chore: update versions (6-next) (#3611)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.changeset/big-years-repair.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/middleware': minor
+'@verdaccio/utils': minor
+'@verdaccio/web': minor
+---
+
+feat: expose middleware utils

.changeset/brave-seahorses-press.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+fix: markdown ul and img styles

.changeset/chatty-pillows-perform.md

@@ -0,0 +1,18 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/config': minor
+'@verdaccio/core': minor
+'@verdaccio/file-locking': minor
+'@verdaccio/tarball': minor
+'@verdaccio/types': minor
+'@verdaccio/url': minor
+'@verdaccio/hooks': minor
+'@verdaccio/loaders': minor
+'@verdaccio/logger': minor
+'@verdaccio/logger-prettify': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/utils': minor
+'verdaccio': minor
+---
+
+feat: improve support for fs promises older nodejs

.changeset/eight-bottles-own.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/middleware': patch
+'@verdaccio/server': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/local-publish': patch
+---
+
+fix: extract logger from middleware

.changeset/famous-bikes-kneel.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+chore: improve info regarding using private registries

.changeset/fifty-stingrays-fold.md

@@ -0,0 +1,25 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/auth': minor
+'@verdaccio/cli': minor
+'@verdaccio/types': minor
+'@verdaccio/hooks': minor
+'@verdaccio/loaders': minor
+'@verdaccio/middleware': minor
+'@verdaccio/node-api': minor
+'verdaccio-audit': minor
+'verdaccio-auth-memory': minor
+'verdaccio-htpasswd': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/proxy': minor
+'@verdaccio/server': minor
+'@verdaccio/server-fastify': minor
+'@verdaccio/store': minor
+'verdaccio': minor
+'@verdaccio/web': minor
+'@verdaccio/logger': minor
+'@verdaccio/logger-7': minor
+'@verdaccio/logger-commons': minor
+---
+
+feat: refactor logger

.changeset/fluffy-papayas-lay.md

@@ -0,0 +1,10 @@
+---
+'@verdaccio/config': patch
+'@verdaccio/core': patch
+'@verdaccio/tarball': patch
+'@verdaccio/url': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+---
+
+fix: build targets for 5x modules

.changeset/forty-students-refuse.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/logger-7': patch
+---
+
+bump up @verdaccio/logger-7

.changeset/four-ways-try.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': minor
+---
+
+feat: upgrade to react 18

.changeset/giant-years-trade.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/test-cli-commons': minor
+'@verdaccio/config': minor
+---
+
+chore: rollback yaml dep support old nodejs versions

.changeset/light-pumas-brake.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/ui-theme': minor
+'@verdaccio/server-fastify': minor
+'@verdaccio/web': minor
+---
+
+feat: parse and sanitize on ui

.changeset/orange-cows-pull.md

@@ -0,0 +1,27 @@
+---
+'@verdaccio/types': major
+'@verdaccio/ui-theme': major
+'@verdaccio/ui-components': major
+---
+
+feat(web): components for custom user interfaces
+
+Provides a package that includes all components from the user interface, instead being embedded at the `@verdaccio/ui-theme` package.
+
+```
+npm i -D @verdaccio/ui-components
+```
+
+The package contains
+
+- Components
+- Providers
+- Redux Storage
+- Layouts (precomposed layouts ready to use)
+- Custom Material Theme
+
+The `@verdaccio/ui-theme` will consume this package and will use only those are need it.
+
+> Prerequisites are using Redux, Material-UI and Translations with `i18next`.
+
+Users could have their own Material UI theme and build custom layouts, adding new features without the need to modify the default project.

.changeset/pre.json

@@ -9,7 +9,6 @@
     "@verdaccio/file-locking": "11.0.0-alpha.0",
     "verdaccio-htpasswd": "11.0.0-alpha.0",
     "@verdaccio/local-storage": "11.0.0-alpha.0",
-    "@verdaccio/readme": "11.0.0-alpha.0",
     "@verdaccio/types": "11.0.0-alpha.0",
     "@verdaccio/hooks": "6.0.0-alpha.0",
     "@verdaccio/loaders": "6.0.0-alpha.0",
@@ -34,9 +33,9 @@
     "@verdaccio/cli-standalone": "6.0.0-alpha.3",
     "@verdaccio/tarball": "11.0.0-alpha.3",
     "@verdaccio/url": "11.0.0-alpha.3",
+    "@verdaccio/ui-components": "2.0.0-alpha.0",
     "@verdaccio/server-fastify": "6.0.0-6-next.9",
-    "@verdaccio/eslint-config": "1.0.0",
-    "@verdaccio/benchmark": "1.0.0",
+    "@verdaccio/eslint-config": "2.0.0-alpha.0",
     "@verdaccio/core": "6.0.0-next.0",
     "@verdaccio/test-helper": "1.0.0",
     "docusaurus-plugin-contributors": "1.0.0",
@@ -55,33 +54,45 @@
     "@verdaccio/e2e-cli-npm9": "1.0.1-6-next.5",
     "@verdaccio/e2e-ui": "2.0.0-6-next.3",
     "customprefix-auth": "0.0.1",
-    "@verdaccio/crowdin-translations": "1.0.0"
+    "@verdaccio/crowdin-translations": "1.0.0",
+    "@verdaccio/logger-7": "6.0.0-6-next.1",
+    "@verdaccio/logger-commons": "6.0.0-6-next.25"
   },
   "changesets": [
     "afraid-mice-obey",
     "angry-nails-appear",
     "big-lobsters-sin",
+    "big-years-repair",
+    "brave-seahorses-press",
     "bright-poems-obey",
     "brown-cycles-laugh",
     "brown-pandas-wink",
     "calm-pants-impress",
+    "chatty-pillows-perform",
     "chilled-ways-fetch",
     "chilly-glasses-occur",
     "clever-pugs-warn",
     "dry-planes-tap",
     "dull-monkeys-search",
     "early-jokes-nail",
+    "eight-bottles-own",
     "eleven-brooms-hunt",
     "eleven-spoons-matter",
     "fair-lemons-beam",
+    "famous-bikes-kneel",
     "famous-tigers-doubt",
     "few-cooks-destroy",
     "few-mangos-grow",
     "fifty-jars-rest",
+    "fifty-stingrays-fold",
+    "fluffy-papayas-lay",
+    "forty-students-refuse",
+    "four-ways-try",
     "fuzzy-drinks-taste",
     "fuzzy-onions-draw",
     "gentle-parrots-lay",
     "gentle-trains-switch",
+    "giant-years-trade",
     "gold-vans-tease",
     "green-yaks-divide",
     "healthy-bikes-behave",
@@ -92,6 +103,7 @@
     "kind-bears-nail",
     "late-adults-love",
     "late-parents-act",
+    "light-pumas-brake",
     "light-walls-begin",
     "little-stingrays-rule",
     "loud-shoes-jog",
@@ -103,6 +115,7 @@
     "neat-toes-report",
     "neat-toys-float",
     "olive-candles-speak",
+    "orange-cows-pull",
     "orange-flowers-cover",
     "perfect-candles-clap",
     "perfect-emus-clean",
@@ -129,19 +142,23 @@
     "sour-buses-shout",
     "sour-maps-live",
     "spicy-frogs-press",
+    "spicy-radios-remain",
     "spicy-snakes-sip",
     "strange-ladybugs-nail",
     "swift-pumpkins-knock",
     "ten-parents-breathe",
     "tender-bags-call",
     "thick-countries-move",
+    "thick-geese-wash",
     "thick-readers-hang",
     "three-moles-drop",
     "three-pots-sit",
     "tiny-seals-join",
     "tricky-taxis-watch",
+    "twelve-crabs-guess",
     "two-dolls-check",
     "unlucky-hairs-wonder",
+    "weak-mangos-taste",
     "wild-jokes-beam",
     "witty-ties-speak"
   ]

.changeset/spicy-radios-remain.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/logger': patch
+'@verdaccio/logger-7': patch
+'@verdaccio/logger-commons': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/middleware': patch
+---
+
+bump logger packages

.changeset/thick-geese-wash.md

@@ -0,0 +1,21 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/auth': minor
+'@verdaccio/config': minor
+'@verdaccio/core': minor
+'@verdaccio/url': minor
+'@verdaccio/middleware': minor
+'@verdaccio/local-storage': minor
+'@verdaccio/web': minor
+---
+
+chore: move improvements from v5 to v6
+
+Migrate improvements form v5 to v6:
+
+- https://github.com/verdaccio/verdaccio/pull/3158
+- https://github.com/verdaccio/verdaccio/pull/3151
+- https://github.com/verdaccio/verdaccio/pull/2271
+- https://github.com/verdaccio/verdaccio/pull/2787
+- https://github.com/verdaccio/verdaccio/pull/2791
+- https://github.com/verdaccio/verdaccio/pull/2205

.changeset/twelve-crabs-guess.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+chore: bumb up package

.changeset/weak-mangos-taste.md

@@ -0,0 +1,15 @@
+---
+'@verdaccio/api': minor
+'@verdaccio/config': minor
+'@verdaccio/types': minor
+'@verdaccio/hooks': minor
+'@verdaccio/middleware': minor
+'verdaccio-audit': minor
+'@verdaccio/proxy': minor
+'@verdaccio/server': minor
+'@verdaccio/store': minor
+'@verdaccio/web': minor
+'@verdaccio/ui-theme': minor
+---
+
+refactor: render html middleware

.eslintignore

@@ -14,3 +14,7 @@ test/functional/store/*
 docker-examples/**/lib/**/*.js
 test/cli/e2e-yarn4/bin/yarn-4.0.0-rc.14.cjs
 yarn.js
+# storybook
+packages/ui-components/storybook-static
+dist.js
+bundle.js

.github/workflows/benchmark.yml

@@ -1,174 +0,0 @@
----
-name: ci - benchmark
-
-on:
-  workflow_dispatch:
-  schedule:
-    # 1 time peer week
-    # collecting enough data to draw some graphics
-    - cron: '0 1 * * 1'
-  # push:
-  #   branches:
-  #     - master
-permissions:
-  contents: read
-
-jobs:
-  prepare: 
-    name: Prepare build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
-        with:
-          node-version: 16.x
-      - name: install pnpm
-        run: sudo npm i pnpm@latest-6 -g
-      - name: set store
-        run: | 
-          mkdir ~/.pnpm-store
-          pnpm config set store-dir ~/.pnpm-store     
-      - name: setup pnpm config registry
-        run: pnpm config set registry https://registry.verdaccio.org
-      - name: install dependencies
-        run: pnpm install
-      - name: Cache .pnpm-store
-        uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-              
-      - name: build
-        run: pnpm build
-      - name: tar packages
-        run: |      
-          tar -czvf ${{ github.workspace }}/pkg.tar.gz -C ${{ github.workspace }}/packages .
-      - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
-        with:
-          name: verdaccio-artifact
-          path: pkg.tar.gz
-  benchmark-autocannon:
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        benchmark:
-          - info
-          - tarball
-        verdaccioVersion:
-          # - local
-          - 3.13.1
-          - 4.12.2
-          - 5.10.2
-          - 6.0.0-6-next.40
-    name: Benchmark autocannon
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
-        with:
-          node-version: 16.x
-      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v3
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages          
-      - name: install pnpm
-        # require fixed version
-        run: sudo npm i pnpm@latest-6 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}   
-      - name: install dependencies
-        run: pnpm install    
-      - name: start registry
-        run: ./scripts/benchmark-prepare.sh ${{matrix.verdaccioVersion}}        
-      - name: benchmark        
-        run: pnpm benchmark:api -- -v ${{matrix.verdaccioVersion}} -f ${{matrix.benchmark}}       
-        shell: bash
-        env:
-          DEBUG: metrics*
-      - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
-        with:
-          name: verdaccio-metrics-api
-          path: ./api-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json  
-          if-no-files-found: error
-          retention-days: 10 
-      - name: submit metrics
-        run: pnpm benchmark:submit
-        env:
-          DEBUG: metrics
-          METRICS_SOURCE: autocannon
-          METRICS_URL: ${{ secrets.METRICS_URL }}
-          METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
-          METRICS_BENCHMARK: ${{matrix.benchmark}}
-          METRICS_VERSION: ${{matrix.verdaccioVersion}}
-          METRICS_COMMIT_HASH: ${{ github.sha }}
-          METRICS_FILE_NAME: 'api-results'   
-  benchmark:
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        benchmark:
-          - info
-          - tarball
-        verdaccioVersion:
-          # future 6.x (wip)
-          # - local (master branch)
-          # old versions to compare same test along previous releases
-          - 3.13.1
-          - 4.12.2
-          - 5.10.2
-          - 6.0.0-6-next.40
-    name: Benchmark hyperfine
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
-        with:
-          node-version: 16.x
-      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v3
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages          
-      - name: install pnpm
-        # require fixed version
-        run: sudo npm i pnpm@latest-6 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}   
-      - name: install dependencies
-        run: pnpm install
-      - name: install hyperfine
-        run: |
-          wget https://github.com/sharkdp/hyperfine/releases/download/v1.11.0/hyperfine_1.11.0_amd64.deb
-          sudo dpkg -i hyperfine_1.11.0_amd64.deb
-      - name: start registry
-        run: ./scripts/benchmark-prepare.sh ${{matrix.verdaccioVersion}}
-      - name: benchmark        
-        run: ./scripts/benchmark-run.sh ${{matrix.benchmark}}
-        # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
-        shell: bash
-      - name: rename
-        run: mv ./hyper-results.json ./hyper-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json
-      - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
-        with:
-          name: verdaccio-metrics
-          path: ./hyper-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json  
-          if-no-files-found: error
-          retention-days: 10 
-      - name: submit metrics
-        run: pnpm benchmark:submit
-        env:
-          DEBUG: metrics
-          METRICS_SOURCE: hyperfine
-          METRICS_URL: ${{ secrets.METRICS_URL }}
-          METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
-          METRICS_BENCHMARK: ${{matrix.benchmark}}
-          METRICS_VERSION: ${{matrix.verdaccioVersion}}
-          METRICS_COMMIT_HASH: ${{ github.sha }}

