chore: update versions (next-8) (#5438)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.changeset/beige-cars-raise.md

@@ -0,0 +1,5 @@
+---
+'verdaccio-memory': minor
+---
+
+feat: rewrite of memory storage

.changeset/beige-timers-greet.md

@@ -0,0 +1,10 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/file-locking': patch
+'@verdaccio/core': patch
+'verdaccio': patch
+'@verdaccio/loaders': patch
+'@verdaccio/config': patch
+---
+
+chore: replace conditional require(fs/promises) pattern

.changeset/brave-rockets-remember.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/core': patch
+'@verdaccio/store': patch
+---
+
+fix(storage): check_owners with anonymous access

.changeset/bright-mugs-buy.md

@@ -0,0 +1,21 @@
+---
+'docusaurus-plugin-contributors': patch
+'generator-verdaccio-plugin': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/local-scripts': patch
+'@verdaccio/file-locking': patch
+'@verdaccio/ui-theme': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/middleware': patch
+'verdaccio': patch
+'@verdaccio/node-api': patch
+'@verdaccio/config': patch
+'@verdaccio/hooks': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+---
+
+chore(deps): built-in node imports

.changeset/cuddly-paws-laugh.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/config': patch
+'@verdaccio/logger-commons': patch
+'@verdaccio/types': patch
+---
+
+feat(logger): support redacting sensitive data

.changeset/curvy-bananas-complain.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/node-api': patch
+'@verdaccio/config': patch
+---
+
+fix(config): avoid warning for multiple addresses

.changeset/dry-cups-hear.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/test-helper': patch
+'@verdaccio/api': patch
+'@verdaccio/web': patch
+---
+
+chore: publish @verdaccio/test-helper

.changeset/friendly-worms-drum.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/config': patch
+---
+
+chore: add types for createConfigFolder

.changeset/gold-parents-shave.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/core': minor
+'@verdaccio/node-api': minor
+'@verdaccio/config': minor
+---
+
+feat: getListenAddress getConfigParsed methods

.changeset/mean-timers-look.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/server': patch
+---
+
+chore(express): housekeeping

.changeset/pre.json

@@ -68,12 +68,16 @@
     "afraid-cars-sneeze",
     "afraid-cheetahs-rule",
     "angry-doors-tan",
+    "beige-cars-raise",
     "beige-lions-type",
+    "beige-timers-greet",
     "blue-paws-cheer",
     "brave-ears-drive",
+    "brave-rockets-remember",
     "breezy-geckos-search",
     "breezy-toys-judge",
     "bright-bobcats-ring",
+    "bright-mugs-buy",
     "brown-lions-talk",
     "brown-planets-approve",
     "calm-mangos-compare",
@@ -84,10 +88,13 @@
     "clever-bees-happen",
     "cool-balloons-search",
     "cool-seals-watch",
+    "cuddly-paws-laugh",
     "curly-mirrors-smile",
+    "curvy-bananas-complain",
     "curvy-rockets-camp",
     "cyan-snakes-kiss",
     "dirty-countries-play",
+    "dry-cups-hear",
     "early-eyes-float",
     "early-trainers-grin",
     "eight-countries-think",
@@ -102,10 +109,12 @@
     "four-buttons-remember",
     "fresh-owls-hunt",
     "friendly-feet-sing",
+    "friendly-worms-drum",
     "funny-fireants-tan",
     "fuzzy-ears-yawn",
     "gentle-stingrays-repeat",
     "gold-files-speak",
+    "gold-parents-shave",
     "gold-squids-watch",
     "great-candles-hang",
     "green-eagles-boil",
@@ -123,6 +132,7 @@
     "long-singers-drive",
     "loud-dingos-cough",
     "lucky-crabs-enjoy",
+    "mean-timers-look",
     "modern-llamas-know",
     "nasty-cooks-watch",
     "nasty-experts-bow",
@@ -138,19 +148,25 @@
     "poor-hats-smile",
     "poor-queens-shop",
     "popular-trees-grin",
+    "pretty-beds-destroy",
+    "pretty-carrots-smash",
+    "pretty-news-do",
     "proud-houses-switch",
     "purple-planes-do",
     "quick-avocados-type",
     "quick-seas-deny",
+    "rare-mirrors-notice",
     "real-balloons-travel",
     "real-seahorses-change",
     "red-dolls-repair",
+    "rotten-bananas-attend",
     "rotten-melons-notice",
     "rotton-readers-shave",
     "rude-birds-design",
     "rude-socks-walk",
     "serious-apes-rule",
     "seven-peas-obey",
+    "seven-suits-kneel",
     "sharp-queens-rhyme",
     "shiny-buttons-laugh",
     "short-mails-smoke",
@@ -166,6 +182,7 @@
     "strange-pants-chew",
     "stupid-camels-build",
     "stupid-socks-grow",
+    "sweet-bulldogs-doubt",
     "sweet-crabs-deliver",
     "swift-knives-shop",
     "swift-mangos-grab",
@@ -181,12 +198,14 @@
     "tricky-kiwis-thank",
     "tricky-knives-end",
     "twelve-games-wonder",
+    "twelve-socks-accept",
     "violet-baboons-beg",
     "violet-bobcats-allow",
     "violet-boxes-float",
     "violet-poems-walk",
     "weak-cherries-serve",
     "wet-cats-behave",
+    "wet-comics-listen",
     "wicked-points-relate",
     "wild-coins-lie",
     "yellow-flies-sniff"

.changeset/pretty-beds-destroy.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/core': patch
+---
+
+fix: restore minimatch major version

.changeset/pretty-carrots-smash.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/store': patch
+---
+
+Fix inconsistency in filter plugin invocation upon receiving 304 from uplink after uplink.maxage has passed

.changeset/pretty-news-do.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/types': patch
+---
+
+fix: minor logger missing type

.changeset/rare-mirrors-notice.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/auth': patch
+---
+
+chore(auth): typings

.changeset/rotten-bananas-attend.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/auth': patch
+---
+
+chore(auth): multiple plugins test

.changeset/seven-suits-kneel.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/proxy': patch
+---
+
+chore(proxy): update tests

.changeset/sweet-bulldogs-doubt.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/local-scripts': patch
+'@verdaccio/website': patch
+---
+
+fix(docs): warnings during website build (2)

.changeset/twelve-socks-accept.md

@@ -0,0 +1,12 @@
+---
+'verdaccio-auth-memory': patch
+'@verdaccio/local-scripts': patch
+'@verdaccio/ui-theme': patch
+'@verdaccio/ui-components': patch
+'@verdaccio/tarball': patch
+'@verdaccio/proxy': patch
+'@verdaccio/website': patch
+'@verdaccio/e2e-ui': patch
+---
+
+chore(deps): sync and pin dependencies

.changeset/wet-comics-listen.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/local-scripts': patch
+'@verdaccio/website': patch
+---
+
+fix(docs): warnings during website build

.github/actions/build-app/action.yml

@@ -16,7 +16,7 @@ runs:
     - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
       uses: ./.github/actions/install-app-node
       with:
-        node-version: ${{ inputs.node_version }}
+        node-version: ${{ inputs.node-version }}
     - name: build
       run: pnpm build
       shell: bash

.github/actions/cache-packages/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - name: Cache Packages
       id: cache-packages
-      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ./packages/
         key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}

.github/actions/cache-store/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - name: Cache .pnpm-store
       id: cache-npm
-      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ~/.pnpm-store
         key: pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ github.event.pull_request.number }}-${{ runner.os }}

.github/workflows/changesets-pr.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.event.pull_request.head.repo.fork == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
       - name: crowdin download

.github/workflows/changesets.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
       - name: crowdin download

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
             --health-timeout=20s    
             --health-retries=6
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
   lint:
@@ -43,7 +43,7 @@ jobs:
     name: Lint
     needs: prepare
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
         with:
@@ -55,7 +55,7 @@ jobs:
     name: Format
     needs: prepare
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
         with:
@@ -68,11 +68,11 @@ jobs:
       fail-fast: true
       matrix:
         os: [ubuntu-latest]
-        node_version: [18, 20, 21, 22, 23, 24]
+        node_version: [18, 20, 22, 24]
     name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Build application with Node ${{ matrix.node_version }}
         uses: ./.github/actions/build-app
         with:
@@ -85,7 +85,7 @@ jobs:
     name: synchronize translations
     if: (github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio') || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
@@ -94,7 +94,7 @@ jobs:
           npm install --global corepack@latest
           corepack enable
           corepack install
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/codeql-analysis.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -37,7 +37,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
         with:
           config: |
             paths-ignore:
@@ -50,7 +50,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -64,4 +64,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5

.github/workflows/docker-proxy-apache-e2e.yml

@@ -20,7 +20,7 @@ jobs:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       
     - name: Start containers
       run: docker compose -f "./e2e/docker/apache-verdaccio/docker-compose.yaml" up -d --build

.github/workflows/docker-proxy-nginx-e2e.yml

@@ -18,7 +18,7 @@ jobs:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       
     - name: Start containers
       run: docker compose -f "./e2e/docker/proxy-nginx/docker-compose.yaml" up -d --build

.github/workflows/docker-publish.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'verdaccio/verdaccio'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
@@ -34,7 +34,7 @@ jobs:
 
       - name: Prepare Docker image tags
         id: docker_meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           images: ${{ github.repository }}
           tags: |

