz
+  benchmark-autocannon:
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        benchmark:
+          - info
+          - tarball
+        verdaccioVersion:
+          # - local
+          - 3.13.1
+          - 4.12.2
+          - 5.10.2
+          - 6.0.0-6-next.40
+    name: Benchmark autocannon
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - uses: actions/download-artifact@v3
+        with:
+          name: verdaccio-artifact
+      - name: untar packages
+        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages          
+      - name: install pnpm
+        # require fixed version
+        run: sudo npm i pnpm@latest-6 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}   
+      - name: install dependencies
+        run: pnpm install    
+      - name: start registry
+        run: ./scripts/benchmark-prepare.sh ${{matrix.verdaccioVersion}}        
+      - name: benchmark        
+        run: pnpm benchmark:api -- -v ${{matrix.verdaccioVersion}} -f ${{matrix.benchmark}}       
+        shell: bash
+        env:
+          DEBUG: metrics*
+      - uses: actions/upload-artifact@v3
+        with:
+          name: verdaccio-metrics-api
+          path: ./api-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json  
+          if-no-files-found: error
+          retention-days: 10 
+      - name: submit metrics
+        run: pnpm benchmark:submit
+        env:
+          DEBUG: metrics
+          METRICS_SOURCE: autocannon
+          METRICS_URL: ${{ secrets.METRICS_URL }}
+          METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
+          METRICS_BENCHMARK: ${{matrix.benchmark}}
+          METRICS_VERSION: ${{matrix.verdaccioVersion}}
+          METRICS_COMMIT_HASH: ${{ github.sha }}
+          METRICS_FILE_NAME: 'api-results'   
+  benchmark:
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        benchmark:
+          - info
+          - tarball
+        verdaccioVersion:
+          # future 6.x (wip)
+          # - local (master branch)
+          # old versions to compare same test along previous releases
+          - 3.13.1
+          - 4.12.2
+          - 5.10.2
+          - 6.0.0-6-next.40
+    name: Benchmark hyperfine
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - uses: actions/download-artifact@v3
+        with:
+          name: verdaccio-artifact
+      - name: untar packages
+        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages          
+      - name: install pnpm
+        # require fixed version
+        run: sudo npm i pnpm@latest-6 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}   
+      - name: install dependencies
+        run: pnpm install
+      - name: install hyperfine
+        run: |
+          wget https://github.com/sharkdp/hyperfine/releases/download/v1.11.0/hyperfine_1.11.0_amd64.deb
+          sudo dpkg -i hyperfine_1.11.0_amd64.deb
+      - name: start registry
+        run: ./scripts/benchmark-prepare.sh ${{matrix.verdaccioVersion}}
+      - name: benchmark        
+        run: ./scripts/benchmark-run.sh ${{matrix.benchmark}}
+        # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
+        shell: bash
+      - name: rename
+        run: mv ./hyper-results.json ./hyper-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json
+      - uses: actions/upload-artifact@v3
+        with:
+          name: verdaccio-metrics
+          path: ./hyper-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json  
+          if-no-files-found: error
+          retention-days: 10 
+      - name: submit metrics
+        run: pnpm benchmark:submit
+        env:
+          DEBUG: metrics
+          METRICS_SOURCE: hyperfine
+          METRICS_URL: ${{ secrets.METRICS_URL }}
+          METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
+          METRICS_BENCHMARK: ${{matrix.benchmark}}
+          METRICS_VERSION: ${{matrix.verdaccioVersion}}
+          METRICS_COMMIT_HASH: ${{ github.sha }}

.github/workflows/changesets.yml

@@ -0,0 +1,69 @@
+name: Changesets
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+
+  push:
+    branches:
+      - master
+
+env:
+  CI: true
+  PNPM_CACHE_FOLDER: .pnpm-store
+
+jobs:
+  # Update package versions from changesets.
+  version:
+    timeout-minutes: 14
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio'
+    steps:
+      - name: checkout code repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: setup node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: 14
+          registry-url: 'https://registry.npmjs.org'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
+
+      - name: install pnpm
+        run: npm i pnpm@6.32.15 -g
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
+
+      - name: setup pnpm config
+        run: pnpm config set store-dir $PNPM_CACHE_FOLDER
+      - name: setup pnpm config registry
+        run: pnpm config set registry https://registry.npmjs.org
+
+      - name: install dependencies
+        run: pnpm install
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
+      - name: crowdin download
+        env:
+          CROWDIN_VERDACCIO_PROJECT_ID: ${{ secrets.CROWDIN_VERDACCIO_PROJECT_ID }}
+          CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
+          CONTEXT: production
+        run: pnpm crowdin:download       
+      - name: build
+        run: pnpm build
+
+      - name: create versions
+        uses: verdaccio/changeset-action@master
+        with:
+          version: pnpm ci:version
+          commit: 'chore: update versions'
+          title: 'chore: update versions'
+          publish: pnpm ci:publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org