.github/workflows/changesets.yml

@@ -20,12 +20,12 @@ jobs:
     if: github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio'
     steps:
       - name: checkout code repository
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
         with:
           fetch-depth: 0
 
       - name: setup node.js
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version: 14
           registry-url: 'https://registry.npmjs.org'

.github/workflows/ci-windows.yml

@@ -18,9 +18,9 @@ jobs:
         env:
           NODE_ENV: production          
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
     - name: Node
-      uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
       with:
         node-version-file: '.nvmrc'
     - name: Install pnpm
@@ -32,7 +32,7 @@ jobs:
     - name: Install
       run: pnpm recursive install --frozen-lockfile --registry http://localhost:4873
     - name: Cache .pnpm-store
-      uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
       with:
         path: ~/.pnpm-store
         key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -43,14 +43,14 @@ jobs:
     name: Lint
     needs: prepare
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Node
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -63,14 +63,14 @@ jobs:
     name: Format
     needs: prepare
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Use Node
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -88,14 +88,14 @@ jobs:
     name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version: ${{ matrix.node_version }}
       - name: Install pnpm
         run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -110,13 +110,13 @@ jobs:
     runs-on: windows-latest
     name: UI Test E2E
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/ci.yml

@@ -27,13 +27,15 @@ jobs:
         env:
           NODE_ENV: production          
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
     - name: Node
-      uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
       with:
         node-version-file: '.nvmrc'
     - name: Install pnpm
-      run: npm i pnpm@6.32.15 -g
+      run: |
+        corepack enable
+        corepack prepare --activate pnpm@6.32.15
     - name: set store
       run: |
         mkdir ~/.pnpm-store
@@ -41,7 +43,7 @@ jobs:
     - name: Install
       run: pnpm recursive install --frozen-lockfile --registry http://localhost:4873
     - name: Cache .pnpm-store
-      uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
       with:
         path: ~/.pnpm-store
         key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -52,14 +54,16 @@ jobs:
     name: Lint
     needs: prepare
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Node
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
-        run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        run: |
+          corepack enable
+          corepack prepare --activate pnpm@6.32.15
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -72,14 +76,16 @@ jobs:
     name: Format
     needs: prepare
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Use Node
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
-        run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        run: |
+          corepack enable
+          corepack prepare --activate pnpm@6.32.15
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -87,7 +93,7 @@ jobs:
         run: pnpm recursive install --offline --frozen-lockfile --reporter=silence --ignore-scripts
       - name: Lint
         run: pnpm format:check
-  build:
+  test:
     needs: [format, lint]
     strategy:
       fail-fast: true
@@ -97,14 +103,16 @@ jobs:
     name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version: ${{ matrix.node_version }}
       - name: Install pnpm
-        run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        run: |
+          corepack enable
+          corepack prepare --activate pnpm@6.32.15
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
@@ -114,42 +122,21 @@ jobs:
         run: pnpm build
       - name: Test
         run: pnpm test
-  ci-e2e-ui:
-    needs: [format, lint]
-    runs-on: ubuntu-latest
-    name: UI Test E2E
-    steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
-        with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: Install
-        run: pnpm recursive install --offline --frozen-lockfile --reporter=silence --registry http://localhost:4873
-      - name: build
-        run: pnpm build
-      - name: Test UI
-        run: pnpm test:e2e:ui
-        # env:
-        #  DEBUG: verdaccio:e2e*
   sync-translations:
-    needs: [ci-e2e-ui]
+    needs: [test]
     runs-on: ubuntu-latest
     name: synchronize translations
     if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
-        run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        run: |
+          corepack enable
+          corepack prepare --activate pnpm@6.32.15
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/codeql-analysis.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -34,7 +34,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2
+        uses: github/codeql-action/init@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # tag=v2
 
       # Override language selection by uncommenting this and choosing your languages
       # with:
@@ -42,7 +42,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2
+        uses: github/codeql-action/autobuild@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # tag=v2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -56,4 +56,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2
+        uses: github/codeql-action/analyze@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # tag=v2

.github/workflows/docker-publish.yml

@@ -15,12 +15,16 @@ on:
       - 'master'
     tags:
       - 'v*'
+
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # tag=v1
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
+      - uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # tag=v1
       - uses: docker/setup-buildx-action@v1
         with:
           driver-opts: network=host
@@ -41,7 +45,7 @@ jobs:
             {{major}}
             {{major}}.{{minor}}
       - name: Build & Push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ./Dockerfile

.github/workflows/e2e-ci.yml

@@ -15,9 +15,9 @@ jobs:
         env:
           NODE_ENV: production
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
     - name: Use Node
-      uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
       with:
         node-version-file: '.nvmrc'
     - name: Install pnpm
@@ -29,7 +29,7 @@ jobs:
     - name: Install
       run: pnpm recursive install --frozen-lockfile --reporter=silence --ignore-scripts --registry http://localhost:4873
     - name: Cache .pnpm-store
-      uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
       with:
         path: ~/.pnpm-store
         key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
@@ -39,14 +39,14 @@ jobs:
     needs: [prepare]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
       - name: Use Node 16
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
@@ -55,7 +55,7 @@ jobs:
       - name: build
         run: pnpm build
       - name: Cache packages
-        uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         id: cache-packages
         with:
           path: ./packages/
@@ -63,7 +63,7 @@ jobs:
           restore-keys: |
             packages-
       # - name: Cache test
-      #   uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      #   uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
       #   id: cache-test
       #   with:
       #     path: ./e2e/
@@ -75,27 +75,28 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        pkg: [npm6, npm7, npm8, npm9, pnpm6, pnpm7, yarn1, yarn2,  yarn3, yarn4]
-    name:  ${{ matrix.pkg }} / ${{ matrix.os }}
+        pkg: [npm6, npm7, npm8, npm9, pnpm6, pnpm7, yarn1, yarn2, yarn3, yarn4]
+        node: [16, 18, 19]
+    name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
-          node-version-file: '.nvmrc'
+          node-version: ${{ matrix.node }}
       - name: Install pnpm
         run: npm i pnpm@6.32.15 -g
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
       - name: Install
         run: pnpm recursive install --offline --frozen-lockfile --reporter=silence --ignore-scripts --registry http://localhost:4873
-      - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      - uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: ./packages/
           key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      # - uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+      # - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
       #   with:
       #     path: ./e2e/
       #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}

.github/workflows/e2e-ui.yml

@@ -0,0 +1,36 @@
+name: E2E UI
+
+on: [pull_request]
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    name: UI Test E2E
+    services:
+      verdaccio:
+        image: verdaccio/verdaccio:5
+        ports:
+          - 4873:4873
+        env:
+          NODE_ENV: production
+    steps:
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
+      - name: Use Node
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
+        with:
+          node-version-file: '.nvmrc'
+      - name: Install pnpm
+        run: |
+         corepack enable
+         corepack prepare --activate pnpm@6.32.15
+      - name: Install
+        run: pnpm install --frozen-lockfile --reporter=silence --registry http://localhost:4873
+      - name: build
+        run: pnpm build
+      - name: Test UI
+        run: pnpm test:e2e:ui
+      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3
+        with:
+          name: videos
+          path: /home/runner/work/verdaccio/verdaccio/e2e/ui/cypress/videos

.github/workflows/static-data.yml

@@ -10,16 +10,20 @@ on:
   # push:
   #   branches:
   #     - master
+
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   prepare:
     name: Run script
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version: 18.x
       - name: install pnpm
@@ -38,6 +42,8 @@ jobs:
         run: pnpm run contributors
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: update addson data
+        run: pnpm script:addson
       - name: update translations
         run: pnpm run translations
         env:
@@ -45,7 +51,7 @@ jobs:
       - name: format
         run: pnpm format
       - name: Commit & Push changes
-        uses: actions-js/push@a52398fac807b0c1e5f1492c969b477c8560a0ba # tag=v1.3
+        uses: actions-js/push@156f2b10c3aa000c44dbe75ea7018f32ae999772 # tag=v1.4
         with:
           github_token: ${{ secrets.TOKEN_VERDACCIOBOT_GITHUB }}
           message: "chore: updated static data"

.github/workflows/ui-components.yml

@@ -0,0 +1,78 @@
+name: UI Components
+
+on: 
+  workflow_dispatch:
+  pull_request:
+    paths:
+    - .github/workflows/ui-components.yml
+    - 'packages/ui-components/**'
+    - 'package.json'
+    - 'pnpm-workspace.yaml'
+    - 'pnpm-lock.yaml'
+
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
+env:
+  DEBUG: verdaccio*
+
+jobs:
+  deploy:
+    permissions:
+      contents: read  #  to fetch code (actions/checkout)
+      deployments: write
+      pull-requests: write  #  to comment on pull-requests
+
+    runs-on: ubuntu-latest
+    env:
+      NODE_OPTIONS: --max_old_space_size=4096
+    steps:
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
+
+      - name: Use Node
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Cache pnpm modules
+        uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
+        env:
+          cache-name: cache-pnpm-modules
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-
+
+      - name: Install pnpm
+        run: |
+          corepack enable
+            corepack prepare --activate pnpm@6.32.15
+      - name: Install
+        run: pnpm recursive install --frozen-lockfile  
+      - name: Build storybook
+        run: pnpm ui:storybook:build
+      - name: Copy public content
+        # the msw.js worker is need it at the storybook-static folder in production
+        run: cp -R packages/ui-components/public/* packages/ui-components/storybook-static
+      - name: 🔥 Deploy Production UI Netlify
+        if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
+        uses: verdaccio/action-netlify-deploy@v2.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          netlify-site-id: ${{ secrets.NETLIFY_UI_SITE_ID }}
+          build-dir: './packages/ui-components/storybook-static'          
+      - name: 🤖 Deploy Preview UI Components Netlify
+        if: github.repository == 'verdaccio/verdaccio'
+        uses: verdaccio/action-netlify-deploy@v2.0.0
+        id: netlify_preview_ui
+        with:
+          draft: true
+          comment-on-pull-request: true
+          github-deployment-is-production: false
+          github-deployment-is-transient: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          netlify-site-id: ${{ secrets.NETLIFY_UI_SITE_ID }}
+          build-dir: './packages/ui-components/storybook-static'

.github/workflows/website.yml

@@ -9,21 +9,29 @@ on:
   schedule:
     - cron: '0 0 * * *' 
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   build:
+    permissions:
+      contents: read  #  to fetch code (actions/checkout)
+      deployments: write
+      pull-requests: write  #  to comment on pull-requests
+
     runs-on: ubuntu-latest
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
 
       - name: Use Node 16
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # tag=v3
         with:
           node-version: 16
 
       - name: Cache pnpm modules
-        uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         env:
           cache-name: cache-pnpm-modules
         with:
@@ -43,7 +51,7 @@ jobs:
       - name: Build Translations percentage
         run: pnpm build --filter "@verdaccio/crowdin-translations"
       - name: Cache Docusaurus Build
-        uses: actions/cache@56461b9eb0f8438fd15c7a9968e3c9ebb18ceff1 # tag=v3
+        uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3
         with:
           path: website/node_modules/.cache/webpack
           key: cache/webpack-${{github.ref}}-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -92,7 +100,7 @@ jobs:
       - name: Audit preview URL with Lighthouse
         if: github.repository == 'verdaccio/verdaccio'
         id: lighthouse_audit
-        uses: treosh/lighthouse-ci-action@b4dfae3eb959c5226e2c5c6afd563d493188bfaf # tag=9.3.0
+        uses: treosh/lighthouse-ci-action@e0fe113967eee84b631d526ed18ce001f35fe9e9 # tag=9.3.1
         with:
           urls: |
             ${{ steps.netlify_preview.outputs.preview-url }}
@@ -101,7 +109,7 @@ jobs:
 
       - name: Format lighthouse score
         id: format_lighthouse_score
-        uses: actions/github-script@7dff1a87643417cf3b95bb10b29f4c4bc60d8ebd # tag=v6
+        uses: actions/github-script@98814c53be79b1d30f795b907e553d8679345975 # tag=v6
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -126,7 +134,7 @@ jobs:
       - name: Add comment to PR
         if: github.repository == 'verdaccio/verdaccio'
         id: comment_to_pr
-        uses: marocchino/sticky-pull-request-comment@39c5b5dc7717447d0cba270cd115037d32d28443 # tag=v2
+        uses: marocchino/sticky-pull-request-comment@3d60a5b2dae89d44e0c6ddc69dd7536aec2071cd # tag=v2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           number: ${{ github.event.issue.number }}