.github/workflows/e2e-ci.yml

@@ -1,11 +1,14 @@
 name: E2E CLI
 
 on: [pull_request]
+
 permissions:
   contents: read
+
 concurrency:
   group: e2e-ci-${{ github.ref }}
   cancel-in-progress: true
+
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -18,22 +21,12 @@ jobs:
         env:
           NODE_ENV: production
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
-  build:
-    needs: [prepare]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Build application with Node ${{ matrix.node_version }}
-        uses: ./.github/actions/build-app
-        with:
-          node-version: ${{ matrix.node_version }}
-      - name: Cache packages
-        uses: ./.github/actions/cache-packages
+
   e2e-cli-npm:
-    needs: [prepare, build]
+    needs: [prepare]
     strategy:
       fail-fast: false
       matrix:
@@ -47,23 +40,25 @@ jobs:
             npm11,
           ]
         node: [22, 24]
-    name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
+    name: ${{ matrix.pkg }} / ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Build application with Node ${{ matrix.node }}
+        uses: ./.github/actions/build-app
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install dependencies with a custom registry version ${{ matrix.node }}
         uses: ./.github/actions/install-app-node
         with:
-          node-version: ${{ inputs.node_version }}
+          node-version: ${{ matrix.node }}
           reporter: 'default'
           loglevel: 'debug'
-      - name: Restore cache pnpm store
-        uses: ./.github/actions/cache-packages
       - name: Test CLI
         run: cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
 
   e2e-cli-pnpm:
-    needs: [prepare, build]
+    needs: [prepare]
     strategy:
       fail-fast: true
       matrix:
@@ -73,23 +68,26 @@ jobs:
             pnpm9,
             pnpm10,
           ]
-        node: [2, 24]
-    name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
+        node: [22, 24]
+    name: ${{ matrix.pkg }} / ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Build application with Node ${{ matrix.node }}
+        uses: ./.github/actions/build-app
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install dependencies with a custom registry version ${{ matrix.node }}
         uses: ./.github/actions/install-app-node
         with:
-          node-version: ${{ inputs.node_version }}
+          node-version: ${{ matrix.node }}
           reporter: 'default'
           loglevel: 'debug'
-      - name: Restore cache pnpm store
-        uses: ./.github/actions/cache-packages
       - name: Test CLI
-        run:  cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
+        run: cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
+
   e2e-cli-yarn:
-    needs: [prepare, build]
+    needs: [prepare]
     strategy:
       fail-fast: false
       matrix:
@@ -101,18 +99,19 @@ jobs:
             yarn4
           ]
         node: [22, 24]
-    name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
+    name: ${{ matrix.pkg }} / ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Build application with Node ${{ matrix.node }}
+        uses: ./.github/actions/build-app
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install dependencies with a custom registry version ${{ matrix.node }}
         uses: ./.github/actions/install-app-node
         with:
-          node-version: ${{ inputs.node_version }}
+          node-version: ${{ matrix.node }}
           reporter: 'default'
           loglevel: 'debug'
-      - name: Restore cache pnpm store
-        uses: ./.github/actions/cache-packages
       - name: Test CLI
         run: cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
-

.github/workflows/e2e-ui.yml

@@ -19,7 +19,7 @@ jobs:
         env:
           NODE_ENV: production
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Build application with Node 20
         uses: ./.github/actions/build-app
         with:

.github/workflows/plugin-generator-e2e.yaml

@@ -16,15 +16,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [20, 22, 23]
+        node-version: [20, 22, 24]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Build application with Node ${{ matrix.node_version }}
         uses: ./.github/actions/build-app
         with:
           node-version: ${{ matrix.node_version }}
       - name: install verdaccio
-        run: npm install -g verdaccio@5
+        run: npm install -g verdaccio@6
       - name: Start server
         run: verdaccio -c e2e/docker/generator-e2e/generator.yaml &
       - name: ping server

.github/workflows/shared-docker-publish.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - uses: docker/setup-buildx-action@v1
         with:

.github/workflows/static-data.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/test-docker-build.yml

@@ -6,8 +6,25 @@ jobs:
     name: Test Docker Build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Build
-      run: docker build .
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - name: Build Docker image
+      run: docker build -t verdaccio-test .
       env:
         VERDACCIO_BUILD_REGISTRY: https://registry.npmjs.org
+    - name: Run Verdaccio in background
+      run: |
+        docker run -d --name verdaccio-test -p 4873:4873 verdaccio-test
+        sleep 10  # Give Verdaccio some time to start
+
+    - name: Test npm install from local Verdaccio
+      run: |
+        npm set registry http://localhost:4873
+        npm install -g verdaccio 
+
+    - name: Show Verdaccio logs (for debugging)
+      if: always()
+      run: docker logs verdaccio-test
+
+    - name: Stop Verdaccio
+      if: always()
+      run: docker stop verdaccio-test

.github/workflows/test-publish-package.yml

@@ -1,13 +1,20 @@
 on:
   workflow_call:
+    inputs:
+      verdaccio-version:
+        description: 'Verdaccio version to use'
+        required: false
+        default: 'latest'
+        type: string
 
 jobs:
   testVerdaccio:
     name: Test Verdaccio Publish
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Publish
-      uses: verdaccio/github-actions/publish@f2e0370cfa5d74d24c325017b701bfddc9cc2e5d # tag=v0.4.0
+      uses: verdaccio/github-actions/publish@master # always latest by design 
       with:
         args: -d
+        verdaccio-version: ${{ inputs.verdaccio-version }}

.github/workflows/ui-components.yml

@@ -21,7 +21,7 @@ jobs:
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
       - name: crowdin download

.github/workflows/website.yml

@@ -31,7 +31,7 @@ jobs:
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Build application with Node 20
         uses: ./.github/actions/build-app
         with:
@@ -39,7 +39,7 @@ jobs:
       - name: Build Translations percentage
         run: pnpm --filter @verdaccio/local-scripts build
       - name: Cache Docusaurus Build
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: website/node_modules/.cache/webpack
           key: cache/webpack-${{github.ref}}-${{ hashFiles('**/pnpm-lock.yaml') }}

.github/workflows/x-e2e-angular-cli-workflow.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

.github/workflows/x-e2e-audit-workflow.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

.github/workflows/x-e2e-gatsbyjs-cli-workflow.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

.github/workflows/x-e2e-jest-workflow.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -138,7 +138,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Use Node.js'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

.github/workflows/x-release-snapshot.yml

@@ -6,7 +6,7 @@ jobs:
     name: Release Snapshot
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Use Node (latest)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:

.github/workflows/x-release.yml

@@ -6,7 +6,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Use Node (latest)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:

.github/workflows/x-smok-test-docker.yml

@@ -16,7 +16,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'

.github/workflows/x-smok-test-module.yml

@@ -10,7 +10,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Use Node (latest)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:

.github/workflows/yarn-ci-lint.yml

@@ -6,7 +6,7 @@ jobs:
     name: Node Lint
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Use Node 
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:

.github/workflows/yarn-ci.yml

@@ -9,7 +9,7 @@ jobs:
     name: Node ${{ inputs.node_version }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Use Node ${{ inputs.node_version }}
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:

README.md

@@ -329,7 +329,7 @@ You can find and chat with them over Discord, click [here](http://chat.verdaccio
 - [NX](https://github.com/nrwl/nx) _(+6.1k ⭐️)_
 - [Mozilla Neutrino](https://github.com/neutrinojs/neutrino) _(+3.7k ⭐️)_
 - [workshopper how to npm](https://github.com/workshopper/how-to-npm) _(+1k ⭐️)_
-- [Amazon SDK v3](https://github.com/aws/aws-sdk-js-v3)
+- [Amazon SDK for JavaScript (v3)](https://github.com/aws/aws-sdk-js-v3)
 - [Amazon Encryption SDK for Javascript](https://github.com/aws/aws-encryption-sdk-javascript)
 
 🤓 Don't be shy, add yourself to this readme.

docker-examples/v4/docker-plugin-external/plugins/verdaccio-memory/package.json

@@ -16,9 +16,9 @@
     "build": "babel src/ --out-dir lib/ --copy-files --ignore ___tests___"
   },
   "dependencies": {
-    "@verdaccio/streams": "^1.0.0",
+    "@verdaccio/streams": "10.2.1",
     "http-errors": "1.6.3",
-    "memory-fs": "^0.4.1"
+    "memory-fs": "0.5.0"
   },
   "devDependencies": {
     "@commitlint/cli": "7.0.0",

docker-examples/v6/README.md

@@ -8,7 +8,7 @@
 
 ## Proxy
 
-- [Docker + Nginx + Verdaccio](proxy/reverse_proxy/nginx/README.md)
+- [Docker + Nginx + Verdaccio](reverse_proxy/nginx/README.md)
 - [Docker + Apache + Verdaccio](proxy/apache-verdaccio/README.md)
 - [Docker + HTTPS Portal + Verdaccio](proxy/https-portal-example/README.md)
 

e2e/cli/cli-commons/package.json

@@ -4,16 +4,16 @@
   "version": "2.0.0-next-8.1",
   "main": "src/index.ts",
   "devDependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.19",
-    "@verdaccio/core": "workspace:8.0.0-next-8.19",
-    "@verdaccio/types": "workspace:13.0.0-next-8.6",
-    "debug": "4.4.1",
+    "@verdaccio/config": "workspace:8.0.0-next-8.24",
+    "@verdaccio/core": "workspace:8.0.0-next-8.24",
+    "@verdaccio/types": "workspace:13.0.0-next-8.8",
+    "debug": "4.4.3",
     "fs-extra": "11.2.0",
     "get-port": "5.1.1",
     "got": "11.8.6",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "verdaccio": "workspace:8.0.0-next-8.19"
+    "verdaccio": "workspace:8.0.0-next-8.24"
   },
   "scripts": {
     "test": "echo no test",