.github/workflows/ci.yml

@@ -0,0 +1,197 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+      - 'changeset-release/master'
+  pull_request:
+    paths:
+      - .changeset/**
+      - .github/workflows/ci.yml
+      - 'packages/**'
+      - 'docker-examples/**'
+      - 'jest/**'
+      - 'package.json'
+      - 'pnpm-workspace.yaml'
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    name: setup verdaccio
+    services:
+      verdaccio:
+        image: verdaccio/verdaccio:nightly-master
+        ports:
+          - 4873:4873
+    steps:
+    - uses: actions/checkout@v3
+    - name: Use Node 16
+      uses: actions/setup-node@v3
+      with:
+        node-version: 16
+    - name: Install pnpm
+      run: npm i pnpm@6.32.15 -g
+    - name: set store
+      run: |
+        mkdir ~/.pnpm-store
+        pnpm config set store-dir ~/.pnpm-store
+    - name: Install
+      run: pnpm recursive install --frozen-lockfile --registry http://localhost:4873
+    - name: Cache .pnpm-store
+      uses: actions/cache@v3
+      with:
+        path: ~/.pnpm-store
+        key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          pnpm-
+  lint:
+    runs-on: ubuntu-latest
+    name: Lint
+    needs: prepare
+    steps:
+      - uses: actions/checkout@v3
+      - name: Use Node 16
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: Install pnpm
+        run: npm i pnpm@6.32.15 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+      - name: Install
+        run: pnpm recursive install --frozen-lockfile --ignore-scripts
+      - name: Lint
+        run: pnpm lint
+  format:
+    runs-on: ubuntu-latest
+    name: Format
+    needs: prepare
+    steps:
+      - uses: actions/checkout@v3
+      - name: Use Node 16
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: Install pnpm
+        run: npm i pnpm@6.32.15 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+      - name: Install
+        run: pnpm recursive install --frozen-lockfile --ignore-scripts
+      - name: Lint
+        run: pnpm format:check
+  build:
+    needs: [format, lint]
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        ## Node 16 breaks UI test, jest issue
+        node_version: [16, 17]
+    name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Use Node ${{ matrix.node_version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node_version }}
+      - name: Install pnpm
+        run: npm i pnpm@6.32.15 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+      - name: Install
+        run: pnpm recursive install --frozen-lockfile --ignore-scripts
+      - name: build
+        run: pnpm build
+      - name: Test
+        run: pnpm test
+  ci-e2e-ui:
+    needs: [format, lint]
+    runs-on: ubuntu-latest
+    name: UI Test E2E Node 16
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: Install pnpm
+        run: npm i pnpm@6.32.15 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+      - name: Install
+        ## we need scripts, pupetter downloads aditional content
+        run: pnpm recursive install --frozen-lockfile
+      - name: build
+        run: pnpm build
+      - name: Test UI
+        run: pnpm test:e2e:ui
+        # env:
+        #  DEBUG: verdaccio:e2e*
+  # FIXME verify why fails on Node 16 (locally works fine) 
+  # ci-e2e-cli:
+  #   needs: [format, lint]
+  #   runs-on: ubuntu-latest
+  #   # TODO: fails on migrate to node 16, we need to check why
+  #   name: CLI Test E2E Node 16
+  #   steps:
+  #     - uses: actions/checkout@v3
+  #     - uses: actions/setup-node@v3
+  #       with:
+  #         node-version: 16
+  #     - name: Install pnpm
+  #       run: npm i pnpm@latest -g
+  #     - uses: actions/cache@v3
+  #       with:
+  #         path: ~/.pnpm-store
+  #         key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+  #     - name: Install
+  #       ## we need scripts, pupetter downloads aditional content
+  #       run: pnpm recursive install --frozen-lockfile
+  #     - name: build
+  #       run: pnpm build
+  #     - name: Test CLI
+  #       run: pnpm test:e2e:cli
+  #       env:
+  #         DEBUG: verdaccio*
+  sync-translations:
+    # needs: [ci-e2e-cli, ci-e2e-ui]
+    needs: [ci-e2e-ui]
+    runs-on: ubuntu-latest
+    name: synchronize translations
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: Install pnpm
+        run: npm i pnpm@6.32.15 -g
+      - uses: actions/cache@v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+      - name: Install
+        ## we need scripts, pupetter downloads aditional content
+        run: pnpm recursive install --frozen-lockfile
+      - name: build
+        run: pnpm build
+      - name: generate website translations
+        run: pnpm write-translations --filter ...@verdaccio/website
+      - name: sync
+        env:
+          CROWDIN_VERDACCIO_PROJECT_ID: ${{ secrets.CROWDIN_VERDACCIO_PROJECT_ID }}
+          CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
+          CONTEXT: production
+        run: pnpm crowdin:sync