.gitignore

@@ -41,13 +41,6 @@ packages/plugins/ui-theme/static
 # CI Pnpm cache
 .pnpm-store/
 
-# benchmark
-api-results.json
-hyper-results.json
-hyper-results*.json
-api-results*.json
-.clinic/
-
 #docs 
 website/docs/api/**/*.md
 website/docs/api/**/*.yml
@@ -57,3 +50,6 @@ packages/**/docs
 # cypress
 e2e/ui/cypress/videos/**/*
 e2e/ui/cypress/screenshots/**/*
+
+# storybook
+packages/ui-components/storybook-static

.npmrc

@@ -1,5 +1,4 @@
 always-auth = true
 recursive-install = true
-registry = https://registry.verdaccio.org
 loglevel=info
 fetch-retries="10"

.prettierignore

@@ -8,13 +8,15 @@
 **/wrong.package.json
 crowdin.yaml
 /docs/website
-/website/*
 /website/translated_docs/
 CHANGELOG.md
 CONTRIBUTORS.md
 node_modules/
 **/coverage/**
 **/static/*.js
+**/dist/*.js
+website/.docusaurus/**/*
+website/i18n/**/*
 **/build/*.js
 packages/core/local-storage/_storage/**
 packages/partials/storage_default_storage/
@@ -33,3 +35,5 @@ packages/plugins/ui-theme/static/
 .verdaccio-db.json
 test/cli/e2e-yarn4/bin/yarn-4.0.0-rc.14.cjs
 yarn.js
+website/docs/api/*
+packages/ui-components/storybook-static/*

Dockerfile

@@ -6,8 +6,8 @@ ENV NODE_ENV=development \
 RUN apk --no-cache add openssl ca-certificates wget && \
     apk --no-cache add g++ gcc libgcc libstdc++ linux-headers make python3 && \
     wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \
-    wget -q https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.25-r0/glibc-2.25-r0.apk && \
-    apk add glibc-2.25-r0.apk
+    wget -q https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r0/glibc-2.35-r0.apk && \
+    apk add --force-overwrite glibc-2.35-r0.apk
 
 WORKDIR /opt/verdaccio-build
 COPY . .

docker-examples/v4/plugins/docker-extend/Dockerfile

@@ -4,7 +4,7 @@ USER root
 
 ENV NODE_ENV=production
 
-RUN npm i && npm install verdaccio-aws-s3-storage
+RUN npm i && npm -g install verdaccio-aws-s3-storage
 
 USER verdaccio
 

docker-examples/v5/plugins/docker-build-install-plugin/Dockerfile

@@ -1,25 +1,7 @@
-# Docs based on https://github.com/xlts-dev/verdaccio-prometheus-middleware#installation
-
-# Docker multi-stage build - https://docs.docker.com/develop/develop-images/multistage-build/
-# Use an alpine node image to install the plugin
-FROM node:lts-alpine as builder
-
-# Install the metrics middleware plugin
-# npm docs
-# --global-style https://docs.npmjs.com/cli/v7/commands/npm-install#global-style
-# --no-bin-links https://docs.npmjs.com/cli/v7/commands/npm-install#bin-links
-# --omit=optional 
-RUN mkdir -p /verdaccio/plugins \
-  && cd /verdaccio/plugins \
-  && npm install --global-style --no-bin-links --omit=optional verdaccio-auth-memory@latest
-
 # The final built image will be based on the standard Verdaccio docker image.
 FROM verdaccio/verdaccio:5
-
-# Copy the plugin files over from the 'builder' node image.
-# The `$VERDACCIO_USER_UID` env variable is defined in the base `verdaccio/verdaccio` image.
-# Refer to: https://github.com/verdaccio/verdaccio/blob/v5.2.0/Dockerfile#L32
 ADD docker.yaml /verdaccio/conf/config.yaml  
-COPY --chown=$VERDACCIO_USER_UID:root --from=builder \
-  /verdaccio/plugins/node_modules/verdaccio-auth-memory \
-  /verdaccio/plugins/verdaccio-auth-memory
+USER root
+RUN npm install --global verdaccio-static-token \
+  && npm install --global verdaccio-auth-memory
+USER $VERDACCIO_USER_UID