e2e/cli/e2e-pnpm-commons/publish.ts

@@ -15,9 +15,15 @@ export function runPublish(pnpm) {
     test.each([['verdaccio-memory', 'verdaccio', '@verdaccio/foo', '@verdaccio/some-foo']])(
       'should publish a package %s',
       async (pkgName) => {
+        // As of npm v11, npm will fetch the packument from the npm registry before publishing (from the uplink),
+        // and there are more checks in the client:
+        // - "You cannot publish over the previously published versions"
+        // - "You must specify a tag using --tag when publishing a prerelease version"
+        // - "Cannot implicitly apply the 'latest' tag because previously published version x.y.z is higher than the new version a.b.c"
+        // Therefore, we pick a version that is higher than any of the published versions for the test packages (and not a pre-release).
         const { tempFolder } = await prepareGenericEmptyProject(
           pkgName,
-          '1.0.0-patch',
+          '99.0.0',
           registry.port,
           registry.getToken(),
           registry.getRegistryUrl()
@@ -31,7 +37,6 @@ export function runPublish(pnpm) {
         const parsedBody = JSON.parse(resp.stdout as string);
         expect(parsedBody.name).toEqual(pkgName);
         expect(parsedBody.files).toBeDefined();
-        expect(parsedBody.files).toBeDefined();
       }
     );
 

e2e/cli/e2e-pnpm-commons/star.ts

@@ -20,7 +20,7 @@ export function runStar(pnpm) {
     test.each([['@verdaccio/foo']])('should star a package %s', async (pkgName) => {
       const { tempFolder } = await prepareGenericEmptyProject(
         pkgName,
-        '1.0.0-patch',
+        '1.0.0',
         registry.port,
         registry.getToken(),
         registry.getRegistryUrl()
@@ -39,7 +39,7 @@ export function runStar(pnpm) {
     test.each([['@verdaccio/bar']])('should unstar a package %s', async (pkgName) => {
       const { tempFolder } = await prepareGenericEmptyProject(
         pkgName,
-        '1.0.0-patch',
+        '1.0.0',
         registry.port,
         registry.getToken(),
         registry.getRegistryUrl()
@@ -67,7 +67,7 @@ export function runStar(pnpm) {
       const pkgName = '@verdaccio/stars';
       const { tempFolder } = await prepareGenericEmptyProject(
         pkgName,
-        '1.0.0-patch',
+        '1.0.0',
         registry.port,
         registry.getToken(),
         registry.getRegistryUrl()

e2e/cli/e2e-pnpm-commons/unpublish.ts

@@ -22,7 +22,7 @@ export function runUnpublish(pnpm) {
       async (pkgName) => {
         const { tempFolder } = await prepareGenericEmptyProject(
           pkgName,
-          '1.0.0-beta',
+          '1.0.0',
           registry.port,
           registry.getToken(),
           registry.getRegistryUrl()
@@ -53,7 +53,7 @@ export function runUnpublish(pnpm) {
       async (pkgName) => {
         const { tempFolder } = await prepareGenericEmptyProject(
           pkgName,
-          '1.0.0-beta',
+          '1.0.0',
           registry.port,
           registry.getToken(),
           registry.getRegistryUrl()
@@ -69,13 +69,13 @@ export function runUnpublish(pnpm) {
         const resp2 = await pnpm(
           { cwd: tempFolder },
           'unpublish',
-          `${pkgName}@1.0.0-beta`,
+          `${pkgName}@1.0.0`,
           '--force',
           '--loglevel=info',
           '--json',
           ...addRegistry(registry.getRegistryUrl())
         );
-        expect(resp2.stdout).toEqual('- @verdaccio/test1@1.0.0-beta');
+        expect(resp2.stdout).toEqual('- @verdaccio/test1@1.0.0');
       }
     );
 

e2e/ui/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/e2e-ui
 
+## 2.0.1-next-8.0
+
+### Patch Changes
+
+- f443f81: chore(deps): sync and pin dependencies
+
 ## 2.0.0
 
 ### Major Changes

e2e/ui/package.json

@@ -1,14 +1,14 @@
 {
   "private": true,
   "name": "@verdaccio/e2e-ui",
-  "version": "2.0.0",
+  "version": "2.0.1-next-8.0",
   "devDependencies": {
-    "verdaccio": "workspace:8.0.0-next-8.19",
-    "@verdaccio/core": "workspace:8.0.0-next-8.19",
-    "@verdaccio/config": "workspace:8.0.0-next-8.19",
-    "@verdaccio/test-helper": "workspace:4.0.0-next-8.5",
-    "debug": "4.4.1",
-    "cypress": "^13.6.0",
+    "verdaccio": "workspace:8.0.0-next-8.24",
+    "@verdaccio/core": "workspace:8.0.0-next-8.24",
+    "@verdaccio/config": "workspace:8.0.0-next-8.24",
+    "@verdaccio/test-helper": "workspace:4.0.0-next-8.8",
+    "debug": "4.4.3",
+    "cypress": "15.4.0",
     "get-port": "5.1.1"
   },
   "scripts": {

package.json

@@ -15,41 +15,41 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@babel/cli": "7.27.2",
-    "@babel/core": "7.27.4",
+    "@babel/cli": "7.28.3",
+    "@babel/core": "7.28.4",
     "@babel/eslint-parser": "7.25.9",
-    "@babel/node": "7.27.1",
-    "@babel/plugin-proposal-decorators": "7.27.1",
+    "@babel/node": "7.28.0",
+    "@babel/plugin-proposal-decorators": "7.28.0",
     "@babel/plugin-proposal-function-sent": "7.27.1",
     "@babel/plugin-proposal-throw-expressions": "7.27.1",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-syntax-import-meta": "7.10.4",
     "@babel/plugin-transform-async-to-generator": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
-    "@babel/plugin-transform-classes": "7.27.1",
+    "@babel/plugin-transform-classes": "7.28.4",
     "@babel/plugin-transform-export-namespace-from": "7.27.1",
     "@babel/plugin-transform-json-strings": "7.27.1",
     "@babel/plugin-transform-nullish-coalescing-operator": "7.27.1",
     "@babel/plugin-transform-numeric-separator": "7.27.1",
-    "@babel/plugin-transform-object-rest-spread": "7.27.3",
+    "@babel/plugin-transform-object-rest-spread": "7.28.4",
     "@babel/plugin-transform-optional-chaining": "7.27.1",
-    "@babel/plugin-transform-runtime": "7.27.4",
-    "@babel/preset-env": "7.27.2",
+    "@babel/plugin-transform-runtime": "7.28.3",
+    "@babel/preset-env": "7.28.3",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.24.7",
-    "@babel/register": "7.27.1",
-    "@babel/runtime": "7.27.6",
+    "@babel/register": "7.28.3",
+    "@babel/runtime": "7.28.4",
     "@changesets/changelog-github": "0.5.1",
     "@changesets/cli": "2.27.12",
     "@changesets/get-dependents-graph": "2.1.3",
     "@crowdin/cli": "4.7.1",
     "@dianmora/contributors": "5.0.0",
-    "@emotion/react": "11.10.6",
-    "@emotion/styled": "11.10.6",
-    "@testing-library/dom": "10.4.0",
-    "@testing-library/jest-dom": "6.6.3",
-    "@testing-library/react": "16.1.0",
-    "@testing-library/user-event": "14.5.2",
+    "@emotion/react": "11.11.4",
+    "@emotion/styled": "11.11.5",
+    "@testing-library/dom": "10.4.1",
+    "@testing-library/jest-dom": "6.8.0",
+    "@testing-library/react": "16.3.0",
+    "@testing-library/user-event": "14.6.1",
     "@trivago/prettier-plugin-sort-imports": "4.3.0",
     "@types/body-parser": "1.19.5",
     "@types/connect": "3.4.38",
@@ -89,14 +89,14 @@
     "@verdaccio/local-scripts": "workspace:*",
     "@verdaccio/types": "workspace:*",
     "@verdaccio/ui-theme": "workspace:*",
-    "@vitest/coverage-v8": "3.0.4",
+    "@vitest/coverage-v8": "3.2.4",
     "aria-query": "5.1.3",
     "babel-core": "7.0.0-bridge.0",
     "babel-plugin-dynamic-import-node": "2.3.3",
     "babel-plugin-emotion": "11.0.0",
     "concurrently": "8.2.2",
     "cross-env": "7.0.3",
-    "debug": "4.4.1",
+    "debug": "4.4.3",
     "detect-secrets": "1.0.6",
     "eslint": "8.57.1",
     "fs-extra": "11.2.0",
@@ -106,24 +106,24 @@
     "kleur": "4.1.5",
     "lint-staged": "11.2.6",
     "nock": "13.5.6",
-    "nodemon": "3.0.3",
-    "npm-run-all2": "5.0.2",
+    "nodemon": "3.1.10",
+    "npm-run-all2": "8.0.4",
     "prettier": "3.4.2",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "rimraf": "5.0.10",
     "selfsigned": "2.4.1",
-    "semver": "^7.6.3",
-    "supertest": "7.0.0",
+    "semver": "7.7.3",
+    "supertest": "7.1.4",
     "ts-node": "10.9.2",
     "typescript": "5.3.3",
     "undici-types": "5.28.4",
-    "update-ts-references": "3.6.0",
+    "update-ts-references": "3.6.2",
     "verdaccio-audit": "workspace:*",
     "verdaccio-auth-memory": "workspace:*",
     "verdaccio-htpasswd": "workspace:*",
     "verdaccio-memory": "workspace:*",
-    "vitest": "3.0.4"
+    "vitest": "3.2.4"
   },
   "scripts": {
     "prepare": "husky install",