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,59 @@
+name: 'Code scanning - action'
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/codeql-analysis.yml
+      - 'packages/**'
+  schedule:
+    - cron: '0 2 * * 4'
+
+permissions:
+  contents: read
+
+jobs:
+  CodeQL-Build:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          # We must fetch at least the immediate parents so that if this is
+          # a pull request then we can checkout the head.
+          fetch-depth: 2
+
+      # If this run was triggered by a pull request event, then checkout
+      # the head of the pull request instead of the merge commit.
+      - run: git checkout HEAD^2
+        if: ${{ github.event_name == 'pull_request' }}
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+
+      # Override language selection by uncommenting this and choosing your languages
+      # with:
+      #   languages: go, javascript, csharp, python, cpp, java
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/contributors.yml

@@ -0,0 +1,48 @@
+---
+name: contributors
+
+on:
+  workflow_dispatch:
+  schedule:
+    # twice peer week
+    - cron: '0 0 * * 1,4'
+  # for now, scheduled, we can enable on push master but not make much sense now
+  # push:
+  #   branches:
+  #     - master
+jobs:
+  prepare:
+    name: Run script
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 17.x
+      - name: install pnpm
+        run: sudo npm i pnpm@latest-6 -g
+      - name: set store
+        run: | 
+          mkdir ~/.pnpm-store
+          pnpm config set store-dir ~/.pnpm-store
+      - name: setup pnpm config registry
+        run: pnpm config set registry https://registry.verdaccio.org
+      - name: install dependencies
+        run: pnpm install
+      - name: update contributors
+        run: pnpm run contributors
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: format
+        run: pnpm format
+      - name: Commit & Push changes
+        uses: actions-js/push@v1.3
+        with:
+          github_token: ${{ secrets.TOKEN_VERDACCIOBOT_GITHUB }}
+          message: "chore: updated contributors list"
+          branch: master
+          author_email: verdaccio.npm@gmail.com
+          author_name: verdacciobot

.github/workflows/docker-publish.yml

@@ -0,0 +1,51 @@
+name: Docker publish to docker.io
+
+on:
+  push:
+    paths:
+      - .github/workflows/docker-publish.yml
+      - .github/workflows/docker-publish.yml
+      - 'packages/**'
+      - 'docker-bin/**'
+      - 'package.json'
+      - 'pnpm-*.yaml'
+      - 'Dockerfile'
+      - '.dockerignore'
+    branches:
+      - 'master'
+    tags:
+      - 'v*'
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: docker/setup-qemu-action@v1
+      - uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: network=host
+      - uses: docker/login-action@v1
+        name: Login Docker Hub
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Prepare docker image tags
+        id: docker_meta
+        uses: crazy-max/ghaction-docker-meta@v1
+        with:
+          images: ${{ github.repository }}
+          tag-custom: nightly-master
+          tag-custom-only: ${{ github.ref == 'refs/heads/master' }}
+          tag-semver: |
+            {{version}}
+            {{major}}
+            {{major}}.{{minor}}
+      - name: Build & Push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/website.yml