docker-examples/v5/plugins/docker-build-install-plugin/README.md

@@ -38,9 +38,11 @@ FROM verdaccio/verdaccio:5
 
 # copy your modified config.yaml into the image
 ADD docker.yaml /verdaccio/conf/config.yaml
-
-COPY --chown=$VERDACCIO_USER_UID:root --from=builder \
-  /verdaccio/plugins/node_modules/verdaccio-auth-memory \
-  /verdaccio/plugins/verdaccio-auth-memory
-
+# need it for install global plugins
+USER root
+# install plugins with npm global
+RUN npm install --global verdaccio-static-token \
+  && npm install --global verdaccio-auth-memory
+# back to original user
+USER $VERDACCIO_USER_UID
 ```

docker-examples/v5/plugins/docker-build-install-plugin/docker.yaml

@@ -176,6 +176,13 @@ server:
 middlewares:
   audit:
     enabled: true
+  static-token:
+    - token: mySecureToken
+      user: systemUser
+      password: systemPassword
+    - token: ABCD1234
+      user: uncle
+      password: tom
 
 # https://verdaccio.org/docs/logger
 # log settings

docker-examples/v6/plugins/docker-build-install-plugin/docker.yaml

@@ -176,6 +176,13 @@ server:
 middlewares:
   audit:
     enabled: true
+  static-token:
+    - token: mySecureToken
+      user: systemUser
+      password: systemPassword
+    - token: ABCD1234
+      user: uncle
+      password: tom
 
 # https://verdaccio.org/docs/logger
 # log settings

e2e/cli/README.md

@@ -20,6 +20,7 @@
 | ping      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ⛔    | ⛔    | ⛔    | ⛔    |
 | search    | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ⛔    | ⛔    | ⛔    | ⛔    |
 | star      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ⛔    | ⛔    | ⛔    | ⛔    |
+| stars     | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ⛔    | ⛔    | ⛔    | ⛔    |
 | dist-tag  | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ❌    | ❌    | ❌    |
 
 > notes:

e2e/cli/cli-commons/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/test-cli-commons
 
+## 1.1.0-6-next.6
+
+### Minor Changes
+
+- d167f92e: chore: rollback yaml dep support old nodejs versions
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/cli-commons/package.json

@@ -1,18 +1,18 @@
 {
   "private": true,
   "name": "@verdaccio/test-cli-commons",
-  "version": "1.0.1-6-next.5",
+  "version": "1.1.0-6-next.6",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "devDependencies": {
-    "verdaccio": "workspace:6.0.0-6-next.50",
-    "@verdaccio/core": "workspace:6.0.0-6-next.50",
-    "@verdaccio/config": "workspace:6.0.0-6-next.50",
-    "@verdaccio/types": "workspace:11.0.0-6-next.17",
-    "yaml": "2.1.3",
+    "verdaccio": "workspace:6.0.0-6-next.61",
+    "@verdaccio/core": "workspace:6.0.0-6-next.61",
+    "@verdaccio/config": "workspace:6.0.0-6-next.61",
+    "@verdaccio/types": "workspace:11.0.0-6-next.20",
+    "js-yaml": "4.1.0",
     "debug": "4.3.4",
     "fs-extra": "10.1.0",
-    "got": "11.8.5",
+    "got": "11.8.6",
     "lodash": "4.17.21"
   },
   "scripts": {

e2e/cli/cli-commons/src/yarn-modern-utils.ts

@@ -1,7 +1,7 @@
 import { cp, writeFile } from 'fs/promises';
+import YAML from 'js-yaml';
 import { join } from 'path';
 import { URL } from 'url';
-import YAML from 'yaml';
 
 import { Dependencies } from '@verdaccio/types';
 
@@ -25,7 +25,7 @@ export function createYamlConfig(registry: string, token?: string) {
     };
   }
 
-  return YAML.stringify(defaultYaml);
+  return YAML.dump(defaultYaml);
 }
 
 export async function prepareYarnModernProject(

e2e/cli/e2e-npm6/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-npm6
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-npm6/package.json

@@ -1,10 +1,10 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-npm6",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
-    "npm": "6.14.17"
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
+    "npm": "6.14.18"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm6/star.spec.ts

@@ -63,6 +63,22 @@ describe('star a package', () => {
     expect(resp1.stdout).toEqual(`☆  ${pkgName}`);
   });
 
+  test('should list stars of a user %s', async () => {
+    const pkgName = '@verdaccio/stars';
+    const { tempFolder } = await prepareGenericEmptyProject(
+      pkgName,
+      '1.0.0-patch',
+      registry.port,
+      registry.getToken(),
+      registry.getRegistryUrl()
+    );
+    await npmUtils.publish(npm, tempFolder, pkgName, registry);
+    await npm({ cwd: tempFolder }, 'star', pkgName, ...addRegistry(registry.getRegistryUrl()));
+    const resp = await npm({ cwd: tempFolder }, 'stars', ...addRegistry(registry.getRegistryUrl()));
+    // side effects: this result is affected the the package published in the previous step
+    expect(resp.stdout).toEqual(`@verdaccio/foo@verdaccio/stars`);
+  });
+
   afterAll(async () => {
     registry.stop();
   });

e2e/cli/e2e-npm7/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-npm7
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-npm7/package.json

@@ -1,9 +1,9 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-npm7",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
     "npm": "7.24.2"
   },
   "scripts": {

e2e/cli/e2e-npm7/star.spec.ts

@@ -63,6 +63,22 @@ describe('star a package', () => {
     expect(resp1.stdout).toEqual(`☆  ${pkgName}`);
   });
 
+  test('should list stars of a user %s', async () => {
+    const pkgName = '@verdaccio/stars';
+    const { tempFolder } = await prepareGenericEmptyProject(
+      pkgName,
+      '1.0.0-patch',
+      registry.port,
+      registry.getToken(),
+      registry.getRegistryUrl()
+    );
+    await npmUtils.publish(npm, tempFolder, pkgName, registry);
+    await npm({ cwd: tempFolder }, 'star', pkgName, ...addRegistry(registry.getRegistryUrl()));
+    const resp = await npm({ cwd: tempFolder }, 'stars', ...addRegistry(registry.getRegistryUrl()));
+    // side effects: this result is affected the the package published in the previous step
+    expect(resp.stdout).toEqual(`@verdaccio/foo@verdaccio/stars`);
+  });
+
   afterAll(async () => {
     registry.stop();
   });

e2e/cli/e2e-npm8/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-npm8
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-npm8/package.json

@@ -1,10 +1,10 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-npm8",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
-    "npm": "8.19.2"
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
+    "npm": "8.19.3"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm8/star.spec.ts

@@ -63,6 +63,22 @@ describe('star a package', () => {
     expect(resp1.stdout).toEqual(`☆  ${pkgName}`);
   });
 
+  test('should list stars of a user %s', async () => {
+    const pkgName = '@verdaccio/stars';
+    const { tempFolder } = await prepareGenericEmptyProject(
+      pkgName,
+      '1.0.0-patch',
+      registry.port,
+      registry.getToken(),
+      registry.getRegistryUrl()
+    );
+    await npmUtils.publish(npm, tempFolder, pkgName, registry);
+    await npm({ cwd: tempFolder }, 'star', pkgName, ...addRegistry(registry.getRegistryUrl()));
+    const resp = await npm({ cwd: tempFolder }, 'stars', ...addRegistry(registry.getRegistryUrl()));
+    // side effects: this result is affected the the package published in the previous step
+    expect(resp.stdout).toEqual(`@verdaccio/foo@verdaccio/stars`);
+  });
+
   afterAll(async () => {
     registry.stop();
   });

e2e/cli/e2e-npm9/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-npm9
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-npm9/package.json

@@ -1,10 +1,10 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-npm9",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
-    "npm": "9.0.0-pre.5"
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
+    "npm": "9.2.0"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm9/star.spec.ts

@@ -63,6 +63,22 @@ describe('star a package', () => {
     expect(resp1.stdout).toEqual(`☆  ${pkgName}`);
   });
 
+  test('should list stars of a user %s', async () => {
+    const pkgName = '@verdaccio/stars';
+    const { tempFolder } = await prepareGenericEmptyProject(
+      pkgName,
+      '1.0.0-patch',
+      registry.port,
+      registry.getToken(),
+      registry.getRegistryUrl()
+    );
+    await npmUtils.publish(npm, tempFolder, pkgName, registry);
+    await npm({ cwd: tempFolder }, 'star', pkgName, ...addRegistry(registry.getRegistryUrl()));
+    const resp = await npm({ cwd: tempFolder }, 'stars', ...addRegistry(registry.getRegistryUrl()));
+    // side effects: this result is affected the the package published in the previous step
+    expect(resp.stdout).toEqual(`@verdaccio/foo@verdaccio/stars`);
+  });
+
   afterAll(async () => {
     registry.stop();
   });

e2e/cli/e2e-pnpm6/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-pnpm6
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-pnpm6/package.json

@@ -1,9 +1,9 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-pnpm6",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
     "pnpm": "latest-6"
   },
   "scripts": {

e2e/cli/e2e-pnpm6/star.spec.ts

@@ -63,6 +63,26 @@ describe('star a package', () => {
     expect(resp1.stdout).toEqual(`☆  ${pkgName}`);
   });
 
+  test('should list stars of a user %s', async () => {
+    const pkgName = '@verdaccio/stars';
+    const { tempFolder } = await prepareGenericEmptyProject(
+      pkgName,
+      '1.0.0-patch',
+      registry.port,
+      registry.getToken(),
+      registry.getRegistryUrl()
+    );
+    await pnpmUtils.publish(pnpm, tempFolder, pkgName, registry);
+    await pnpm({ cwd: tempFolder }, 'star', pkgName, ...addRegistry(registry.getRegistryUrl()));
+    const resp = await pnpm(
+      { cwd: tempFolder },
+      'stars',
+      ...addRegistry(registry.getRegistryUrl())
+    );
+    // side effects: this result is affected the the package published in the previous step
+    expect(resp.stdout).toEqual(`@verdaccio/foo@verdaccio/stars`);
+  });
+
   afterAll(async () => {
     registry.stop();
   });

e2e/cli/e2e-pnpm7/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-pnpm7
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-pnpm7/package.json

@@ -1,9 +1,9 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-pnpm7",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
     "pnpm": "next-7"
   },
   "scripts": {

e2e/cli/e2e-pnpm7/star.spec.ts

@@ -63,6 +63,26 @@ describe('star a package', () => {
     expect(resp1.stdout).toEqual(`☆  ${pkgName}`);
   });
 
+  test('should list stars of a user %s', async () => {
+    const pkgName = '@verdaccio/stars';
+    const { tempFolder } = await prepareGenericEmptyProject(
+      pkgName,
+      '1.0.0-patch',
+      registry.port,
+      registry.getToken(),
+      registry.getRegistryUrl()
+    );
+    await pnpmUtils.publish(pnpm, tempFolder, pkgName, registry);
+    await pnpm({ cwd: tempFolder }, 'star', pkgName, ...addRegistry(registry.getRegistryUrl()));
+    const resp = await pnpm(
+      { cwd: tempFolder },
+      'stars',
+      ...addRegistry(registry.getRegistryUrl())
+    );
+    // side effects: this result is affected the the package published in the previous step
+    expect(resp.stdout).toEqual(`@verdaccio/foo@verdaccio/stars`);
+  });
+
   afterAll(async () => {
     registry.stop();
   });

e2e/cli/e2e-yarn1/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-yarn1
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-yarn1/package.json

@@ -1,9 +1,9 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-yarn1",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
     "yarn": "1.22.19"
   },
   "scripts": {

e2e/cli/e2e-yarn2/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-yarn2
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-yarn2/audit.spec.ts

@@ -30,10 +30,6 @@ describe('audit a package yarn 2', () => {
     const resp = await yarn(projectFolder, 'npm', 'audit', '--json');
     const parsedBody = JSON.parse(resp.stdout as string);
     expect(parsedBody.advisories).toBeDefined();
-    expect(parsedBody.advisories['1069969']).toBeDefined();
-    expect(parsedBody.advisories['1069969'].recommendation).toEqual(
-      'Upgrade to version 3.4.0 or later'
-    );
   });
 
   afterAll(async () => {

e2e/cli/e2e-yarn2/package.json

@@ -1,9 +1,9 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-yarn2",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
     "@yarnpkg/cli-dist": "2.4.2"
   },
   "scripts": {

e2e/cli/e2e-yarn3/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-yarn3
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-yarn3/audit.spec.ts

@@ -30,10 +30,6 @@ describe('audit a package yarn 3', () => {
     const resp = await yarn(projectFolder, 'npm', 'audit', '--json');
     const parsedBody = JSON.parse(resp.stdout as string);
     expect(parsedBody.advisories).toBeDefined();
-    expect(parsedBody.advisories['1069969']).toBeDefined();
-    expect(parsedBody.advisories['1069969'].recommendation).toEqual(
-      'Upgrade to version 3.4.0 or later'
-    );
   });
 
   afterAll(async () => {

e2e/cli/e2e-yarn3/package.json

@@ -1,10 +1,10 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-yarn3",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5",
-    "@yarnpkg/cli-dist": "3.2.4"
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6",
+    "@yarnpkg/cli-dist": "3.3.1"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-yarn4/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-yarn4
 