packages/api/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @verdaccio/api
 
+## 8.1.0-next-8.24
+
+### Patch Changes
+
+- Updated dependencies [71587f3]
+  - @verdaccio/store@8.0.0-next-8.24
+  - @verdaccio/core@8.0.0-next-8.24
+  - @verdaccio/config@8.0.0-next-8.24
+  - @verdaccio/auth@8.0.0-next-8.24
+  - @verdaccio/middleware@8.0.0-next-8.24
+  - @verdaccio/logger@8.0.0-next-8.24
+
+## 8.1.0-next-8.23
+
+### Patch Changes
+
+- 5c499fa: chore: publish @verdaccio/test-helper
+- Updated dependencies [b671a38]
+  - @verdaccio/config@8.0.0-next-8.23
+  - @verdaccio/store@8.0.0-next-8.23
+  - @verdaccio/auth@8.0.0-next-8.23
+  - @verdaccio/middleware@8.0.0-next-8.23
+  - @verdaccio/core@8.0.0-next-8.23
+  - @verdaccio/logger@8.0.0-next-8.23
+
+## 8.1.0-next-8.22
+
+### Patch Changes
+
+- Updated dependencies [67e667b]
+- Updated dependencies [60ef8ff]
+- Updated dependencies [05f03b3]
+  - @verdaccio/core@8.0.0-next-8.22
+  - @verdaccio/config@8.0.0-next-8.22
+  - @verdaccio/store@8.0.0-next-8.22
+  - @verdaccio/auth@8.0.0-next-8.22
+  - @verdaccio/middleware@8.0.0-next-8.22
+  - @verdaccio/logger@8.0.0-next-8.22
+
+## 8.1.0-next-8.21
+
+### Patch Changes
+
+- Updated dependencies [f8a321f]
+  - @verdaccio/core@8.0.0-next-8.21
+  - @verdaccio/auth@8.0.0-next-8.21
+  - @verdaccio/config@8.0.0-next-8.21
+  - @verdaccio/middleware@8.0.0-next-8.21
+  - @verdaccio/store@8.0.0-next-8.21
+  - @verdaccio/logger@8.0.0-next-8.21
+
+## 8.1.0-next-8.20
+
+### Patch Changes
+
+- 08e1b21: chore(deps): built-in node imports
+- Updated dependencies [08e1b21]
+- Updated dependencies [a1a73e9]
+- Updated dependencies [6a4d6dd]
+- Updated dependencies [73c0194]
+- Updated dependencies [5fef0b6]
+  - @verdaccio/middleware@8.0.0-next-8.20
+  - @verdaccio/config@8.0.0-next-8.20
+  - @verdaccio/store@8.0.0-next-8.20
+  - @verdaccio/auth@8.0.0-next-8.20
+  - @verdaccio/core@8.0.0-next-8.20
+  - @verdaccio/logger@8.0.0-next-8.20
+
 ## 8.1.0-next-8.19
 
 ### Patch Changes

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "8.1.0-next-8.19",
+  "version": "8.1.0-next-8.24",
   "description": "Verdaccio Registry API",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -42,26 +42,26 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "workspace:8.0.0-next-8.19",
-    "@verdaccio/config": "workspace:8.0.0-next-8.19",
-    "@verdaccio/core": "workspace:8.0.0-next-8.19",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.19",
-    "@verdaccio/middleware": "workspace:8.0.0-next-8.19",
-    "@verdaccio/store": "workspace:8.0.0-next-8.19",
+    "@verdaccio/auth": "workspace:8.0.0-next-8.24",
+    "@verdaccio/config": "workspace:8.0.0-next-8.24",
+    "@verdaccio/core": "workspace:8.0.0-next-8.24",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.24",
+    "@verdaccio/middleware": "workspace:8.0.0-next-8.24",
+    "@verdaccio/store": "workspace:8.0.0-next-8.24",
     "abortcontroller-polyfill": "1.7.8",
     "body-parser": "1.20.3",
     "cookies": "0.9.1",
-    "debug": "4.4.1",
+    "debug": "4.4.3",
     "express": "4.21.2",
     "lodash": "4.17.21",
     "mime": "2.6.0",
-    "semver": "7.7.2"
+    "semver": "7.7.3"
   },
   "devDependencies": {
-    "@verdaccio/test-helper": "workspace:4.0.0-next-8.5",
-    "@verdaccio/types": "workspace:13.0.0-next-8.6",
+    "@verdaccio/test-helper": "workspace:4.0.0-next-8.8",
+    "@verdaccio/types": "workspace:13.0.0-next-8.8",
     "mockdate": "3.0.5",
-    "supertest": "7.0.0"
+    "supertest": "7.1.4"
   },
   "funding": {
     "type": "opencollective",

packages/api/test/integration/_helper.ts

@@ -1,6 +1,6 @@
 import { Application } from 'express';
 import _ from 'lodash';
-import path from 'path';
+import path from 'node:path';
 import supertest from 'supertest';
 import { expect } from 'vitest';
 
@@ -27,7 +27,7 @@ setup({});
 
 export const buildToken = authUtils.buildToken;
 
-export const getConf = (conf) => {
+export const getConf = (conf: string) => {
   const configPath = path.join(__dirname, 'config', conf);
   const config = parseConfigFile(configPath);
   // custom config to avoid conflict with other tests
@@ -35,12 +35,12 @@ export const getConf = (conf) => {
   return config;
 };
 
-export async function initializeServer(configName): Promise<Application> {
+export async function initializeServer(configName: string): Promise<Application> {
   const config = getConf(configName);
   return initializeServerHelper(config, [apiMiddleware], Storage);
 }
 
-export function createUser(app, name: string, password: string): supertest.Test {
+export function createUser(app: any, name: string, password: string): supertest.Test {
   return supertest(app)
     .put(`/-/user/org.couchdb.user:${name}`)
     .send({
@@ -61,7 +61,7 @@ export async function getNewToken(app: any, credentials: any): Promise<string> {
   return token;
 }
 
-export async function generateTokenCLI(app, token, payload): Promise<any> {
+export async function generateTokenCLI(app: any, token: string, payload: any): Promise<any> {
   return supertest(app)
     .post('/-/npm/v1/tokens')
     .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
@@ -70,7 +70,7 @@ export async function generateTokenCLI(app, token, payload): Promise<any> {
     .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET);
 }
 
-export async function deleteTokenCLI(app, token, tokenToDelete): Promise<any> {
+export async function deleteTokenCLI(app: any, token: string, tokenToDelete: string): Promise<any> {
   return supertest(app)
     .delete(`/-/npm/v1/tokens/token/${tokenToDelete}`)
     .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
@@ -80,7 +80,7 @@ export async function deleteTokenCLI(app, token, tokenToDelete): Promise<any> {
 }
 
 export function publishVersionWithToken(
-  app,
+  app: any,
   pkgName: string,
   version: string,
   token: string,
@@ -98,7 +98,7 @@ export function publishVersionWithToken(
 }
 
 export function publishVersion(
-  app,
+  app: any,
   pkgName: string,
   version: string,
   distTags?: GenericBody,
@@ -121,7 +121,7 @@ export function publishVersion(
 }
 
 export function starPackage(
-  app,
+  app: any,
   options: {
     users: PackageUsers;
     name: string;
@@ -152,7 +152,7 @@ export function starPackage(
 }
 
 export function changeOwners(
-  app,
+  app: any,
   options: {
     maintainers: Author[];
     name: string;
@@ -182,7 +182,7 @@ export function changeOwners(
   return test;
 }
 
-export function getDisTags(app, pkgName) {
+export function getDisTags(app: any, pkgName: string): supertest.Test {
   return supertest(app)
     .get(`/-/package/${encodeURIComponent(pkgName)}/dist-tags`)
     .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)

packages/api/test/integration/publish.spec.ts

@@ -1,5 +1,5 @@
 import nock from 'nock';
-import { basename } from 'path';
+import { basename } from 'node:path';
 import supertest from 'supertest';
 import { describe, expect, test } from 'vitest';
 

packages/api/test/unit/validate.api.params.middleware.spec.ts

@@ -1,7 +1,7 @@
 /* eslint-disable curly */
 // ensure that all arguments are validated
-import fs from 'fs';
-import path from 'path';
+import fs from 'node:fs';
+import path from 'node:path';
 import { describe, expect, test } from 'vitest';
 
 /**

packages/auth/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @verdaccio/auth
 
