chore(deps): update node.js to v22 (#5093)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.babelrc

@@ -1,26 +0,0 @@
-{
-  "presets": [ [
-    "@babel/env",
-    {
-      "useBuiltIns": "usage",
-      "corejs": {
-        "version": 3, "proposals": true
-      },
-      "targets": {
-        "node": 12
-      }
-    }
-  ],
-    "@babel/typescript"
-  ],
-  "plugins": [
-    "babel-plugin-dynamic-import-node",
-    "@babel/proposal-class-properties",
-    "@babel/proposal-object-rest-spread",
-    "@babel/plugin-proposal-optional-chaining",
-    "@babel/plugin-proposal-nullish-coalescing-operator"
-    ],
-  "ignore": [
-    "**/*.d.ts"
-  ]
-}

.changeset/README.md

@@ -1,8 +0,0 @@
-# Changesets
-
-Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
-with multi-package repos, or single-package repos to help you version and publish your code. You can
-find the full documentation for it [in our repository](https://github.com/changesets/changesets)
-
-We have a quick list of common questions to get you started engaging with this project in
-[our documentation](https://github.com/changesets/changesets/blob/master/docs/common-questions.md)

.changeset/afraid-mice-obey.md

@@ -1,15 +0,0 @@
----
-'@verdaccio/types': minor
-'@verdaccio/ui-theme': minor
-'@verdaccio/web': minor
----
-
-allow disable login on ui and endpoints
-
-To be able disable the login, set `login: false`, anything else would enable login. This flag will disable access via UI and web endpoints.
-
-```yml
-web:
-  title: verdaccio
-  login: false
-```

.changeset/big-lobsters-sin.md

@@ -1,23 +0,0 @@
----
-'@verdaccio/local-storage': major
-'@verdaccio/url': major
-'verdaccio-aws-s3-storage': major
-'verdaccio-google-cloud': major
-'verdaccio-memory': major
-'@verdaccio/store': major
----
-
-# async storage plugin bootstrap
-
-Gives a storage plugin the ability to perform asynchronous tasks on initialization
-
-## Breaking change
-
-Plugin must have an init method in which asynchronous tasks can be executed
-
-```js
-public async init(): Promise<void> {
-   this.data = await this._fetchLocalPackages();
-   this._sync();
-}
-```

.changeset/calm-pants-impress.md

@@ -1,5 +0,0 @@
----
-'verdaccio-aws-s3-storage': patch
----
-
-Fix the prefix used to delete from s3 when unpublishing packages

.changeset/config.json

@@ -1,10 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json",
-  "changelog": "@changesets/cli/changelog",
-  "commit": false,
-  "linked": [],
-  "access": "public",
-  "baseBranch": "master",
-  "updateInternalDependencies": "patch",
-  "ignore": []
-}

.changeset/few-cooks-destroy.md

@@ -1,46 +0,0 @@
----
-'@verdaccio/api': major
-'@verdaccio/auth': major
-'@verdaccio/cli': major
-'@verdaccio/config': major
-'@verdaccio/commons-api': major
-'@verdaccio/file-locking': major
-'verdaccio-htpasswd': major
-'@verdaccio/local-storage': major
-'@verdaccio/readme': major
-'@verdaccio/streams': major
-'@verdaccio/types': major
-'@verdaccio/hooks': major
-'@verdaccio/loaders': major
-'@verdaccio/logger': major
-'@verdaccio/logger-prettify': major
-'@verdaccio/middleware': major
-'@verdaccio/mock': major
-'@verdaccio/node-api': major
-'@verdaccio/active-directory': major
-'verdaccio-audit': major
-'verdaccio-auth-memory': major
-'verdaccio-aws-s3-storage': major
-'verdaccio-google-cloud': major
-'verdaccio-memory': major
-'@verdaccio/proxy': major
-'@verdaccio/server': major
-'@verdaccio/store': major
-'@verdaccio/dev-types': major
-'@verdaccio/utils': major
-'verdaccio': major
-'@verdaccio/web': major
-'@verdaccio/website': major
----
-
-feat!: experiments config renamed to flags
-
-- The `experiments` configuration is renamed to `flags`. The functionality is exactly the same.
-
-```js
-flags: token: false;
-search: false;
-```
-
-- The `self_path` property from the config file is being removed in favor of `config_file` full path.
-- Refactor `config` module, better types and utilities