+## 1.0.1-6-next.6
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/test-cli-commons@1.1.0-6-next.6
+
 ## 1.0.1-6-next.5
 
 ### Patch Changes

e2e/cli/e2e-yarn4/package.json

@@ -1,9 +1,9 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-cli-yarn4",
-  "version": "1.0.1-6-next.5",
+  "version": "1.0.1-6-next.6",
   "dependencies": {
-    "@verdaccio/test-cli-commons": "workspace:1.0.1-6-next.5"
+    "@verdaccio/test-cli-commons": "workspace:1.1.0-6-next.6"
   },
   "scripts": {
     "test": "jest"

e2e/ui/config/config.yaml

@@ -3,18 +3,26 @@ web:
   title: verdaccio-server-e2e
   login: true
 
-log: { type: stdout, format: pretty, level: debug }
+log: { type: stdout, format: json, level: info }
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
 
 auth:
   htpasswd:
     file: ./htpasswd
 
 packages:
+  '@verdaccio/*':
+    access: $all
+    publish: $authenticated
   '@*/*':
     access: $all
     publish: $authenticated
+    proxy: npmjs
   '**':
     access: $all
     publish: $authenticated
-
+    proxy: npmjs
 _debug: true

e2e/ui/cypress.config.ts

@@ -29,8 +29,8 @@ export default defineConfig({
       });
 
       on('task', {
-        publishScoped() {
-          const scopedPackageMetadata = generatePackageMetadata('pkg-scoped', '1.0.6');
+        publishScoped({ pkgName }) {
+          const scopedPackageMetadata = generatePackageMetadata(pkgName, '1.0.6');
           const server = new ServerQuery(registry1.getRegistryUrl());
           server
             .putPackage(scopedPackageMetadata.name, scopedPackageMetadata, {

e2e/ui/cypress/e2e/publish.cy.ts

@@ -5,18 +5,19 @@ describe('publish spec', () => {
     // @ts-expect-error
     const registry = await cy.task('registry');
     ctx.url = registry.registryUrl;
+    const pkgName = `@verdaccio/pkg-scoped`;
     cy.intercept('POST', '/-/verdaccio/sec/login').as('sign');
     cy.intercept('GET', '/-/verdaccio/data/packages').as('pkgs');
-    cy.intercept('GET', '/-/verdaccio/data/sidebar/pkg-scoped').as('sidebar');
-    cy.intercept('GET', '/-/verdaccio/data/package/readme/pkg-scoped').as('readme');
-    cy.task('publishScoped', { pkgName: 'pkg-protected' });
+    cy.intercept('GET', `/-/verdaccio/data/sidebar/${pkgName}`).as('sidebar');
+    cy.intercept('GET', `/-/verdaccio/data/package/readme/${pkgName}`).as('readme');
+    cy.task('publishScoped', { pkgName });
   });
 
   it('should have one published package', () => {
     cy.visit(ctx.url);
     cy.login(credentials.user, credentials.password);
     cy.wait('@sign');
-    cy.getByTestId('package-title').should('have.length', 1);
+    // cy.getByTestId('package-title').should('have.length', 1);
   });
 
   it('should navigate to page detail', () => {
@@ -25,9 +26,7 @@ describe('publish spec', () => {
     cy.wait('@sign');
     cy.wait('@pkgs');
     cy.wait(300);
-    cy.getByTestId('package-title').click();
-    cy.wait('@sidebar');
-    cy.wait('@readme');
+    cy.getByTestId('package-title').first().click();
   });
 
   it('should have readme content', () => {
@@ -35,9 +34,9 @@ describe('publish spec', () => {
     cy.login(credentials.user, credentials.password);
     cy.wait('@sign');
     cy.wait('@pkgs');
-    cy.getByTestId('package-title').click();
-    cy.wait('@sidebar');
+    cy.getByTestId('package-title').first().click();
     cy.wait('@readme');
+    cy.wait('@sidebar');
     cy.get('.markdown-body').should('have.length', 1);
     cy.contains('.markdown-body', /test/);
   });
@@ -48,9 +47,9 @@ describe('publish spec', () => {
     cy.wait('@sign');
     cy.wait('@pkgs');
     cy.wait(300);
-    cy.getByTestId('package-title').click();
-    cy.wait('@sidebar');
+    cy.getByTestId('package-title').first().click();
     cy.wait('@readme');
+    cy.wait('@sidebar');
     cy.getByTestId('dependencies-tab').click();
     cy.wait(100);
     cy.getByTestId('dependencies').should('have.length', 1);
@@ -67,9 +66,9 @@ describe('publish spec', () => {
     cy.wait('@sign');
     cy.wait('@pkgs');
     cy.wait(300);
-    cy.getByTestId('package-title').click();
-    cy.wait('@sidebar');
+    cy.getByTestId('package-title').first().click();
     cy.wait('@readme');
+    cy.wait('@sidebar');
     cy.getByTestId('versions-tab').click();
     cy.getByTestId('tag-latest').children().invoke('text').should('match', /1.0.6/);
     cy.screenshot();
@@ -81,9 +80,9 @@ describe('publish spec', () => {
     cy.wait('@sign');
     cy.wait('@pkgs');
     cy.wait(300);
-    cy.getByTestId('package-title').click();
-    cy.wait('@sidebar');
+    cy.getByTestId('package-title').first().click();
     cy.wait('@readme');
+    cy.wait('@sidebar');
     cy.getByTestId('uplinks-tab').click();
     cy.getByTestId('no-uplinks').should('be.visible');
     cy.screenshot();

e2e/ui/cypress/e2e/signin.cy.ts

@@ -25,6 +25,7 @@ describe('sign spec', () => {
     cy.wait(100);
     cy.getByTestId('logOutDialogIcon').click();
     cy.screenshot();
+    cy.wait(200);
     cy.getByTestId('header--button-login').contains('Login');
     cy.screenshot();
   });

e2e/ui/package.json

@@ -3,12 +3,12 @@
   "name": "@verdaccio/e2e-ui",
   "version": "2.0.0-6-next.3",
   "devDependencies": {
-    "verdaccio": "workspace:6.0.0-6-next.50",
-    "@verdaccio/core": "workspace:6.0.0-6-next.50",
-    "@verdaccio/config": "workspace:6.0.0-6-next.50",
-    "@verdaccio/test-helper": "workspace:2.0.0-6-next.6",
+    "verdaccio": "workspace:6.0.0-6-next.61",
+    "@verdaccio/core": "workspace:6.0.0-6-next.61",
+    "@verdaccio/config": "workspace:6.0.0-6-next.61",
+    "@verdaccio/test-helper": "workspace:2.0.0-6-next.7",
     "debug": "4.3.4",
-    "cypress": "10.10.0"
+    "cypress": "11.2.0"
   },
   "scripts": {
     "cypress:open": "cypress open",

package.json

@@ -15,93 +15,102 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@babel/cli": "7.19.3",
-    "@babel/core": "7.19.3",
-    "@babel/node": "7.19.1",
+    "@babel/cli": "7.20.7",
+    "@babel/core": "7.20.7",
+    "@babel/node": "7.20.7",
     "@babel/plugin-proposal-class-properties": "7.18.6",
-    "@babel/plugin-proposal-decorators": "7.19.3",
+    "@babel/plugin-proposal-decorators": "7.20.7",
     "@babel/plugin-proposal-export-namespace-from": "7.18.9",
     "@babel/plugin-proposal-function-sent": "7.18.6",
     "@babel/plugin-proposal-json-strings": "7.18.6",
     "@babel/plugin-proposal-nullish-coalescing-operator": "7.18.6",
     "@babel/plugin-proposal-numeric-separator": "7.18.6",
-    "@babel/plugin-proposal-object-rest-spread": "7.19.4",
-    "@babel/plugin-proposal-optional-chaining": "7.18.9",
+    "@babel/plugin-proposal-object-rest-spread": "7.20.7",
+    "@babel/plugin-proposal-optional-chaining": "7.20.7",
     "@babel/plugin-proposal-throw-expressions": "7.18.6",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-syntax-import-meta": "7.10.4",
-    "@babel/plugin-transform-async-to-generator": "7.18.6",
-    "@babel/plugin-transform-classes": "7.19.0",
-    "@babel/plugin-transform-runtime": "7.19.1",
-    "@babel/preset-env": "7.19.4",
+    "@babel/plugin-transform-async-to-generator": "7.20.7",
+    "@babel/plugin-transform-classes": "7.20.7",
+    "@babel/plugin-transform-runtime": "7.19.6",
+    "@babel/preset-env": "7.20.2",
     "@babel/preset-react": "7.18.6",
     "@babel/preset-typescript": "7.18.6",
     "@babel/register": "7.18.9",
-    "@babel/runtime": "7.19.4",
+    "@babel/runtime": "7.20.7",
     "@dianmora/contributors": "5.0.0",
-    "@changesets/changelog-github": "0.4.7",
+    "@changesets/changelog-github": "0.4.8",
     "@changesets/cli": "2.24.4",
-    "@changesets/get-dependents-graph": "1.3.4",
-    "@crowdin/cli": "3.8.1",
-    "@trivago/prettier-plugin-sort-imports": "3.3.0",
-    "@types/async": "3.2.15",
-    "@types/autocannon": "4.1.1",
-    "@types/express": "4.17.14",
+    "@changesets/get-dependents-graph": "1.3.5",
+    "@crowdin/cli": "3.9.1",
+    "@emotion/react": "11.10.5",
+    "@emotion/styled": "11.10.5",
+    "@testing-library/dom": "8.19.1",
+    "@testing-library/jest-dom": "5.16.5",
+    "@testing-library/react": "12.1.4",
+    "react": "18.2.0",
+    "react-dom": "18.2.0",
+    "@trivago/prettier-plugin-sort-imports": "3.4.0",
+    "@types/async": "3.2.16",
+    "@types/express": "4.17.15",
     "@types/http-errors": "1.8.2",
     "@types/jest": "27.5.2",
-    "@types/lodash": "4.14.186",
+    "@types/lodash": "4.14.191",
     "@types/mime": "2.0.3",
     "@types/minimatch": "3.0.5",
-    "@types/node": "16.11.65",
+    "@types/redux": "3.6.0",
+    "@types/node": "16.18.10",
     "@types/jsonwebtoken": "8.5.9",
     "@types/request": "2.48.8",
-    "@types/semver": "7.3.12",
+    "@types/semver": "7.3.13",
     "@types/node-fetch": "2.6.2",
     "@types/supertest": "2.0.12",
     "@types/testing-library__jest-dom": "5.14.5",
-    "@types/validator": "13.7.7",
+    "@types/validator": "13.7.10",
     "@types/webpack": "5.28.0",
     "@types/webpack-env": "1.18.0",
-    "@typescript-eslint/eslint-plugin": "5.37.0",
-    "@typescript-eslint/parser": "5.37.0",
-    "@verdaccio/benchmark": "workspace:*",
+    "@types/react": "18.0.26",
+    "@types/react-dom": "18.0.9",
+    "@types/react-router-dom": "5.3.3",
+    "@types/react-virtualized": "9.21.21",
+    "@typescript-eslint/eslint-plugin": "5.49.0",
+    "@typescript-eslint/parser": "5.49.0",
     "@verdaccio/crowdin-translations": "workspace:*",
     "@verdaccio/eslint-config": "workspace:*",
     "@verdaccio/types": "workspace:*",
     "@verdaccio/ui-theme": "workspace:*",
-    "autocannon": "7.10.0",
     "babel-core": "7.0.0-bridge.0",
     "babel-eslint": "10.1.0",
-    "babel-jest": "29.2.0",
+    "babel-jest": "29.3.1",
     "babel-plugin-dynamic-import-node": "2.3.3",
     "babel-plugin-emotion": "10.2.2",
     "concurrently": "6.5.1",
-    "core-js": "3.25.5",
+    "core-js": "3.27.0",
     "cross-env": "7.0.3",
     "debug": "4.3.4",
     "detect-secrets": "1.0.6",
-    "jest-diff": "29.2.0",
-    "eslint": "8.23.1",
+    "jest-diff": "29.3.1",
+    "eslint": "8.33.0",
     "fs-extra": "10.1.0",
     "husky": "7.0.4",
     "in-publish": "2.0.1",
-    "jest": "29.2.0",
-    "jest-environment-jsdom": "29.2.0",
+    "jest": "29.3.1",
+    "jest-environment-jsdom": "29.3.1",
     "jest-environment-jsdom-global": "3.1.2",
-    "jest-environment-node": "29.2.0",
+    "jest-environment-node": "29.3.1",
     "jest-junit": "12.3.0",
     "kleur": "3.0.3",
     "lint-staged": "11.2.6",
+    "got": "11.8.6",
     "nock": "13.2.9",
-    "node-fetch": "cjs",
     "nodemon": "2.0.20",
     "npm-run-all": "4.1.5",
-    "prettier": "2.7.1",
+    "prettier": "2.8.3",
     "rimraf": "3.0.2",
     "selfsigned": "1.10.14",
-    "supertest": "6.3.0",
+    "supertest": "6.3.3",
     "ts-node": "10.9.1",
-    "typescript": "4.8.4",
+    "typescript": "4.9.4",
     "update-ts-references": "2.4.1",
     "verdaccio-audit": "workspace:*",
     "verdaccio-auth-memory": "workspace:*",
@@ -121,10 +130,8 @@
     "test:e2e:cli": "pnpm test --filter ...@verdaccio/e2e-cli-* -- --coverage=false",
     "test:e2e:ui": "pnpm test --filter ...@verdaccio/e2e-ui",
     "start": "concurrently --kill-others \"pnpm _start:server\" \"pnpm _start:web\"",
-    "benchmark:hyper": "verdaccio-benchmark hyper -r ./hyper-results.json",
-    "benchmark:api": "verdaccio-benchmark api",
-    "benchmark:submit": "pnpm ts-node ./scripts/submit-metrics.ts",
     "contributors": "ts-node ./scripts/contributors-update.ts",
+    "script:addson": "ts-node ./scripts/addon-update.ts",
     "start:watch": "concurrently --kill-others \"pnpm _build:watch\" \"pnpm _start:server\" \"pnpm _debug:reload\"",
     "_build:watch": "pnpm run --parallel watch --filter ./packages",
     "_start:server": "node --inspect packages/verdaccio/debug/bootstrap.js --listen 8000",
@@ -142,13 +149,16 @@
     "ci:publish": "changeset publish",
     "ts:ref": "update-ts-references --discardComments",
     "website": "pnpm build --filter ...@verdaccio/website",
+    "ui:storybook:build": "pnpm build-storybook --filter ...@verdaccio/ui-components",
+    "ui:storybook": "pnpm storybook --filter ...@verdaccio/ui-components",
     "translations": "local-crowdin-api translations",
     "crowdin:upload": "crowdin upload sources --auto-update --config ./crowdin.yaml",
     "crowdin:download": "crowdin download --verbose --config ./crowdin.yaml",
     "crowdin:sync": "pnpm crowdin:upload && pnpm crowdin:download --verbose",
     "postinstall": "husky install",
     "local:registry": "pnpm start --filter ...@verdaccio/local-publish",
-    "local:publish": "cross-env npm_config_registry=http://localhost:4873 pnpm ci:publish",
+    "local:snapshots": "changeset version --snapshot",
+    "local:publish": "cross-env npm_config_registry=http://localhost:4873 pnpm ci:publish -- --no-git-tag",
     "local:publish:release": "concurrently \"pnpm local:registry\" \"pnpm local:publish\""
   },
   "pnpm": {

packages/api/CHANGELOG.md

@@ -1,5 +1,171 @@
 # @verdaccio/api
 
+## 6.0.0-6-next.44
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/config@6.0.0-6-next.61
+  - @verdaccio/auth@6.0.0-6-next.40
+  - @verdaccio/middleware@6.0.0-6-next.40
+  - @verdaccio/store@6.0.0-6-next.41
+  - @verdaccio/core@6.0.0-6-next.61
+  - @verdaccio/utils@6.0.0-6-next.29
+  - @verdaccio/logger@6.0.0-6-next.29
+
+## 6.0.0-6-next.43