+## 8.0.0-next-8.24
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.24
+- @verdaccio/config@8.0.0-next-8.24
+- @verdaccio/loaders@8.0.0-next-8.14
+- verdaccio-htpasswd@13.0.0-next-8.24
+- @verdaccio/signature@8.0.0-next-8.16
+
+## 8.0.0-next-8.23
+
+### Patch Changes
+
+- Updated dependencies [b671a38]
+  - @verdaccio/config@8.0.0-next-8.23
+  - @verdaccio/loaders@8.0.0-next-8.13
+  - verdaccio-htpasswd@13.0.0-next-8.23
+  - @verdaccio/signature@8.0.0-next-8.15
+  - @verdaccio/core@8.0.0-next-8.23
+
+## 8.0.0-next-8.22
+
+### Patch Changes
+
+- Updated dependencies [67e667b]
+- Updated dependencies [60ef8ff]
+- Updated dependencies [05f03b3]
+  - @verdaccio/core@8.0.0-next-8.22
+  - @verdaccio/loaders@8.0.0-next-8.12
+  - @verdaccio/config@8.0.0-next-8.22
+  - verdaccio-htpasswd@13.0.0-next-8.22
+  - @verdaccio/signature@8.0.0-next-8.14
+
+## 8.0.0-next-8.21
+
+### Patch Changes
+
+- Updated dependencies [f8a321f]
+  - @verdaccio/core@8.0.0-next-8.21
+  - @verdaccio/config@8.0.0-next-8.21
+  - @verdaccio/loaders@8.0.0-next-8.11
+  - verdaccio-htpasswd@13.0.0-next-8.21
+  - @verdaccio/signature@8.0.0-next-8.13
+
+## 8.0.0-next-8.20
+
+### Patch Changes
+
+- 08e1b21: chore(deps): built-in node imports
+- 73c0194: chore(auth): typings
+- 5fef0b6: chore(auth): multiple plugins test
+- Updated dependencies [08e1b21]
+- Updated dependencies [a1a73e9]
+- Updated dependencies [6a4d6dd]
+  - @verdaccio/config@8.0.0-next-8.20
+  - @verdaccio/core@8.0.0-next-8.20
+  - verdaccio-htpasswd@13.0.0-next-8.20
+  - @verdaccio/loaders@8.0.0-next-8.10
+  - @verdaccio/signature@8.0.0-next-8.12
+
 ## 8.0.0-next-8.19
 
 ### Patch Changes

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "8.0.0-next-8.19",
+  "version": "8.0.0-next-8.24",
   "description": "Verdaccio Authentication",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -42,20 +42,20 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.19",
-    "@verdaccio/core": "workspace:8.0.0-next-8.19",
-    "@verdaccio/loaders": "workspace:8.0.0-next-8.9",
-    "@verdaccio/signature": "workspace:8.0.0-next-8.11",
-    "debug": "4.4.1",
+    "@verdaccio/config": "workspace:8.0.0-next-8.24",
+    "@verdaccio/core": "workspace:8.0.0-next-8.24",
+    "@verdaccio/loaders": "workspace:8.0.0-next-8.14",
+    "@verdaccio/signature": "workspace:8.0.0-next-8.16",
+    "debug": "4.4.3",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "workspace:13.0.0-next-8.19"
+    "verdaccio-htpasswd": "workspace:13.0.0-next-8.24"
   },
   "devDependencies": {
-    "@verdaccio/middleware": "workspace:8.0.0-next-8.19",
-    "@verdaccio/types": "workspace:13.0.0-next-8.6",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.19",
+    "@verdaccio/middleware": "workspace:8.0.0-next-8.24",
+    "@verdaccio/types": "workspace:13.0.0-next-8.8",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.24",
     "express": "4.21.2",
-    "supertest": "7.0.0"
+    "supertest": "7.1.4"
   },
   "funding": {
     "type": "opencollective",

packages/auth/src/auth.ts

@@ -1,5 +1,5 @@
 import buildDebug from 'debug';
-import _, { isFunction } from 'lodash';
+import _ from 'lodash';
 import { HTPasswd } from 'verdaccio-htpasswd';
 
 import { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';
@@ -73,7 +73,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   }
 
   public async init() {
-    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];
+    let plugins = await this.loadPlugin();
 
     debug('auth plugins found %s', plugins.length);
     if (!plugins || plugins.length === 0) {
@@ -86,15 +86,14 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
   private loadDefaultPlugin() {
     debug('load default auth plugin');
-    const pluginOptions: pluginUtils.PluginOptions = {
-      config: this.config,
-      logger: this.logger,
-    };
     let authPlugin;
     try {
       authPlugin = new HTPasswd(
         { file: './htpasswd' },
-        pluginOptions as any as pluginUtils.PluginOptions
+        {
+          config: this.config,
+          logger: this.logger,
+        }
       );
       this.logger.info(
         { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },
@@ -110,7 +109,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   }
 
   private async loadPlugin() {
-    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(
+    return asyncLoadPlugin<pluginUtils.Auth<Config>>(
       this.config.auth,
       {
         config: this.config,
@@ -184,9 +183,9 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   ): void {
     const plugins = this.plugins.slice(0);
     (function next(): void {
-      const plugin = plugins.shift() as pluginUtils.Auth<Config>;
+      const plugin = plugins.shift();
 
-      if (isFunction(plugin.authenticate) === false) {
+      if (typeof plugin?.authenticate !== 'function') {
         return next();
       }
 
@@ -233,7 +232,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
     (function next(): void {
       let method = 'adduser';
-      const plugin = plugins.shift() as pluginUtils.Auth<Config>;
+      const plugin = plugins.shift();
       // @ts-expect-error future major (7.x) should remove this section
       if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
         method = 'add_user';
@@ -283,9 +282,9 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     debug('allow access for %o', packageName);
 
     (function next(): void {
-      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;
+      const plugin = plugins.shift();
 
-      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {
+      if (typeof plugin?.allow_access !== 'function') {
         return next();
       }
 
@@ -321,7 +320,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
         debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);
         continue;
       } else {
-        plugin.allow_unpublish(user, pkg, (err, ok): void => {
+        plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {
           if (err) {
             debug(
               'forbidden publish for %o, it will fallback on unpublish permissions',

packages/auth/test/auth-utils-middleware.spec.ts

@@ -1,5 +1,5 @@
 import _ from 'lodash';
-import path from 'path';
+import path from 'node:path';
 import { describe, expect, test, vi } from 'vitest';
 
 import {

packages/auth/test/auth-utils.spec.ts

@@ -1,5 +1,5 @@
 import _ from 'lodash';
-import path from 'path';
+import path from 'node:path';
 import { describe, expect, test, vi } from 'vitest';
 
 import {

packages/auth/test/auth.spec.ts

@@ -1,5 +1,5 @@
 import express from 'express';
-import path from 'path';
+import path from 'node:path';
 import supertest from 'supertest';
 import { describe, expect, test, vi } from 'vitest';
 
@@ -198,29 +198,52 @@ describe('AuthTest', () => {
       });
     });
 
-    describe('test multiple authenticate methods', () => {
-      test('should skip falsy values', async () => {
-        const config: Config = new AppConfig({
-          ...getDefaultConfig(),
-          plugins: path.join(__dirname, './partials/plugin'),
-          auth: {
-            success: {},
-            'fail-invalid-method': {},
-          },
-        });
-        config.checkSecretKey('12345');
-        const auth: Auth = new Auth(config, logger);
-        await auth.init();
+    test('should success first plugin, ignore subsequent plugins', async () => {
+      const config: Config = new AppConfig({
+        ...getDefaultConfig(),
+        plugins: path.join(__dirname, './partials/plugin'),
+        auth: {
+          success: {},
+          'no-access': {},
+        },
+      });
+      config.checkSecretKey('12345');
+      const auth: Auth = new Auth(config, logger);
+      await auth.init();
 
-        return new Promise((resolve) => {
-          auth.authenticate('foo', 'bar', (err, value) => {
-            expect(value).toEqual({
-              name: 'foo',
-              groups: ['test', ROLES.$ALL, '$authenticated', '@all', '@authenticated', 'all'],
-              real_groups: ['test'],
-            });
-            resolve(value);
+      return new Promise((resolve) => {
+        auth.authenticate('foo', 'bar', (err, value) => {
+          expect(value).toEqual({
+            name: 'foo',
+            groups: ['test', ROLES.$ALL, '$authenticated', '@all', '@authenticated', 'all'],
+            real_groups: ['test'],
           });
+          resolve(value);
+        });
+      });
+    });
+
+    test('should fail first plugin, success second plugin', async () => {
+      const config: Config = new AppConfig({
+        ...getDefaultConfig(),
+        plugins: path.join(__dirname, './partials/plugin'),
+        auth: {
+          'no-access': {},
+          success: {},
+        },
+      });
+      config.checkSecretKey('12345');
+      const auth: Auth = new Auth(config, logger);
+      await auth.init();
+
+      return new Promise((resolve) => {
+        auth.authenticate('foo', 'bar', (err, value) => {
+          expect(value).toEqual({
+            name: 'foo',
+            groups: ['test', ROLES.$ALL, '$authenticated', '@all', '@authenticated', 'all'],
+            real_groups: ['test'],
+          });
+          resolve(value);
         });
       });
     });

packages/auth/test/helper/plugin.ts

@@ -1,4 +1,4 @@
-import path from 'path';
+import path from 'node:path';
 
 import { getDefaultConfig } from '@verdaccio/config';
 

packages/auth/test/partials/plugin/verdaccio-no-access/no-access.js

@@ -0,0 +1,8 @@
+module.exports = function () {
+  return {
+    authenticate(user, pass, callback) {
+      // no access but also no error
+      callback(null, false);
+    },
+  };
+};

packages/auth/test/partials/plugin/verdaccio-no-access/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-no-access",
+  "main": "no-access.js",
+  "version": "1.0.0"
+}