@@ -0,0 +1,136 @@
+name: Verdaccio Website CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - 'master'
+    paths:
+      - 'website/**'
+      - 'package.json'
+      - './.github/workflows/website.yml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: --max_old_space_size=4096
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Use Node 16
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16
+
+      - name: Cache pnpm modules
+        uses: actions/cache@v3
+        env:
+          cache-name: cache-pnpm-modules
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-
+
+      - uses: pnpm/action-setup@v2.2.2
+        with:
+          version: 6.32.15
+          run_install: |
+            - recursive: true
+              args: [--frozen-lockfile]
+      - name: Build Plugins
+        run: pnpm build --filter "docusaurus-plugin-contributors"
+      - name: Cache Docusaurus Build
+        uses: actions/cache@v3
+        with:
+          path: website/node_modules/.cache/webpack
+          key: cache/webpack-${{github.ref}}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: cache/webpack-${{github.ref}}
+
+      # Will deploy to production on:
+        # 1st: When a push occurs on master branch
+        # 2nd: When we force the worflow dispatch through the UI
+      - name: Build Production
+        if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
+        env:
+          CROWDIN_VERDACCIO_PROJECT_ID: ${{ secrets.CROWDIN_VERDACCIO_PROJECT_ID }}
+          CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
+          CONTEXT: production
+        run: pnpm netlify:build:production --filter ...@verdaccio/website
+
+      - name: 🔥 Deploy Production Netlify
+        if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
+        uses: semoal/action-netlify-deploy@master
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          netlify-site-id: ${{ secrets.NETLIFY_SITE_ID }}
+          build-dir: './website/build'
+
+      # Will deploy to Preview URL, only when a pull request is open with changes on the website
+      - name: Build Deployment Preview
+        env:
+          CONTEXT: deploy-preview
+        run: pnpm netlify:build:deployPreview --filter ...@verdaccio/website
+
+      - name: 🤖 Deploy Preview Netlify
+        if: github.repository == 'verdaccio/verdaccio'
+        uses: semoal/action-netlify-deploy@master
+        id: netlify_preview
+        with:
+          draft: true
+          comment-on-pull-request: true
+          github-deployment-is-production: false
+          github-deployment-is-transient: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          netlify-site-id: ${{ secrets.NETLIFY_SITE_ID }}
+          build-dir: './website/build'
+
+      - name: Audit preview URL with Lighthouse
+        if: github.repository == 'verdaccio/verdaccio'
+        id: lighthouse_audit
+        uses: treosh/lighthouse-ci-action@9.3.0
+        with:
+          urls: |
+            ${{ steps.netlify_preview.outputs.preview-url }}
+          uploadArtifacts: true
+          temporaryPublicStorage: true
+
+      - name: Format lighthouse score
+        id: format_lighthouse_score
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const result = ${{ steps.lighthouse_audit.outputs.manifest }}[0].summary
+            const links = ${{ steps.lighthouse_audit.outputs.links }}
+            const formatResult = (res) => Math.round((res * 100))
+            Object.keys(result).forEach(key => result[key] = formatResult(result[key]))
+            const score = res => res >= 90 ? '🟢' : res >= 50 ? '🟠' : '🔴'
+            const comment = [
+                `⚡️ [Lighthouse report](${Object.values(links)[0]}) for the changes in this PR:`,
+                '| Category | Score |',
+                '| --- | --- |',
+                `| ${score(result.performance)} Performance | ${result.performance} |`,
+                `| ${score(result.accessibility)} Accessibility | ${result.accessibility} |`,
+                `| ${score(result['best-practices'])} Best practices | ${result['best-practices']} |`,
+                `| ${score(result.seo)} SEO | ${result.seo} |`,
+                ' ',
+                `*Lighthouse ran on [${Object.keys(links)[0]}](${Object.keys(links)[0]})*`
+            ].join('\n')
+             core.setOutput("comment", comment);
+
+      - name: Add comment to PR
+        if: github.repository == 'verdaccio/verdaccio'
+        id: comment_to_pr
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          number: ${{ github.event.issue.number }}
+          delete: true
+          header: lighthouse
+          message: |
+            ${{ steps.format_lighthouse_score.outputs.comment }}

.gitignore

@@ -0,0 +1,52 @@
+*.log*
+verdaccio-*.tgz
+.DS_Store
+build/
+dist/
+.eslintcache
+node_modules
+
+### database
+.verdaccio-db.json
+.sinopia-db.json
+
+### test
+test-storage*
+.verdaccio_test_env
+
+# docker examples
+docker-examples/v5/reverse_proxy/nginx/relative_path/storage/*
+docker-examples/v5/**/storage/*
+
+# jest
+reports/
+coverage/
+
+## IDE
+.idea/
+
+# Compiled script
+packages/partials
+tsconfig.tsbuildinfo
+
+## bundle files
+packages/standalone/dist/
+
+## ui
+packages/plugins/ui-theme/static
+/packages/plugins/ui-theme/src/i18n/download_translations/
+!/packages/plugins/ui-theme/src/i18n/crowdin/ui.json
+
+
+# CI Pnpm cache
+.pnpm-store/
+
+# benchmark
+api-results.json
+hyper-results.json
+hyper-results*.json
+api-results*.json
+
+#docs 
+./api
+packages/core/core/docs