+
+### Minor Changes
+
+- 45c03819: refactor: render html middleware
+
+### Patch Changes
+
+- Updated dependencies [45c03819]
+  - @verdaccio/config@6.0.0-6-next.60
+  - @verdaccio/middleware@6.0.0-6-next.39
+  - @verdaccio/store@6.0.0-6-next.40
+  - @verdaccio/auth@6.0.0-6-next.39
+  - @verdaccio/core@6.0.0-6-next.60
+  - @verdaccio/logger@6.0.0-6-next.28
+  - @verdaccio/utils@6.0.0-6-next.28
+
+## 6.0.0-6-next.42
+
+### Patch Changes
+
+- Updated dependencies [65f88b82]
+  - @verdaccio/logger@6.0.0-6-next.27
+  - @verdaccio/middleware@6.0.0-6-next.38
+  - @verdaccio/auth@6.0.0-6-next.38
+  - @verdaccio/store@6.0.0-6-next.39
+  - @verdaccio/core@6.0.0-6-next.59
+  - @verdaccio/config@6.0.0-6-next.59
+  - @verdaccio/utils@6.0.0-6-next.27
+
+## 6.0.0-6-next.41
+
+### Patch Changes
+
+- Updated dependencies [fa274ee4]
+  - @verdaccio/middleware@6.0.0-6-next.37
+  - @verdaccio/core@6.0.0-6-next.58
+  - @verdaccio/config@6.0.0-6-next.58
+  - @verdaccio/auth@6.0.0-6-next.37
+  - @verdaccio/store@6.0.0-6-next.38
+  - @verdaccio/utils@6.0.0-6-next.26
+  - @verdaccio/logger@6.0.0-6-next.26
+
+## 6.0.0-6-next.40
+
+### Patch Changes
+
+- Updated dependencies [9943e2b1]
+  - @verdaccio/middleware@6.0.0-6-next.36
+  - @verdaccio/store@6.0.0-6-next.37
+  - @verdaccio/core@6.0.0-6-next.57
+  - @verdaccio/config@6.0.0-6-next.57
+  - @verdaccio/auth@6.0.0-6-next.36
+  - @verdaccio/logger@6.0.0-6-next.25
+  - @verdaccio/utils@6.0.0-6-next.25
+
+## 6.0.0-6-next.39
+
+### Minor Changes
+
+- a1986e09: feat: expose middleware utils
+
+### Patch Changes
+
+- Updated dependencies [a1986e09]
+  - @verdaccio/middleware@6.0.0-6-next.35
+  - @verdaccio/utils@6.0.0-6-next.24
+  - @verdaccio/auth@6.0.0-6-next.35
+  - @verdaccio/config@6.0.0-6-next.56
+  - @verdaccio/store@6.0.0-6-next.36
+  - @verdaccio/core@6.0.0-6-next.56
+  - @verdaccio/logger@6.0.0-6-next.24
+
+## 6.0.0-6-next.38
+
+### Patch Changes
+
+- Updated dependencies [9718e033]
+  - @verdaccio/config@6.0.0-6-next.55
+  - @verdaccio/core@6.0.0-6-next.55
+  - @verdaccio/store@6.0.0-6-next.35
+  - @verdaccio/utils@6.0.0-6-next.23
+  - @verdaccio/auth@6.0.0-6-next.34
+  - @verdaccio/logger@6.0.0-6-next.23
+  - @verdaccio/middleware@6.0.0-6-next.34
+
+## 6.0.0-6-next.37
+
+### Minor Changes
+
+- ef88da3b: feat: improve support for fs promises older nodejs
+
+### Patch Changes
+
+- Updated dependencies [ef88da3b]
+  - @verdaccio/config@6.0.0-6-next.54
+  - @verdaccio/core@6.0.0-6-next.54
+  - @verdaccio/logger@6.0.0-6-next.22
+  - @verdaccio/utils@6.0.0-6-next.22
+  - @verdaccio/auth@6.0.0-6-next.33
+  - @verdaccio/store@6.0.0-6-next.34
+  - @verdaccio/middleware@6.0.0-6-next.33
+
+## 6.0.0-6-next.36
+
+### Patch Changes
+
+- @verdaccio/auth@6.0.0-6-next.32
+- @verdaccio/core@6.0.0-6-next.53
+- @verdaccio/logger@6.0.0-6-next.21
+- @verdaccio/store@6.0.0-6-next.33
+- @verdaccio/config@6.0.0-6-next.53
+- @verdaccio/middleware@6.0.0-6-next.32
+- @verdaccio/utils@6.0.0-6-next.21
+
+## 6.0.0-6-next.35
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.52
+- @verdaccio/config@6.0.0-6-next.52
+- @verdaccio/auth@6.0.0-6-next.31
+- @verdaccio/logger@6.0.0-6-next.20
+- @verdaccio/middleware@6.0.0-6-next.31
+- @verdaccio/store@6.0.0-6-next.32
+- @verdaccio/utils@6.0.0-6-next.20
+
+## 6.0.0-6-next.34
+
+### Minor Changes
+
+- 4b29d715: chore: move improvements from v5 to v6
+
+  Migrate improvements form v5 to v6:
+
+  - https://github.com/verdaccio/verdaccio/pull/3158
+  - https://github.com/verdaccio/verdaccio/pull/3151
+  - https://github.com/verdaccio/verdaccio/pull/2271
+  - https://github.com/verdaccio/verdaccio/pull/2787
+  - https://github.com/verdaccio/verdaccio/pull/2791
+  - https://github.com/verdaccio/verdaccio/pull/2205
+
+### Patch Changes
+
+- Updated dependencies [4b29d715]
+  - @verdaccio/auth@6.0.0-6-next.30
+  - @verdaccio/config@6.0.0-6-next.51
+  - @verdaccio/core@6.0.0-6-next.51
+  - @verdaccio/middleware@6.0.0-6-next.30
+  - @verdaccio/store@6.0.0-6-next.31
+  - @verdaccio/logger@6.0.0-6-next.19
+  - @verdaccio/utils@6.0.0-6-next.19
+
 ## 6.0.0-6-next.33
 
 ### Patch Changes

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "6.0.0-6-next.33",
+  "version": "6.0.0-6-next.44",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -39,13 +39,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "workspace:6.0.0-6-next.29",
-    "@verdaccio/config": "workspace:6.0.0-6-next.50",
-    "@verdaccio/core": "workspace:6.0.0-6-next.50",
-    "@verdaccio/logger": "workspace:6.0.0-6-next.18",
-    "@verdaccio/middleware": "workspace:6.0.0-6-next.29",
-    "@verdaccio/store": "workspace:6.0.0-6-next.30",
-    "@verdaccio/utils": "workspace:6.0.0-6-next.18",
+    "@verdaccio/auth": "workspace:6.0.0-6-next.40",
+    "@verdaccio/config": "workspace:6.0.0-6-next.61",
+    "@verdaccio/core": "workspace:6.0.0-6-next.61",
+    "@verdaccio/logger": "workspace:6.0.0-6-next.29",
+    "@verdaccio/middleware": "workspace:6.0.0-6-next.40",
+    "@verdaccio/store": "workspace:6.0.0-6-next.41",
+    "@verdaccio/utils": "workspace:6.0.0-6-next.29",
     "abortcontroller-polyfill": "1.7.5",
     "cookies": "0.8.0",
     "debug": "4.3.4",
@@ -56,11 +56,11 @@
     "semver": "7.3.8"
   },
   "devDependencies": {
-    "@types/node": "16.11.65",
-    "@verdaccio/server": "workspace:6.0.0-6-next.39",
-    "@verdaccio/types": "workspace:11.0.0-6-next.17",
-    "@verdaccio/test-helper": "workspace:2.0.0-6-next.6",
-    "supertest": "6.3.0",
+    "@types/node": "16.18.10",
+    "@verdaccio/server": "workspace:6.0.0-6-next.50",
+    "@verdaccio/types": "workspace:11.0.0-6-next.20",
+    "@verdaccio/test-helper": "workspace:2.0.0-6-next.7",
+    "supertest": "6.3.3",
     "nock": "13.2.9",
     "mockdate": "3.0.5"
   },

packages/api/src/dist-tags.ts

@@ -4,13 +4,17 @@ import mime from 'mime';
 
 import { Auth } from '@verdaccio/auth';
 import { constants, errorUtils } from '@verdaccio/core';
+import { logger } from '@verdaccio/logger';
 import { allow, media } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
 
 export default function (route: Router, auth: Auth, storage: Storage): void {
-  const can = allow(auth);
+  const can = allow(auth, {
+    beforeAll: (a, b) => logger.trace(a, b),
+    afterAll: (a, b) => logger.trace(a, b),
+  });
   const addTagPackageVersionMiddleware = async function (
     req: $RequestExtend,
     res: $ResponseExtend,
@@ -98,24 +102,4 @@ export default function (route: Router, auth: Auth, storage: Storage): void {
       }
     }
   );
-
-  route.post(
-    '/-/package/:package/dist-tags',
-    can('publish'),
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      try {
-        await storage.mergeTagsNext(req.params.package, req.body);
-        res.status(constants.HTTP_STATUS.CREATED);
-        return next({
-          ok: constants.API_MESSAGE.TAG_UPDATED,
-        });
-      } catch (err) {
-        next(err);
-      }
-    }
-  );
 }

packages/api/src/index.ts

@@ -42,7 +42,6 @@ export default function (config: Config, auth: Auth, storage: Storage): Router {
   // TODO: For some reason? what reason?
   app.param('_rev', match(/^-rev$/));
   app.param('org_couchdb_user', match(/^org\.couchdb\.user:/));
-  app.param('anything', match(/.*/));
   app.use(auth.apiJWTmiddleware());
   app.use(bodyParser.json({ strict: false, limit: config.max_body_size || '10mb' }));
   // @ts-ignore

packages/api/src/package.ts

@@ -3,6 +3,7 @@ import { Router } from 'express';
 
 import { Auth } from '@verdaccio/auth';
 import { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';
+import { logger } from '@verdaccio/logger';
 import { allow } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 
@@ -11,8 +12,10 @@ import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/cust
 const debug = buildDebug('verdaccio:api:package');
 
 export default function (route: Router, auth: Auth, storage: Storage): void {
-  const can = allow(auth);
-
+  const can = allow(auth, {
+    beforeAll: (a, b) => logger.trace(a, b),
+    afterAll: (a, b) => logger.trace(a, b),
+  });
   route.get(
     '/:package/:version?',
     can('access'),
@@ -58,13 +61,13 @@ export default function (route: Router, auth: Auth, storage: Storage): void {
   );
 
   route.get(
-    '/:pkg/-/:filename',
+    '/:package/-/:filename',
     can('access'),
     async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {
-      const { pkg, filename } = req.params;
+      const { package: pkgName, filename } = req.params;
       const abort = new AbortController();
       try {
-        const stream = (await storage.getTarballNext(pkg, filename, {
+        const stream = (await storage.getTarballNext(pkgName, filename, {
           signal: abort.signal,
           // TODO: review why this param
           // enableRemote: true,

packages/api/src/publish.ts

@@ -93,7 +93,10 @@ const debug = buildDebug('verdaccio:api:publish');
    *
    */
 export default function publish(router: Router, auth: Auth, storage: Storage): void {
-  const can = allow(auth);
+  const can = allow(auth, {
+    beforeAll: (a, b) => logger.trace(a, b),
+    afterAll: (a, b) => logger.trace(a, b),
+  });
   router.put(
     '/:package',
     can('publish'),

packages/api/src/star.ts

@@ -1,88 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unused-vars */
-import buildDebug from 'debug';
-import { Response } from 'express';
-import _ from 'lodash';
-
-import { HTTP_STATUS, USERS } from '@verdaccio/core';
-import { Storage } from '@verdaccio/store';
-
-import { $NextFunctionVer, $RequestExtend } from '../types/custom';
-
-const debug = buildDebug('verdaccio:api:publish:star');
-
-export default function (
-  storage: Storage
-): (req: $RequestExtend, res: Response, next: $NextFunctionVer) => void {
-  const validateInputs = (newUsers, localUsers, username, isStar): boolean => {
-    const isExistlocalUsers = _.isNil(localUsers[username]) === false;
-    if (isStar && isExistlocalUsers && localUsers[username]) {
-      return true;
-    } else if (!isStar && isExistlocalUsers) {
-      return false;
-    } else if (!isStar && !isExistlocalUsers) {
-      return true;
-    }
-    return false;
-  };
-
-  return (req: $RequestExtend, res: Response, next: $NextFunctionVer): void => {
-    const name = req.params.package;
-    debug('starring a package for %o', name);
-    // const afterChangePackage = function (err?: Error) {
-    //   if (err) {
-    //     debug('error on update package for %o', name);
-    //     return next(err);
-    //   }
-
-    //   debug('succes update package for %o', name);
-    //   res.status(HTTP_STATUS.OK);
-    //   next({
-    //     success: true,
-    //   });
-    // };
-
-    debug('get package info package for %o', name);
-    // @ts-ignore
-    // storage.getPackage({
-    //   name,
-    //   req,
-    //   callback: function (err, info) {
-    //     if (err) {
-    //       debug('error on get package info package for %o', name);
-    //       return next(err);
-    //     }
-    //     const newStarUser = req.body[USERS];
-    //     const remoteUsername = req.remote_user.name;
-    //     const localStarUsers = info[USERS];
-    //     // Check is star or unstar
-    //     const isStar = Object.keys(newStarUser).includes(remoteUsername);
-    //     debug('is start? %o', isStar);
-    //     if (
-    //       _.isNil(localStarUsers) === false &&
-    //       validateInputs(newStarUser, localStarUsers, remoteUsername, isStar)
-    //     ) {
-    //       return afterChangePackage();
-    //     }
-    //     const users = isStar
-    //       ? {
-    //           ...localStarUsers,
-    //           [remoteUsername]: true,
-    //         }
-    //       : _.reduce(
-    //           localStarUsers,
-    //           (users, value, key) => {
-    //             if (key !== remoteUsername) {
-    //               users[key] = value;
-    //             }
-    //             return users;
-    //           },
-    //           {}
-    //         );
-    //     debug('update package for  %o', name);
-    //     storage.changePackage(name, { ...info, users }, req.body._rev, function (err) {
-    //       afterChangePackage(err);
-    //     });
-    //   },
-    // });
-  };
-}

packages/api/src/stars.ts

@@ -1,7 +1,7 @@
 import { Response, Router } from 'express';
 import _ from 'lodash';
 
-import { HTTP_STATUS, USERS } from '@verdaccio/core';
+import { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';
 import { Storage } from '@verdaccio/store';
 import { Version } from '@verdaccio/types';
 
@@ -11,13 +11,15 @@ export default function (route: Router, storage: Storage): void {
   route.get(
     '/-/_view/starredByUser',
     async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {
-      const remoteUsername = req.remote_user.name;
+      const query: { key: string } = req.query;
+      if (typeof query?.key !== 'string') {
+        return next(errorUtils.getBadRequest('missing query key username'));
+      }
 
       try {
-        const localPackages: Version[] = await storage.getLocalDatabaseNext();
-
+        const localPackages: Version[] = await storage.getLocalDatabase();
         const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>
-          _.keys(localPackage[USERS]).includes(remoteUsername)
+          _.keys(localPackage[USERS]).includes(query?.key.toString().replace(/['"]+/g, ''))
         );
 