packages/cli/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @verdaccio/cli
 
+## 8.0.0-next-8.24
+
+### Patch Changes
+
+- @verdaccio/node-api@8.0.0-next-8.24
+- @verdaccio/core@8.0.0-next-8.24
+- @verdaccio/config@8.0.0-next-8.24
+- @verdaccio/logger@8.0.0-next-8.24
+
+## 8.0.0-next-8.23
+
+### Patch Changes
+
+- Updated dependencies [b671a38]
+  - @verdaccio/config@8.0.0-next-8.23
+  - @verdaccio/node-api@8.0.0-next-8.23
+  - @verdaccio/core@8.0.0-next-8.23
+  - @verdaccio/logger@8.0.0-next-8.23
+
+## 8.0.0-next-8.22
+
+### Patch Changes
+
+- Updated dependencies [67e667b]
+- Updated dependencies [60ef8ff]
+- Updated dependencies [05f03b3]
+  - @verdaccio/core@8.0.0-next-8.22
+  - @verdaccio/config@8.0.0-next-8.22
+  - @verdaccio/node-api@8.0.0-next-8.22
+  - @verdaccio/logger@8.0.0-next-8.22
+
+## 8.0.0-next-8.21
+
+### Patch Changes
+
+- Updated dependencies [f8a321f]
+  - @verdaccio/core@8.0.0-next-8.21
+  - @verdaccio/config@8.0.0-next-8.21
+  - @verdaccio/node-api@8.0.0-next-8.21
+  - @verdaccio/logger@8.0.0-next-8.21
+
+## 8.0.0-next-8.20
+
+### Patch Changes
+
+- Updated dependencies [08e1b21]
+- Updated dependencies [a1a73e9]
+- Updated dependencies [6a4d6dd]
+  - @verdaccio/node-api@8.0.0-next-8.20
+  - @verdaccio/config@8.0.0-next-8.20
+  - @verdaccio/core@8.0.0-next-8.20
+  - @verdaccio/logger@8.0.0-next-8.20
+
 ## 8.0.0-next-8.19
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/cli",
-  "version": "8.0.0-next-8.19",
+  "version": "8.0.0-next-8.24",
   "author": {
     "name": "Juan Picado",
     "email": "juanpicado19@gmail.com"
@@ -47,14 +47,14 @@
     "start": "ts-node src/index.ts"
   },
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.19",
-    "@verdaccio/core": "workspace:8.0.0-next-8.19",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.19",
-    "@verdaccio/node-api": "workspace:8.0.0-next-8.19",
+    "@verdaccio/config": "workspace:8.0.0-next-8.24",
+    "@verdaccio/core": "workspace:8.0.0-next-8.24",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.24",
+    "@verdaccio/node-api": "workspace:8.0.0-next-8.24",
     "clipanion": "4.0.0-rc.4",
-    "envinfo": "7.14.0",
+    "envinfo": "7.19.0",
     "kleur": "4.1.5",
-    "semver": "7.7.2"
+    "semver": "7.7.3"
   },
   "devDependencies": {
     "ts-node": "10.9.2"

packages/config/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @verdaccio/config
 
+## 8.0.0-next-8.24
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.24
+
+## 8.0.0-next-8.23
+
+### Patch Changes
+
+- b671a38: chore: add types for createConfigFolder
+  - @verdaccio/core@8.0.0-next-8.23
+
+## 8.0.0-next-8.22
+
+### Patch Changes
+
+- 67e667b: chore: replace conditional require(fs/promises) pattern
+- 05f03b3: fix(config): avoid warning for multiple addresses
+- Updated dependencies [67e667b]
+- Updated dependencies [60ef8ff]
+  - @verdaccio/core@8.0.0-next-8.22
+
+## 8.0.0-next-8.21
+
+### Patch Changes
+
+- Updated dependencies [f8a321f]
+  - @verdaccio/core@8.0.0-next-8.21
+
+## 8.0.0-next-8.20
+
+### Minor Changes
+
+- 6a4d6dd: feat: getListenAddress getConfigParsed methods
+
+### Patch Changes
+
+- 08e1b21: chore(deps): built-in node imports
+- a1a73e9: feat(logger): support redacting sensitive data
+- Updated dependencies [6a4d6dd]
+  - @verdaccio/core@8.0.0-next-8.20
+
 ## 8.0.0-next-8.19
 
 ### Patch Changes

packages/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "8.0.0-next-8.19",
+  "version": "8.0.0-next-8.24",
   "description": "Verdaccio Configuration",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -42,8 +42,8 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.19",
-    "debug": "4.4.1",
+    "@verdaccio/core": "workspace:8.0.0-next-8.24",
+    "debug": "4.4.3",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
     "minimatch": "7.4.6"

packages/config/src/address.ts

@@ -0,0 +1,140 @@
+import createDebug from 'debug';
+
+import { DEFAULT_DOMAIN, DEFAULT_PORT, DEFAULT_PROTOCOL } from '@verdaccio/core';
+import { ListenAddress as ConfigListenAddress, Logger } from '@verdaccio/types';
+
+const debug = createDebug('verdaccio:config:address');
+
+export interface ListenAddress {
+  proto: string;
+  host?: string;
+  port?: string;
+  path?: string;
+}
+
+/**
+ * Parse an internet address
+ * Allow:
+ - https:localhost:1234        - protocol + host + port
+ - localhost:1234              - host + port
+ - 1234                        - port
+ - http::1234                  - protocol + port
+ - https://localhost:443/      - full url + https
+ - http://[::1]:443/           - ipv6
+ - unix:/tmp/http.sock         - unix sockets
+ - https://unix:/tmp/http.sock - unix sockets (https)
+ * @param {*} urlAddress the internet address definition
+ * @return {Object|Null} literal object that represent the address parsed
+ */
+export function parseAddress(urlAddress: string): ListenAddress | null {
+  //
+  // TODO: refactor it to something more reasonable?
+  //
+  //        protocol :  //      (  host  )|(    ipv6     ):  port  /
+  const urlPattern = /^((https?):(\/\/)?)?((([^\/:]*)|\[([^\[\]]+)\]):)?(\d+)\/?$/.exec(urlAddress);
+
+  if (urlPattern) {
+    return {
+      proto: urlPattern[2] || DEFAULT_PROTOCOL,
+      host: urlPattern[6] || urlPattern[7] || DEFAULT_DOMAIN,
+      port: urlPattern[8] || DEFAULT_PORT,
+    };
+  }
+
+  const unixPattern = /^(?:(https?):\/\/)?unix:(\/.*)$/.exec(urlAddress);
+  if (!unixPattern) {
+    // if we cannot match the unix pattern, we return null
+    // this is to avoid returning a wrong object
+    return null;
+  }
+
+  return {
+    host: unixPattern[2],
+    proto: unixPattern[1] || 'unix',
+    path: unixPattern[2],
+  };
+}
+
+function addrToString(a: ListenAddress): string {
+  return a.proto === 'unix' ? `unix:${a.host}` : `${a.proto}://${a.host}:${a.port}`;
+}
+
+/**
+ * Retrieve all addresses defined in the config file.
+ * Verdaccio is able to listen multiple ports
+ * @param {String} argListen
+ * @param {String} configListen
+ * eg:
+ *  listen:
+ - localhost:5555
+ - localhost:5557
+ @return {Array}
+ */
+export function getListenAddress(
+  listen: ConfigListenAddress | string | undefined,
+  logger: Logger
+): ListenAddress {
+  debug('getListenAddress called with %o', listen);
+
+  if (!listen) {
+    debug('No listen address provided, using default');
+    return { proto: DEFAULT_PROTOCOL, host: DEFAULT_DOMAIN, port: DEFAULT_PORT };
+  }
+
+  if (Array.isArray(listen)) {
+    const filteredListen = listen.filter((item) => typeof item === 'string');
+
+    if (filteredListen.length === 0) {
+      throw new Error('Listen addresses array cannot be empty');
+    }
+
+    const invalid: string[] = [];
+    const valid: ListenAddress[] = [];
+
+    for (const raw of filteredListen) {
+      const candidate = parseAddress(raw as string);
+      if (candidate) {
+        debug('valid listen address found: %o', candidate);
+        valid.push(candidate);
+      } else {
+        debug('invalid address found: %o', raw);
+        invalid.push(raw as string);
+      }
+    }
+
+    invalid.forEach((bad) =>
+      logger.warn(
+        { addr: bad },
+        'invalid address - @{addr}, we expect a port (e.g. "4873"), ' +
+          'host:port (e.g. "localhost:4873"), full url ' +
+          '(e.g. "http://localhost:4873/") or unix:/path/socket'
+      )
+    );
+
+    if (valid.length === 0) {
+      throw new Error('No valid listen addresses found in configuration array');
+    }
+
+    const firstValid = valid[0];
+
+    if (listen.length > 1) {
+      logger.warn(
+        `Multiple listen addresses are not supported, using the first valid one ${addrToString(
+          firstValid
+        )}`
+      );
+    }
+
+    return firstValid;
+  }
+
+  const single = parseAddress(listen as string);
+  if (!single) {
+    throw new Error(
+      `Invalid address - ${listen}, we expect a port (e.g. "4873"), ` +
+        `host:port (e.g. "localhost:4873"), full url ` +
+        `(e.g. "http://localhost:4873/") or unix:/path/socket`
+    );
+  }
+  return single;
+}

packages/config/src/conf/default.yaml

@@ -72,6 +72,10 @@ auth:
     # Maximum amount of users allowed to register, defaults to "+inf".
     # You can set this to -1 to disable registration.
     # max_users: 1000
+    # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
+    # algorithm: bcrypt # by default is crypt, but is recommended use bcrypt for new installations
+    # Rounds number for "bcrypt", will be ignored for other algorithms.
+    # rounds: 10
 