.changeset/few-mangos-grow.md

@@ -1,5 +0,0 @@
----
-'@verdaccio/ui-theme': minor
----
-
-upgrade to react@17 and other dependencies

.changeset/fifty-jars-rest.md

@@ -1,6 +0,0 @@
----
-'@verdaccio/middleware': patch
-'@verdaccio/web': patch
----
-
-Remove @ts-ignore and any in packages/web/src/endpoint/package.ts

.changeset/gentle-parrots-lay.md

@@ -1,11 +0,0 @@
----
-'@verdaccio/config': minor
-'@verdaccio/local-storage': minor
-'@verdaccio/e2e-ui': minor
----
-
-Some verdaccio modules depend on 'mkdirp' library which provides recursive directory creation functionality.
-NodeJS can do this out of the box since v.10.12. The last commit in 'mkdirp' was made in early 2016, and it's mid 2021 now.
-Time to stick with a built-in library solution!
-
-- All 'mkdirp' calls are replaced with appropriate 'fs' calls.

.changeset/gentle-trains-switch.md

@@ -1,44 +0,0 @@
----
-'@verdaccio/api': major
-'@verdaccio/auth': major
-'@verdaccio/cli': major
-'@verdaccio/config': major
-'@verdaccio/commons-api': major
-'@verdaccio/file-locking': major
-'verdaccio-htpasswd': major
-'@verdaccio/local-storage': major
-'@verdaccio/readme': major
-'@verdaccio/streams': major
-'@verdaccio/types': major
-'@verdaccio/hooks': major
-'@verdaccio/loaders': major
-'@verdaccio/logger': major
-'@verdaccio/logger-prettify': major
-'@verdaccio/middleware': major
-'@verdaccio/mock': major
-'@verdaccio/node-api': major
-'@verdaccio/proxy': major
-'@verdaccio/server': major
-'@verdaccio/store': major
-'@verdaccio/dev-types': major
-'@verdaccio/utils': major
-'verdaccio': major
-'@verdaccio/web': major
----
-
-- Replace signature handler for legacy tokens by removing deprecated crypto.createDecipher by createCipheriv
-- Introduce environment variables for legacy tokens
-
-### Code Improvements
-
-- Add debug library for improve developer experience
-
-### Breaking change
-
-- The new signature invalidates all previous tokens generated by Verdaccio 4 or previous versions.
-- The secret key must have 32 characters long.
-
-### New environment variables
-
-- `VERDACCIO_LEGACY_ALGORITHM`: Allows to define the specific algorithm for the token signature which by default is `aes-256-ctr`
-- `VERDACCIO_LEGACY_ENCRYPTION_KEY`: By default, the token stores in the database, but using this variable allows to get it from memory

.changeset/gold-vans-tease.md

@@ -1,5 +0,0 @@
----
-'@verdaccio/utils': patch
----
-
-Fixed the validation of the name when searching for a tarball that have scoped package name

.changeset/healthy-bikes-behave.md

@@ -1,21 +0,0 @@
----
-'@verdaccio/cli': patch
-'@verdaccio/types': patch
-'@verdaccio/node-api': patch
-'@verdaccio/server': patch
----
-
-fix: restore logger on init
-
-Enable logger after parse configuration and log the very first step on startup phase.
-
-```bash
- warn --- experiments are enabled, it is recommended do not use experiments in production comment out this section to disable it
- info --- support for experiment [token]  is disabled
- info --- support for experiment [search]  is disabled
-(node:50831) Warning: config.logs is deprecated, rename configuration to "config.log"
-(Use `node --trace-warnings ...` to show where the warning was created)
- info --- http address http://localhost:4873/
- info --- version: 6.0.0-6-next.11
- info --- server started
-```

.changeset/healthy-poets-compare.md

@@ -1,11 +0,0 @@
----
-'@verdaccio/config': patch
----
-
-Feature
-
-- add option to set storage from environment variable VERDACCIO_STORAGE_PATH
-
-#### Related tickets
-
-https://github.com/verdaccio/verdaccio/issues/1681

.changeset/heavy-ravens-lay.md

@@ -1,6 +0,0 @@
----
-'@verdaccio/cli': minor
-'@verdaccio/fastify-migration': minor
----
-
-[Fastify] Add ping endpoint