         res.status(HTTP_STATUS.OK);

packages/api/src/user.ts

@@ -4,8 +4,16 @@ import { Response, Router } from 'express';
 import { getApiToken } from '@verdaccio/auth';
 import { Auth } from '@verdaccio/auth';
 import { createRemoteUser } from '@verdaccio/config';
-import { API_ERROR, API_MESSAGE, HTTP_STATUS, errorUtils, validatioUtils } from '@verdaccio/core';
+import {
+  API_ERROR,
+  API_MESSAGE,
+  HEADERS,
+  HTTP_STATUS,
+  errorUtils,
+  validatioUtils,
+} from '@verdaccio/core';
 import { logger } from '@verdaccio/logger';
+import { rateLimit } from '@verdaccio/middleware';
 import { Config, RemoteUser } from '@verdaccio/types';
 import { getAuthenticatedMessage, mask } from '@verdaccio/utils';
 
@@ -16,6 +24,7 @@ const debug = buildDebug('verdaccio:api:user');
 export default function (route: Router, auth: Auth, config: Config): void {
   route.get(
     '/-/user/:org_couchdb_user',
+    rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       debug('verifying user');
       const message = getAuthenticatedMessage(req.remote_user.name);
@@ -46,6 +55,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
  */
   route.put(
     '/-/user/:org_couchdb_user/:_rev?/:revision?',
+    rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       const { name, password } = req.body;
       debug('login or adduser');
@@ -75,6 +85,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
             }
 
             res.status(HTTP_STATUS.CREATED);
+            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
 
             const message = getAuthenticatedMessage(req.remote_user.name);
             debug('login: created user message %o', message);
@@ -124,6 +135,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
 
           req.remote_user = user;
           res.status(HTTP_STATUS.CREATED);
+          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
           debug('adduser: user has been created');
           return next({
             ok: `user '${req.body.name}' created`,

packages/api/src/v1/profile.ts

@@ -10,6 +10,7 @@ import {
   errorUtils,
   validatioUtils,
 } from '@verdaccio/core';
+import { rateLimit } from '@verdaccio/middleware';
 import { Config } from '@verdaccio/types';
 
 import { $NextFunctionVer, $RequestExtend } from '../../types/custom';
@@ -41,6 +42,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
 
   route.get(
     '/-/npm/v1/user',
+    rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       if (_.isNil(req.remote_user.name) === false) {
         return next(buildProfile(req.remote_user.name));
@@ -55,6 +57,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
 
   route.post(
     '/-/npm/v1/user',
+    rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       if (_.isNil(req.remote_user.name)) {
         res.status(HTTP_STATUS.UNAUTHORIZED);

packages/api/src/v1/token.ts

@@ -3,8 +3,9 @@ import _ from 'lodash';
 
 import { getApiToken } from '@verdaccio/auth';
 import { Auth } from '@verdaccio/auth';
-import { HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';
+import { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';
 import { logger } from '@verdaccio/logger';
+import { rateLimit } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Config, RemoteUser, Token } from '@verdaccio/types';
 import { mask, stringToMD5 } from '@verdaccio/utils';
@@ -26,6 +27,7 @@ function normalizeToken(token: Token): NormalizeToken {
 export default function (route: Router, auth: Auth, storage: Storage, config: Config): void {
   route.get(
     '/-/npm/v1/tokens',
+    rateLimit(config?.userRateLimit),
     async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {
       const { name } = req.remote_user;
 
@@ -53,6 +55,7 @@ export default function (route: Router, auth: Auth, storage: Storage, config: Co
 
   route.post(
     '/-/npm/v1/tokens',
+    rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {
       const { password, readonly, cidr_whitelist } = req.body;
       const { name } = req.remote_user;
@@ -102,6 +105,7 @@ export default function (route: Router, auth: Auth, storage: Storage, config: Co
 
           await storage.saveToken(saveToken);
           logger.debug({ key, name }, 'token @{key} was created for user @{name}');
+          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
           return next(
             normalizeToken({
               token,
@@ -122,6 +126,7 @@ export default function (route: Router, auth: Auth, storage: Storage, config: Co
 
   route.delete(
     '/-/npm/v1/tokens/token/:tokenKey',
+    rateLimit(config?.userRateLimit),
     async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {
       const {
         params: { tokenKey },

packages/api/test/integration/_helper.ts

@@ -11,12 +11,12 @@ import {
   generatePackageMetadata,
   initializeServer as initializeServerHelper,
 } from '@verdaccio/test-helper';
-import { GenericBody } from '@verdaccio/types';
+import { GenericBody, PackageUsers } from '@verdaccio/types';
 import { buildToken, generateRandomHexString } from '@verdaccio/utils';
 
 import apiMiddleware from '../../src';
 
-setup();
+setup({});
 
 export const getConf = (conf) => {
   const configPath = path.join(__dirname, 'config', conf);
@@ -39,6 +39,7 @@ export function createUser(app, name: string, password: string): supertest.Test
       password: password,
     })
     .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+    .expect(HEADERS.CACHE_CONTROL, 'no-cache, no-store')
     .expect(HTTP_STATUS.CREATED);
 }
 
@@ -91,16 +92,54 @@ export function publishVersion(
   app,
   pkgName: string,
   version: string,
-  distTags?: GenericBody
+  distTags?: GenericBody,
+  token?: string
 ): supertest.Test {
   const pkgMetadata = generatePackageMetadata(pkgName, version, distTags);
 
-  return supertest(app)
+  const test = supertest(app)
     .put(`/${encodeURIComponent(pkgName)}`)
     .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
     .send(JSON.stringify(pkgMetadata))
     .set('accept', HEADERS.GZIP)
     .set(HEADER_TYPE.ACCEPT_ENCODING, HEADERS.JSON);
+
+  if (typeof token === 'string') {
+    test.set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token));
+  }
+
+  return test;
+}
+
+export function starPackage(
+  app,
+  options: {
+    users: PackageUsers;
+    name: string;
+    _rev: string;
+    _id?: string;
+  },
+  token?: string
+): supertest.Test {
+  const { _rev, _id, users } = options;
+  const starManifest = {
+    _rev,
+    _id,
+    users,
+  };
+
+  const test = supertest(app)
+    .put(`/${encodeURIComponent(options.name)}`)
+    .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+    .send(JSON.stringify(starManifest))
+    .set('accept', HEADERS.GZIP)
+    .set(HEADER_TYPE.ACCEPT_ENCODING, HEADERS.JSON);
+
+  if (typeof token === 'string') {
+    test.set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token));
+  }
+
+  return test;
 }
 
 export function getDisTags(app, pkgName) {

packages/api/test/integration/config/star.yaml

@@ -0,0 +1,26 @@
+auth:
+  htpasswd:
+    file: ./htpasswd-star
+web:
+  enable: true
+  title: verdaccio
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+
+log: { type: stdout, format: pretty, level: info }
+
+packages:
+  '@*/*':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+    proxy: npmjs
+  '**':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+    proxy: npmjs
+
+_debug: true

packages/api/test/integration/publish.spec.ts

@@ -6,38 +6,8 @@ import { HTTP_STATUS } from '@verdaccio/core';
 import { API_ERROR, API_MESSAGE, HEADERS, HEADER_TYPE } from '@verdaccio/core';
 import { generatePackageMetadata, generateRemotePackageMetadata } from '@verdaccio/test-helper';
 
-import { $RequestExtend, $ResponseExtend } from '../../types/custom';
 import { getPackage, initializeServer, publishVersion } from './_helper';
 
-const mockApiJWTmiddleware = jest.fn(
-  () =>
-    (req: $RequestExtend, res: $ResponseExtend, _next): void => {
-      req.remote_user = { name: 'foo', groups: [], real_groups: [] };
-      _next();
-    }
-);
-
-jest.mock('@verdaccio/auth', () => ({
-  Auth: class {
-    apiJWTmiddleware() {
-      return mockApiJWTmiddleware();
-    }
-    init() {
-      return Promise.resolve();
-    }
-    allow_access(_d, f_, cb) {
-      cb(null, true);
-    }
-    allow_publish(_d, f_, cb) {
-      cb(null, true);
-    }
-
-    allow_unpublish(_d, f_, cb) {
-      cb(null, true);
-    }
-  },
-}));
-
 describe('publish', () => {
   describe('handle errors', () => {
     const pkgName = 'test';
@@ -80,6 +50,22 @@ describe('publish', () => {
           });
       });
     });
+
+    test.each([['foo', '@scope/foo']])(
+      'should fails on publish a duplicated package',
+      async (pkgName) => {
+        const app = await initializeServer('publish.yaml');
+        await publishVersion(app, pkgName, '1.0.0');
+        return new Promise((resolve) => {
+          publishVersion(app, pkgName, '1.0.0')
+            .expect(HTTP_STATUS.CONFLICT)
+            .then((response) => {
+              expect(response.body.error).toEqual(API_ERROR.PACKAGE_EXIST);
+              resolve(response);
+            });
+        });
+      }
+    );
   });
 
   describe('publish a package', () => {
@@ -141,6 +127,7 @@ describe('publish', () => {
         });
       });
     });
+
     describe('proxies setup', () => {
       test.each([['foo', '@scope%2Ffoo']])(
         'should publish a a patch package that already exist on a remote',
@@ -172,22 +159,6 @@ describe('publish', () => {
     });
   });
 
-  test.each([['foo', '@scope/foo']])(
-    'should fails on publish a duplicated package',
-    async (pkgName) => {
-      const app = await initializeServer('publish.yaml');
-      await publishVersion(app, pkgName, '1.0.0');
-      return new Promise((resolve) => {
-        publishVersion(app, pkgName, '1.0.0')
-          .expect(HTTP_STATUS.CONFLICT)
-          .then((response) => {
-            expect(response.body.error).toEqual(API_ERROR.PACKAGE_EXIST);
-            resolve(response);
-          });
-      });
-    }
-  );
-
   describe('unpublish a package', () => {
     test.each([['foo', '@scope/foo']])('should unpublish entirely a package', async (pkgName) => {
       const app = await initializeServer('publish.yaml');
@@ -257,6 +228,4 @@ describe('publish', () => {
       }
     );
   });
-
-  describe('star a package', () => {});
 });

packages/api/test/integration/star.spec.ts

@@ -0,0 +1,73 @@
+import nock from 'nock';
+import supertest from 'supertest';
+
+import { HTTP_STATUS } from '@verdaccio/core';
+import { HEADERS, HEADER_TYPE } from '@verdaccio/core';
+
+import { getNewToken, getPackage, initializeServer, publishVersion, starPackage } from './_helper';
+
+describe('star', () => {
+  test.each([['foo', '@scope%2Ffoo']])(
+    'should list stared packages for an user',
+    async (pkgName) => {
+      const userLogged = 'jota_token';
+      nock('https://registry.npmjs.org').get(`/${pkgName}`).reply(404);
+      const app = await initializeServer('star.yaml');
+      const token = await getNewToken(app, { name: userLogged, password: 'secretPass' });
+      await publishVersion(app, pkgName, '1.0.0', undefined, token).expect(HTTP_STATUS.CREATED);
+      await publishVersion(app, 'pkg-1', '1.0.0', undefined, token).expect(HTTP_STATUS.CREATED);
+      await publishVersion(app, 'pkg-2', '1.0.0', undefined, token).expect(HTTP_STATUS.CREATED);
+      const manifest = await getPackage(app, '', decodeURIComponent(pkgName));
+      await starPackage(
+        app,
+        {
+          _rev: manifest.body._rev,
+          _id: manifest.body.id,
+          name: pkgName,
+          users: { [userLogged]: true },
+        },
+        token
+      ).expect(HTTP_STATUS.CREATED);
+      await starPackage(
+        app,
+        {
+          _rev: manifest.body._rev,
+          _id: manifest.body.id,
+          name: 'pkg-1',
+          users: { [userLogged]: true },
+        },
+        token
+      ).expect(HTTP_STATUS.CREATED);
+      await starPackage(
+        app,
+        {
+          _rev: manifest.body._rev,
+          _id: manifest.body.id,
+          name: 'pkg-2',
+          users: { [userLogged]: true },
+        },
+        token
+      ).expect(HTTP_STATUS.CREATED);
+      const resp = await supertest(app)
+        .get(`/-/_view/starredByUser?key=%22jota_token%22`)
+        .set('Accept', HEADERS.JSON)
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      expect(resp.body.rows).toHaveLength(3);
+      expect(resp.body.rows).toEqual([{ value: 'foo' }, { value: 'pkg-1' }, { value: 'pkg-2' }]);
+    }
+  );
+
+  test.each([['foo']])('should requires parameters', async (pkgName) => {
+    const userLogged = 'jota_token';
+    nock('https://registry.npmjs.org').get(`/${pkgName}`).reply(404);
+    const app = await initializeServer('star.yaml');
+    const token = await getNewToken(app, { name: userLogged, password: 'secretPass' });
+    await publishVersion(app, pkgName, '1.0.0', undefined, token).expect(HTTP_STATUS.CREATED);
+    return supertest(app)
+      .get(`/-/_view/starredByUser?key_xxxxx=other`)
+      .set('Accept', HEADERS.JSON)
+      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+      .expect(HTTP_STATUS.BAD_REQUEST);
+  });
+});

packages/api/tsconfig.json

@@ -23,7 +23,7 @@
       "path": "../hooks"
     },
     {