 # A list of other known repositories we can talk to
 # https://verdaccio.org/docs/configuration#uplinks
@@ -210,7 +214,16 @@ middlewares:
 
 # Log settings
 # https://verdaccio.org/docs/logger
-log: { type: stdout, format: pretty, level: http }
+# Redaction: https://getpino.io/#/docs/redaction
+# Synchronous logging: https://getpino.io/#/docs/asynchronous
+log:
+  type: stdout
+  format: pretty
+  level: http
+#  redact:
+#    paths: ['req.header.authorization','req.header.cookie','req.remoteAddress','req.remotePort','ip','remoteIP','user','msg']
+#    censor: '<redacted>'
+#  sync: true
 
 # Feature flags (experimental settings that can be changed or removed in the future)
 # https://verdaccio.org/docs/configuration#experiments

packages/config/src/conf/docker.yaml

@@ -210,7 +210,16 @@ middlewares:
 
 # Log settings
 # https://verdaccio.org/docs/logger
-log: { type: stdout, format: pretty, level: http }
+# Redaction: https://getpino.io/#/docs/redaction
+# Synchronous logging: https://getpino.io/#/docs/asynchronous
+log:
+  type: stdout
+  format: pretty
+  level: http
+#  redact:
+#    paths: ['req.header.authorization','req.header.cookie','req.remoteAddress','req.remotePort','ip','remoteIP','user','msg']
+#    censor: '<redacted>'
+#  sync: true
 
 # Feature flags (experimental settings that can be changed or removed in the future)
 # https://verdaccio.org/docs/configuration#experiments

packages/config/src/conf/index.ts

@@ -1,8 +1,8 @@
-import { join } from 'path';
+import { join } from 'node:path';
 
 import { parseConfigFile } from '../parse';
 
-export function getDefaultConfig(fileName = 'default.yaml') {
+export function getDefaultConfig(fileName: string = 'default.yaml') {
   const file = join(__dirname, `./${fileName}`);
   return parseConfigFile(file);
 }

packages/config/src/config-path.ts

@@ -1,8 +1,8 @@
 import buildDebug from 'debug';
-import fs from 'fs';
 import _ from 'lodash';
-import os from 'os';
-import path from 'path';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 
 import { fileExists, folderExists } from './config-utils';
 
@@ -78,7 +78,7 @@ export function readDefaultConfig(): string {
   return fs.readFileSync(pathDefaultConf, 'utf8');
 }
 
-function createConfigFolder(configLocation): void {
+function createConfigFolder(configLocation: SetupDirectory): void {
   const folder = path.dirname(configLocation.path);
   debug(`creating default config file folder at %o`, folder);
   fs.mkdirSync(folder, { recursive: true });

packages/config/src/config-utils.ts

@@ -1,5 +1,5 @@
 import buildDebug from 'debug';
-import fs from 'fs';
+import fs from 'node:fs';
 
 const debug = buildDebug('verdaccio:config:config-utils');
 

packages/config/src/config.ts

@@ -1,6 +1,6 @@
-import assert from 'assert';
 import buildDebug from 'debug';
 import _ from 'lodash';
+import assert from 'node:assert';
 
 import { APP_ERROR, authUtils, cryptoUtils, validationUtils, warningUtils } from '@verdaccio/core';
 import { Codes } from '@verdaccio/core/build/warning-utils';

packages/config/src/index.ts

@@ -3,10 +3,11 @@ export * from './config-path';
 export * from './token';
 export * from './config-utils';
 export * from './package-access';
-export { fromJStoYAML, parseConfigFile } from './parse';
+export { fromJStoYAML, parseConfigFile, getConfigParsed } from './parse';
 export * from './uplinks';
 export * from './security';
 export * from './agent';
 export * from './user';
 export { default as ConfigBuilder } from './builder';
 export { getDefaultConfig } from './conf';
+export * from './address';

packages/config/src/package-access.ts

@@ -1,6 +1,6 @@
-import assert from 'assert';
 import buildDebug from 'debug';
 import _ from 'lodash';
+import assert from 'node:assert';
 
 import { errorUtils } from '@verdaccio/core';
 import { PackageAccess } from '@verdaccio/types';

packages/config/src/parse.ts

@@ -1,11 +1,13 @@
 import buildDebug from 'debug';
-import fs from 'fs';
 import YAML from 'js-yaml';
 import { isObject } from 'lodash';
+import fs from 'node:fs';
+import path from 'node:path';
 
-import { APP_ERROR } from '@verdaccio/core';
+import { API_ERROR, APP_ERROR } from '@verdaccio/core';
 import { ConfigYaml } from '@verdaccio/types';
 
+import { findConfigFile } from './config-path';
 import { fileExists } from './config-utils';
 
 const debug = buildDebug('verdaccio:config:parse');
@@ -61,3 +63,48 @@ export function fromJStoYAML(config: Partial<ConfigYaml>): string | null {
     throw new Error(`config is not a valid object`);
   }
 }
+
+/**
+ * Parses and returns a configuration object of type `ConfigYaml`.
+ *
+ * If a string or `undefined` is provided, it is interpreted as a path to a config file
+ * (or uses a default location). The config file is then loaded and parsed.
+ * If an object is provided, it is assumed to be a pre-parsed configuration.
+ * Backward compability: ensures the returned configuration object has a `self_path` property set,
+ * either to the config file path or to a property within the object.
+ *
+ * @param {string | ConfigYaml} [config] - Optional. A path to the configuration file (string),
+ *                                         a pre-parsed config object, or `undefined`.
+ * @returns {ConfigYaml} The parsed configuration object with a guaranteed `self_path` property.
+ * @throws {Error} If the provided config is neither a string, undefined, nor an object.
+ */
+export function getConfigParsed(config?: string | ConfigYaml): ConfigYaml {
+  debug('getConfigParsed called with config: %o', typeof config);
+  let configurationParsed: ConfigYaml;
+  if (config === undefined || typeof config === 'string') {
+    debug('using default configuration');
+    const configPathLocation = findConfigFile(config);
+    configurationParsed = parseConfigFile(configPathLocation);
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-expect-error
+    if (!configurationParsed.self_path) {
+      debug('self_path not defined, using config path location');
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-expect-error
+      configurationParsed.self_path = path.resolve(configPathLocation);
+    }
+  } else if (typeof config === 'object' && config !== null) {
+    configurationParsed = config;
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-expect-error
+    if (!configurationParsed.self_path) {
+      debug('self_path not defined, using config path location');
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-expect-error
+      configurationParsed.self_path = configurationParsed.configPath;
+    }
+  } else {
+    throw new Error(API_ERROR.CONFIG_BAD_FORMAT);
+  }
+  return configurationParsed;
+}

packages/config/src/token.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from 'crypto';
+import { randomBytes } from 'node:crypto';
 
 export const TOKEN_VALID_LENGTH = 32;
 

packages/config/src/uplinks.ts

@@ -1,5 +1,5 @@
-import assert from 'assert';
 import _ from 'lodash';
+import assert from 'node:assert';
 
 import { authUtils } from '@verdaccio/core';
 import { PackageList, UpLinksConfList } from '@verdaccio/types';