.changeset/hip-hounds-destroy.md

@@ -1,39 +0,0 @@
----
-'@verdaccio/local-storage': patch
-'@verdaccio/ui-theme': patch
-'@verdaccio/server': patch
-'@verdaccio/api': patch
-'@verdaccio/auth': patch
-'@verdaccio/cli': patch
-'@verdaccio/config': patch
-'@verdaccio/commons-api': patch
-'@verdaccio/file-locking': patch
-'verdaccio-htpasswd': patch
-'@verdaccio/readme': patch
-'@verdaccio/streams': patch
-'@verdaccio/types': patch
-'@verdaccio/hooks': patch
-'@verdaccio/loaders': patch
-'@verdaccio/logger': patch
-'@verdaccio/logger-prettify': patch
-'@verdaccio/middleware': patch
-'@verdaccio/mock': patch
-'@verdaccio/node-api': patch
-'@verdaccio/active-directory': patch
-'verdaccio-audit': patch
-'verdaccio-auth-memory': patch
-'verdaccio-aws-s3-storage': patch
-'verdaccio-google-cloud': patch
-'verdaccio-memory': patch
-'@verdaccio/proxy': patch
-'@verdaccio/store': patch
-'@verdaccio/dev-types': patch
-'@verdaccio/utils': patch
-'verdaccio': patch
-'@verdaccio/web': patch
-'@verdaccio/e2e-cli': patch
-'@verdaccio/e2e-ui': patch
-'@verdaccio/website': patch
----
-
-chore: add release step to private regisry on merge changeset pr

.changeset/late-adults-love.md

@@ -1,20 +0,0 @@
----
-'@verdaccio/api': minor
-'verdaccio-htpasswd': minor
-'@verdaccio/local-storage': minor
----
-
-feat: remove level dependency by lowdb for npm token cli as storage
-
-### new npm token database
-
-There will be a new database located in your storage named `.token-db.json` which
-will store all references to created tokens, **it does not store tokens**, just
-mask of them and related metadata required to reference them.
-
-#### Breaking change
-
-If you were relying on `npm token` experiment. This PR will replace the
-used database (level) by a json plain based one (lowbd) which does not
-require Node.js C++ compilation step and has less dependencies. Since was
-a experiment there is no migration step.

.changeset/late-parents-act.md

@@ -1,6 +0,0 @@
----
-'@verdaccio/hooks': patch
-'@verdaccio/proxy': patch
----
-
-refactor: migrate request to node-fetch at hooks package

.changeset/little-stingrays-rule.md

@@ -1,5 +0,0 @@
----
-'verdaccio-audit': patch
----
-
-fix: several issues which caused the audit to fail (#2335)

.changeset/many-vans-care.md

@@ -1,16 +0,0 @@
----
-'@verdaccio/tarball': patch
-'@verdaccio/mock': patch
-'@verdaccio/ui-theme': patch
-'@verdaccio/server': patch
-'@verdaccio/utils': patch
-'verdaccio': patch
----
-
-Bug Fixes
-
-- fix escaped slash in namespaced packages
-
-#### Related tickets
-
-https://github.com/verdaccio/verdaccio/pull/2193

.changeset/modern-spies-tell.md

@@ -1,6 +0,0 @@
----
-'@verdaccio/ui-theme': minor
-'verdaccio': minor
----
-
-feat: ui theme plugin part of the application

.changeset/neat-toes-report.md

@@ -1,51 +0,0 @@
----
-'@verdaccio/api': minor
-'@verdaccio/auth': minor
-'@verdaccio/cli': minor
-'@verdaccio/config': minor
-'@verdaccio/commons-api': minor
-'@verdaccio/file-locking': minor
-'verdaccio-htpasswd': minor
-'@verdaccio/local-storage': minor
-'@verdaccio/readme': minor
-'@verdaccio/streams': minor
-'@verdaccio/types': minor
-'@verdaccio/hooks': minor
-'@verdaccio/loaders': minor
-'@verdaccio/logger': minor
-'@verdaccio/logger-prettify': minor
-'@verdaccio/middleware': minor
-'@verdaccio/mock': minor
-'@verdaccio/node-api': minor
-'@verdaccio/active-directory': minor
-'verdaccio-audit': minor
-'verdaccio-auth-memory': minor
-'verdaccio-aws-s3-storage': minor
-'verdaccio-google-cloud': minor
-'verdaccio-memory': minor
-'@verdaccio/ui-theme': minor
-'@verdaccio/proxy': minor
-'@verdaccio/server': minor
-'@verdaccio/store': minor
-'@verdaccio/dev-types': minor
-'@verdaccio/utils': minor
-'verdaccio': minor
-'@verdaccio/web': minor
----
-
-feat: add server rate limit protection to all request
-
-To modify custom values, use the server settings property.
-
-```markdown
-server:
-
-## https://www.npmjs.com/package/express-rate-limit#configuration-options
-
-rateLimit:
-windowMs: 1000
-max: 10000
-```
-
-The values are intended to be high, if you want to improve security of your server consider
-using different values.