-      "path": "../logger"
+      "path": "../logger/logger"
     },
     {
       "path": "../middleware"

packages/api/types/custom.d.ts

@@ -2,7 +2,7 @@ import { NextFunction, Request, Response } from 'express';
 
 import { Logger, RemoteUser } from '@verdaccio/types';
 
-export type $RequestExtend = Request & { remote_user?: any; log: Logger };
+export type $RequestExtend = Request & { remote_user?: any; log: Logger; query?: { key: string } };
 export type $ResponseExtend = Response & { cookies?: any };
 export type $NextFunctionVer = NextFunction & any;
 

packages/auth/CHANGELOG.md

@@ -1,5 +1,146 @@
 # @verdaccio/auth
 
+## 6.0.0-6-next.40
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/config@6.0.0-6-next.61
+  - @verdaccio/loaders@6.0.0-6-next.30
+  - verdaccio-htpasswd@11.0.0-6-next.31
+  - @verdaccio/core@6.0.0-6-next.61
+  - @verdaccio/utils@6.0.0-6-next.29
+  - @verdaccio/logger@6.0.0-6-next.29
+
+## 6.0.0-6-next.39
+
+### Patch Changes
+
+- Updated dependencies [45c03819]
+  - @verdaccio/config@6.0.0-6-next.60
+  - @verdaccio/loaders@6.0.0-6-next.29
+  - verdaccio-htpasswd@11.0.0-6-next.30
+  - @verdaccio/core@6.0.0-6-next.60
+  - @verdaccio/logger@6.0.0-6-next.28
+  - @verdaccio/utils@6.0.0-6-next.28
+
+## 6.0.0-6-next.38
+
+### Patch Changes
+
+- Updated dependencies [65f88b82]
+  - @verdaccio/logger@6.0.0-6-next.27
+  - @verdaccio/loaders@6.0.0-6-next.28
+  - verdaccio-htpasswd@11.0.0-6-next.29
+  - @verdaccio/core@6.0.0-6-next.59
+  - @verdaccio/config@6.0.0-6-next.59
+  - @verdaccio/utils@6.0.0-6-next.27
+
+## 6.0.0-6-next.37
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.58
+- @verdaccio/config@6.0.0-6-next.58
+- @verdaccio/loaders@6.0.0-6-next.27
+- verdaccio-htpasswd@11.0.0-6-next.28
+- @verdaccio/utils@6.0.0-6-next.26
+- @verdaccio/logger@6.0.0-6-next.26
+
+## 6.0.0-6-next.36
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.57
+- @verdaccio/config@6.0.0-6-next.57
+- @verdaccio/loaders@6.0.0-6-next.26
+- @verdaccio/logger@6.0.0-6-next.25
+- verdaccio-htpasswd@11.0.0-6-next.27
+- @verdaccio/utils@6.0.0-6-next.25
+
+## 6.0.0-6-next.35
+
+### Patch Changes
+
+- Updated dependencies [a1986e09]
+  - @verdaccio/utils@6.0.0-6-next.24
+  - @verdaccio/config@6.0.0-6-next.56
+  - @verdaccio/loaders@6.0.0-6-next.25
+  - verdaccio-htpasswd@11.0.0-6-next.26
+  - @verdaccio/core@6.0.0-6-next.56
+  - @verdaccio/logger@6.0.0-6-next.24
+
+## 6.0.0-6-next.34
+
+### Patch Changes
+
+- Updated dependencies [9718e033]
+  - @verdaccio/config@6.0.0-6-next.55
+  - @verdaccio/core@6.0.0-6-next.55
+  - @verdaccio/utils@6.0.0-6-next.23
+  - @verdaccio/loaders@6.0.0-6-next.24
+  - verdaccio-htpasswd@11.0.0-6-next.25
+  - @verdaccio/logger@6.0.0-6-next.23
+
+## 6.0.0-6-next.33
+
+### Patch Changes
+
+- Updated dependencies [ef88da3b]
+  - @verdaccio/config@6.0.0-6-next.54
+  - @verdaccio/core@6.0.0-6-next.54
+  - @verdaccio/loaders@6.0.0-6-next.23
+  - @verdaccio/logger@6.0.0-6-next.22
+  - @verdaccio/utils@6.0.0-6-next.22
+  - verdaccio-htpasswd@11.0.0-6-next.24
+
+## 6.0.0-6-next.32
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.53
+- @verdaccio/loaders@6.0.0-6-next.22
+- @verdaccio/logger@6.0.0-6-next.21
+- verdaccio-htpasswd@11.0.0-6-next.23
+- @verdaccio/config@6.0.0-6-next.53
+- @verdaccio/utils@6.0.0-6-next.21
+
+## 6.0.0-6-next.31
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.52
+- @verdaccio/config@6.0.0-6-next.52
+- @verdaccio/loaders@6.0.0-6-next.21
+- @verdaccio/logger@6.0.0-6-next.20
+- verdaccio-htpasswd@11.0.0-6-next.22
+- @verdaccio/utils@6.0.0-6-next.20
+
+## 6.0.0-6-next.30
+
+### Minor Changes
+
+- 4b29d715: chore: move improvements from v5 to v6
+
+  Migrate improvements form v5 to v6:
+
+  - https://github.com/verdaccio/verdaccio/pull/3158
+  - https://github.com/verdaccio/verdaccio/pull/3151
+  - https://github.com/verdaccio/verdaccio/pull/2271
+  - https://github.com/verdaccio/verdaccio/pull/2787
+  - https://github.com/verdaccio/verdaccio/pull/2791
+  - https://github.com/verdaccio/verdaccio/pull/2205
+
+### Patch Changes
+
+- Updated dependencies [4b29d715]
+  - @verdaccio/config@6.0.0-6-next.51
+  - @verdaccio/core@6.0.0-6-next.51
+  - @verdaccio/loaders@6.0.0-6-next.20
+  - verdaccio-htpasswd@11.0.0-6-next.21
+  - @verdaccio/logger@6.0.0-6-next.19
+  - @verdaccio/utils@6.0.0-6-next.19
+
 ## 6.0.0-6-next.29
 
 ### Patch Changes

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "6.0.0-6-next.29",
+  "version": "6.0.0-6-next.40",
   "description": "logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -39,19 +39,19 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "workspace:6.0.0-6-next.50",
-    "@verdaccio/config": "workspace:6.0.0-6-next.50",
-    "@verdaccio/loaders": "workspace:6.0.0-6-next.19",
-    "@verdaccio/logger": "workspace:6.0.0-6-next.18",
-    "@verdaccio/utils": "workspace:6.0.0-6-next.18",
+    "@verdaccio/core": "workspace:6.0.0-6-next.61",
+    "@verdaccio/config": "workspace:6.0.0-6-next.61",
+    "@verdaccio/loaders": "workspace:6.0.0-6-next.30",
+    "@verdaccio/logger": "workspace:6.0.0-6-next.29",
+    "@verdaccio/utils": "workspace:6.0.0-6-next.29",
     "debug": "4.3.4",
     "express": "4.18.2",
-    "jsonwebtoken": "8.5.1",
+    "jsonwebtoken": "9.0.0",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "workspace:11.0.0-6-next.20"
+    "verdaccio-htpasswd": "workspace:11.0.0-6-next.31"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:11.0.0-6-next.17"
+    "@verdaccio/types": "workspace:11.0.0-6-next.20"
   },
   "funding": {
     "type": "opencollective",

packages/auth/src/auth.ts

@@ -574,7 +574,9 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     const { real_groups, name, groups } = user;
     debug('jwt encrypt %o', name);
     const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;
-    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);
+    const groupedGroups = _.isNil(groups)
+      ? real_groups
+      : Array.from(new Set([...groups.concat(realGroupsValidated)]));
     const payload: RemoteUser = {
       real_groups: realGroupsValidated,
       name,

packages/auth/test/auth-utils.spec.ts

@@ -77,8 +77,8 @@ describe('Auth utilities', () => {
     const spyNotCalled = jest.spyOn(auth, methodNotBeenCalled);
     const user: RemoteUser = {
       name: username,
-      real_groups: [],
-      groups: [],
+      real_groups: ['test', '$all', '$authenticated', '@all', '@authenticated', 'all'],
+      groups: ['company-role1', 'company-role2'],
     };
     const token = await getApiToken(auth, config, user, password);
     expect(spy).toHaveBeenCalled();
@@ -93,7 +93,25 @@ describe('Auth utilities', () => {
     const payload = verifyPayload(token, secret);
     expect(payload.name).toBe(user);
     expect(payload.groups).toBeDefined();
+    expect(payload.groups).toEqual([
+      'company-role1',
+      'company-role2',
+      'test',
+      '$all',
+      '$authenticated',
+      '@all',
+      '@authenticated',
+      'all',
+    ]);
     expect(payload.real_groups).toBeDefined();
+    expect(payload.real_groups).toEqual([
+      'test',
+      '$all',
+      '$authenticated',
+      '@all',
+      '@authenticated',
+      'all',
+    ]);
   };
 
   const verifyAES = (token: string, user: string, password: string, secret: string) => {
@@ -219,6 +237,30 @@ describe('Auth utilities', () => {
     });
   });
 
+  describe('createRemoteUser', () => {
+    test('create remote user', () => {
+      expect(createRemoteUser('test', [])).toEqual({
+        name: 'test',
+        real_groups: [],
+        groups: ['$all', '$authenticated', '@all', '@authenticated', 'all'],
+      });
+    });
+    test('create remote user with groups', () => {
+      expect(createRemoteUser('test', ['group1', 'group2'])).toEqual({
+        name: 'test',
+        real_groups: ['group1', 'group2'],
+        groups: ['group1', 'group2', '$all', '$authenticated', '@all', '@authenticated', 'all'],
+      });
+    });
+    test('create anonymous remote user', () => {
+      expect(createAnonymousRemoteUser()).toEqual({
+        name: undefined,
+        real_groups: [],
+        groups: ['$all', '$anonymous', '@all', '@anonymous'],
+      });
+    });
+  });
+
   describe('getApiToken test', () => {
     test('should sign token with aes and security missing', async () => {
       const token = await getTokenByConfiguration(
@@ -445,15 +487,13 @@ describe('Auth utilities', () => {
           security,
           '12345',
           buildToken(TOKEN_BEARER, 'fakeToken')
-        );
+        ) as RemoteUser;
 
         expect(credentials).toBeDefined();
-        // @ts-ignore
         expect(credentials.name).not.toBeDefined();
-        // @ts-ignore
         expect(credentials.real_groups).toBeDefined();
-        // @ts-ignore
-        expect(credentials.real_groups).toEqual([]);
+
+        expect(credentials.groups).toEqual(['$all', '$anonymous', '@all', '@anonymous']);
       });
 
       test('should return anonymous whether token and scheme are corrupted', () => {
@@ -485,14 +525,29 @@ describe('Auth utilities', () => {
           security,
           secret,
           buildToken(TOKEN_BEARER, token)
-        );
+        ) as RemoteUser;
         expect(credentials).toBeDefined();
-        // @ts-ignore
+
         expect(credentials.name).toEqual(user);
-        // @ts-ignore
         expect(credentials.real_groups).toBeDefined();
-        // @ts-ignore
-        expect(credentials.real_groups).toEqual([]);
+        expect(credentials.real_groups).toEqual([
+          'test',
+          '$all',
+          '$authenticated',
+          '@all',
+          '@authenticated',
+          'all',
+        ]);
+        expect(credentials.groups).toEqual([
+          'company-role1',
+          'company-role2',
+          'test',
+          '$all',
+          '$authenticated',
+          '@all',
+          '@authenticated',
+          'all',
+        ]);
       });
     });
   });

packages/auth/tsconfig.json

@@ -20,7 +20,7 @@
       "path": "../loaders"
     },
     {
-      "path": "../logger"
+      "path": "../logger/logger"
     },
     {
       "path": "../utils"

packages/cli/CHANGELOG.md

@@ -1,5 +1,110 @@
 # @verdaccio/cli
 
+## 6.0.0-6-next.61
+
+### Patch Changes
+
+- Updated dependencies [d167f92e]
+  - @verdaccio/config@6.0.0-6-next.61
+  - @verdaccio/node-api@6.0.0-6-next.61
+  - @verdaccio/core@6.0.0-6-next.61
+  - @verdaccio/logger@6.0.0-6-next.29
+
+## 6.0.0-6-next.60
+
+### Patch Changes
+
+- Updated dependencies [45c03819]
+  - @verdaccio/config@6.0.0-6-next.60
+  - @verdaccio/node-api@6.0.0-6-next.60
+  - @verdaccio/core@6.0.0-6-next.60
+  - @verdaccio/logger@6.0.0-6-next.28
+
+## 6.0.0-6-next.59
+
+### Patch Changes
+
+- Updated dependencies [65f88b82]
+  - @verdaccio/logger@6.0.0-6-next.27
+  - @verdaccio/node-api@6.0.0-6-next.59
+  - @verdaccio/core@6.0.0-6-next.59
+  - @verdaccio/config@6.0.0-6-next.59
+
+## 6.0.0-6-next.58
+
+### Patch Changes
+
+- @verdaccio/node-api@6.0.0-6-next.58
+- @verdaccio/core@6.0.0-6-next.58
+- @verdaccio/config@6.0.0-6-next.58
+- @verdaccio/logger@6.0.0-6-next.26
+
+## 6.0.0-6-next.57
+
+### Patch Changes
+
+- @verdaccio/node-api@6.0.0-6-next.57
+- @verdaccio/core@6.0.0-6-next.57
+- @verdaccio/config@6.0.0-6-next.57
+- @verdaccio/logger@6.0.0-6-next.25
+
+## 6.0.0-6-next.56
+
+### Patch Changes
+
+- @verdaccio/config@6.0.0-6-next.56
+- @verdaccio/node-api@6.0.0-6-next.56
+- @verdaccio/core@6.0.0-6-next.56
+- @verdaccio/logger@6.0.0-6-next.24
+
+## 6.0.0-6-next.55
+
+### Patch Changes
+
+- Updated dependencies [9718e033]
+  - @verdaccio/config@6.0.0-6-next.55
+  - @verdaccio/core@6.0.0-6-next.55
+  - @verdaccio/node-api@6.0.0-6-next.55
+  - @verdaccio/logger@6.0.0-6-next.23
+
+## 6.0.0-6-next.54
+
+### Patch Changes
+
+- Updated dependencies [ef88da3b]
+  - @verdaccio/config@6.0.0-6-next.54
+  - @verdaccio/core@6.0.0-6-next.54
+  - @verdaccio/logger@6.0.0-6-next.22
+  - @verdaccio/node-api@6.0.0-6-next.54
+
+## 6.0.0-6-next.53
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.53
+- @verdaccio/logger@6.0.0-6-next.21
+- @verdaccio/node-api@6.0.0-6-next.53
+- @verdaccio/config@6.0.0-6-next.53
+
+## 6.0.0-6-next.52
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.52
+- @verdaccio/config@6.0.0-6-next.52
+- @verdaccio/node-api@6.0.0-6-next.52
+- @verdaccio/logger@6.0.0-6-next.20
+
+## 6.0.0-6-next.51
+
+### Patch Changes
+
+- Updated dependencies [4b29d715]
+  - @verdaccio/config@6.0.0-6-next.51
+  - @verdaccio/core@6.0.0-6-next.51
+  - @verdaccio/node-api@6.0.0-6-next.51
+  - @verdaccio/logger@6.0.0-6-next.19
+
 ## 6.0.0-6-next.50
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/cli",
-  "version": "6.0.0-6-next.50",
+  "version": "6.0.0-6-next.61",
   "author": {
     "name": "Juan Picado",
     "email": "juanpicado19@gmail.com"
@@ -44,10 +44,10 @@
     "start": "ts-node src/index.ts"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:6.0.0-6-next.50",
-    "@verdaccio/config": "workspace:6.0.0-6-next.50",
-    "@verdaccio/logger": "workspace:6.0.0-6-next.18",
-    "@verdaccio/node-api": "workspace:6.0.0-6-next.50",
+    "@verdaccio/core": "workspace:6.0.0-6-next.61",
+    "@verdaccio/config": "workspace:6.0.0-6-next.61",
+    "@verdaccio/logger": "workspace:6.0.0-6-next.29",
+    "@verdaccio/node-api": "workspace:6.0.0-6-next.61",
     "clipanion": "3.1.0",
     "envinfo": "7.8.1",
     "kleur": "3.0.3",