packages/config/test/address.spec.ts

@@ -0,0 +1,209 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+import { Logger } from '@verdaccio/types';
+
+import { getListenAddress, parseAddress } from '../src';
+
+const logger: Logger = {
+  warn: vi.fn(),
+  error: vi.fn(),
+} as any;
+
+describe('address parsing', () => {
+  describe('getListenAddress', () => {
+    const warn = logger.warn as unknown as ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+    });
+
+    test('returns a parsed object for a simple port', () => {
+      const addr = getListenAddress('4873', logger);
+
+      expect(addr).toEqual({
+        proto: 'http',
+        host: 'localhost',
+        port: '4873',
+      });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('throws when the single string is invalid', () => {
+      expect(() => getListenAddress('not_valid', logger)).toThrow(/Invalid address/i);
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('uses the first valid element and warns about the rest', () => {
+      const addr = getListenAddress(['bad', 'http://localhost:4873', 'unix:/tmp/x.sock'], logger);
+
+      expect(addr).toEqual({
+        proto: 'http',
+        host: 'localhost',
+        port: '4873',
+      });
+
+      expect(warn).toHaveBeenCalledTimes(2);
+      // expect(warn.mock.calls[0][0]).toMatchObject({ addr: 'bad' });
+      expect(warn.mock.calls[1][0]).toMatch(/Multiple listen addresses/i);
+    });
+
+    test('throws if every element in the array is invalid', () => {
+      expect(() => getListenAddress(['bad1', 'also_bad'], logger)).toThrow(
+        /No valid listen addresses/i
+      );
+      // two warnings, one per invalid element
+      expect(warn).toHaveBeenCalledTimes(2);
+    });
+
+    test('throws when given an empty array', () => {
+      expect(() => getListenAddress([], logger)).toThrow(/array cannot be empty/i);
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('localhost:4873  (default value)', () => {
+      const addr = getListenAddress('localhost:4873', logger);
+
+      expect(addr).toEqual({ proto: 'http', host: 'localhost', port: '4873' });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('http://localhost:4873 (explicit protocol)', () => {
+      const addr = getListenAddress('http://localhost:4873', logger);
+
+      expect(addr).toEqual({ proto: 'http', host: 'localhost', port: '4873' });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('0.0.0.0:4873 (INADDR_ANY)', () => {
+      const addr = getListenAddress('0.0.0.0:4873', logger);
+
+      expect(addr).toEqual({ proto: 'http', host: '0.0.0.0', port: '4873' });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('https://example.org:4873 (TLS)', () => {
+      const addr = getListenAddress('https://example.org:4873', logger);
+
+      expect(addr).toEqual({ proto: 'https', host: 'example.org', port: '4873' });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('"[::1]:4873" (IPv6)', () => {
+      const addr = getListenAddress('[::1]:4873', logger);
+
+      /* parseAddress collapses brackets & assigns proto http */
+      expect(addr).toEqual({ proto: 'http', host: '::1', port: '4873' });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('"https:[::1]:4873" (IPv6)', () => {
+      const addr = getListenAddress('https:[::1]:4873', logger);
+
+      /* parseAddress collapses brackets & assigns proto http */
+      expect(addr).toEqual({ proto: 'https', host: '::1', port: '4873' });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('unix:/tmp/verdaccio.sock (Unix socket)', () => {
+      const addr = getListenAddress('unix:/tmp/verdaccio.sock', logger);
+
+      expect(addr).toEqual({
+        proto: 'unix',
+        path: '/tmp/verdaccio.sock',
+        host: '/tmp/verdaccio.sock',
+      });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('http://foo.sock:34 (Unix socket)', () => {
+      const addr = getListenAddress('http://foo.sock:34', logger);
+
+      expect(addr).toEqual({
+        host: 'foo.sock',
+        port: '34',
+        proto: 'http',
+      });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('http://unix:/tmp/verdaccio.sock (HTTP Unix socket)', () => {
+      const addr = getListenAddress('http://unix:/tmp/verdaccio.sock', logger);
+
+      expect(addr).toEqual({
+        path: '/tmp/verdaccio.sock',
+        proto: 'http',
+        host: '/tmp/verdaccio.sock',
+      });
+      expect(warn).not.toHaveBeenCalled();
+    });
+
+    test('https://unix:/tmp/verdaccio.sock (HTTPS Unix socket)', () => {
+      const addr = getListenAddress('https://unix:/tmp/verdaccio.sock', logger);
+
+      expect(addr).toEqual({
+        path: '/tmp/verdaccio.sock',
+        proto: 'https',
+        host: '/tmp/verdaccio.sock',
+      });
+      expect(warn).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('parseAddress – documented listen values', () => {
+    test('localhost:4873   (default style)', () => {
+      expect(parseAddress('localhost:4873')).toEqual({
+        proto: 'http',
+        host: 'localhost',
+        port: '4873',
+      });
+    });
+
+    test('http://localhost:4873  (explicit protocol)', () => {
+      expect(parseAddress('http://localhost:4873')).toEqual({
+        proto: 'http',
+        host: 'localhost',
+        port: '4873',
+      });
+    });
+
+    test('0.0.0.0:4873  (INADDR_ANY)', () => {
+      expect(parseAddress('0.0.0.0:4873')).toEqual({
+        proto: 'http',
+        host: '0.0.0.0',
+        port: '4873',
+      });
+    });
+
+    test('https://example.org:4873  (HTTPS)', () => {
+      expect(parseAddress('https://example.org:4873')).toEqual({
+        proto: 'https',
+        host: 'example.org',
+        port: '4873',
+      });
+    });
+
+    test('"[::1]:4873"  (IPv6)', () => {
+      expect(parseAddress('[::1]:4873')).toEqual({
+        proto: 'http',
+        host: '::1',
+        port: '4873',
+      });
+    });
+
+    test('unix:/tmp/verdaccio.sock  (Unix socket)', () => {
+      expect(parseAddress('unix:/tmp/verdaccio.sock')).toEqual({
+        host: '/tmp/verdaccio.sock',
+        proto: 'unix',
+        path: '/tmp/verdaccio.sock',
+      });
+    });
+
+    test('https://unix:/tmp/verdaccio.sock  (HTTPS Unix socket)', () => {
+      expect(parseAddress('https://unix:/tmp/verdaccio.sock')).toEqual({
+        host: '/tmp/verdaccio.sock',
+        proto: 'https',
+        path: '/tmp/verdaccio.sock',
+      });
+    });
+  });
+});

packages/config/test/config-parsing.spec.ts

@@ -1,5 +1,5 @@
-import fs from 'fs';
-import path from 'path';
+import { writeFile } from 'node:fs/promises';
+import path from 'node:path';
 import { describe, expect, test } from 'vitest';
 
 import { fileUtils } from '@verdaccio/core';
@@ -7,8 +7,6 @@ import { fileUtils } from '@verdaccio/core';
 import { fromJStoYAML, parseConfigFile } from '../src';
 import { parseConfigurationFile } from './utils';
 
-const { writeFile } = fs.promises ? fs.promises : require('fs/promises');
-
 describe('parse', () => {
   describe('parseConfigFile', () => {
     describe('JSON format', () => {

packages/config/test/config-utils.spec.ts

@@ -1,4 +1,4 @@
-import path from 'path';
+import path from 'node:path';
 import { describe, expect, test } from 'vitest';
 
 import { fileExists, folderExists } from '../src/config-utils';

packages/config/test/config.path.spec.ts

@@ -1,5 +1,5 @@
-import fs from 'fs';
-import os from 'os';
+import fs from 'node:fs';
+import os from 'node:os';
 import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 
 import { findConfigFile } from '../src/config-path';

packages/config/test/config.spec.ts

@@ -1,5 +1,5 @@
 import _ from 'lodash';
-import path from 'path';
+import path from 'node:path';
 import { describe, expect, test } from 'vitest';
 
 import {

packages/config/test/parse.spec.ts

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import { describe, expect, test } from 'vitest';
+
+import { getConfigParsed, parseConfigFile } from '../src';
+
+describe('getConfigParsed', () => {
+  const partialsDir = path.join(__dirname, './partials/config/yaml');
+
+  test('parses config from a YAML file path', () => {
+    const yamlFile = path.join(partialsDir, 'config-getMatchedPackagesSpec.yaml');
+    const config = getConfigParsed(yamlFile);
+    expect(config).toBeDefined();
+  });
+
+  test('parses config from a YAML file path', () => {
+    const yamlFile = path.join(partialsDir, 'config-getMatchedPackagesSpec.yaml');
+    const config = getConfigParsed(parseConfigFile(yamlFile));
+    expect(config).toBeDefined();
+  });
+
+  test('throws error for invalid config type', () => {
+    // @ts-expect-error
+    expect(() => getConfigParsed(123)).toThrow();
+    // @ts-expect-error
+    expect(() => getConfigParsed(true)).toThrow();
+  });
+});

packages/config/test/utils/parse-configuration-file.ts

@@ -1,4 +1,4 @@
-import path from 'path';
+import path from 'node:path';
 
 export const parseConfigurationFile = (conf: string) => {
   const { name, ext } = path.parse(conf);

packages/core/core/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @verdaccio/core
 
+## 8.0.0-next-8.24
+
+## 8.0.0-next-8.23
+
+## 8.0.0-next-8.22
+
+### Patch Changes
+
+- 67e667b: chore: replace conditional require(fs/promises) pattern
+- 60ef8ff: fix(storage): check_owners with anonymous access
+
+## 8.0.0-next-8.21
+
+### Patch Changes
+
+- f8a321f: fix: restore minimatch major version
+
+## 8.0.0-next-8.20
+
+### Minor Changes
+
+- 6a4d6dd: feat: getListenAddress getConfigParsed methods
+
 ## 8.0.0-next-8.19
 
 ### Patch Changes

packages/core/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/core",
-  "version": "8.0.0-next-8.19",
+  "version": "8.0.0-next-8.24",
   "description": "Verdaccio Core Components",
   "keywords": [
     "private",
@@ -36,15 +36,15 @@
     "ajv": "8.17.1",
     "http-errors": "2.0.0",
     "http-status-codes": "2.3.0",
-    "minimatch": "10.0.1",
+    "minimatch": "7.4.6",
     "process-warning": "1.0.0",
-    "semver": "7.7.2"
+    "semver": "7.7.3"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.6",
+    "@verdaccio/types": "workspace:13.0.0-next-8.8",
     "express": "4.21.2",
-    "typedoc": "0.23.25",
-    "vitest": "3.0.4"
+    "typedoc": "0.28.14",
+    "vitest": "3.2.4"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/core/core/src/constants.ts

@@ -7,7 +7,8 @@ export const DIST_TAGS = 'dist-tags';
 export const LATEST = 'latest';
 export const USERS = 'users';
 export const MAINTAINERS = 'maintainers';
-export const DEFAULT_USER = 'Anonymous';
+export const DEFAULT_USER = 'Anonymous'; // for display purposes
+export const ANONYMOUS_USER = 'anonymous'; // for username purposes
 
 export const HEADER_TYPE = {
   CONTENT_ENCODING: 'content-encoding',
@@ -163,3 +164,7 @@ export const PLUGIN_CATEGORY = {
   FILTER: 'filter',
   THEME: 'theme',
 };
+
+export const DEFAULT_PORT = '4873';
+export const DEFAULT_PROTOCOL = 'http';
+export const DEFAULT_DOMAIN = 'localhost';

packages/core/core/src/file-utils.ts

@@ -1,4 +1,4 @@
-import fs from 'node:fs';
+import { mkdir, mkdtemp } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -6,8 +6,6 @@ export const Files = {
   DatabaseName: '.verdaccio-db.json',
 };
 
-const { mkdir, mkdtemp } = fs.promises ? fs.promises : require('fs/promises');
-
 /**
  * Create a temporary folder.
  * @param prefix The prefix of the folder name.