.changeset/perfect-kangaroos-agree.md

@@ -1,5 +0,0 @@
----
-'@verdaccio/cli': major
----
-
-feat: use clipanion over commander

.changeset/plenty-news-remember.md

@@ -1,30 +0,0 @@
----
-'@verdaccio/auth': major
-'verdaccio-htpasswd': major
-'verdaccio-audit': major
-'@verdaccio/server': major
-'@verdaccio/cli-standalone': major
----
-
-feat: standalone registry with no dependencies
-
-## Usage
-
-To install a server with no dependencies
-
-```bash
-npm install -g @verdaccio/standalone
-```
-
-with no internet required
-
-```bash
-npm install -g ./tarball.tar.gz
-```
-
-Bundles htpasswd and audit plugins.
-
-### Breaking Change
-
-It does not allow anymore the `auth` and `middleware` property at config file empty,
-it will fallback to those plugins by default.

.changeset/plenty-spiders-melt.md

@@ -1,36 +0,0 @@
----
-'@verdaccio/api': minor
-'@verdaccio/auth': minor
-'@verdaccio/cli': minor
-'@verdaccio/config': minor
-'@verdaccio/commons-api': minor
-'@verdaccio/file-locking': minor
-'verdaccio-htpasswd': minor
-'@verdaccio/local-storage': minor
-'@verdaccio/readme': minor
-'@verdaccio/streams': minor
-'@verdaccio/types': minor
-'@verdaccio/hooks': minor
-'@verdaccio/loaders': minor
-'@verdaccio/logger': minor
-'@verdaccio/logger-prettify': minor
-'@verdaccio/middleware': minor
-'@verdaccio/mock': minor
-'@verdaccio/node-api': minor
-'@verdaccio/proxy': minor
-'@verdaccio/server': minor
-'@verdaccio/store': minor
-'@verdaccio/dev-types': minor
-'@verdaccio/utils': minor
-'verdaccio': minor
-'@verdaccio/web': minor
-'@verdaccio/website': minor
----
-
-feat: add typescript project references settings
-
-Reading https://ebaytech.berlin/optimizing-multi-package-apps-with-typescript-project-references-d5c57a3b4440 I realized I can use project references to solve the issue to pre-compile modules on develop mode.
-
-It allows to navigate (IDE) trough the packages without need compile the packages.
-
-Add two `tsconfig`, one using the previous existing configuration that is able to produce declaration files (`tsconfig.build`) and a new one `tsconfig` which is enables [_projects references_](https://www.typescriptlang.org/docs/handbook/project-references.html).

.changeset/plenty-tables-refuse.md

@@ -1,6 +0,0 @@
----
-'@verdaccio/cli': minor
-'@verdaccio/node-api': minor
----
-
-feat: improve cli loggin on start up

.changeset/pre.json

@@ -1,81 +0,0 @@
-{
-  "mode": "pre",
-  "tag": "6-next",
-  "initialVersions": {
-    "@verdaccio/api": "6.0.0-alpha.0",
-    "@verdaccio/auth": "6.0.0-alpha.0",
-    "@verdaccio/cli": "6.0.0-alpha.0",
-    "@verdaccio/config": "6.0.0-alpha.0",
-    "@verdaccio/commons-api": "11.0.0-alpha.0",
-    "@verdaccio/file-locking": "11.0.0-alpha.0",
-    "verdaccio-htpasswd": "11.0.0-alpha.0",
-    "@verdaccio/local-storage": "11.0.0-alpha.0",
-    "@verdaccio/readme": "11.0.0-alpha.0",
-    "@verdaccio/streams": "11.0.0-alpha.0",
-    "@verdaccio/types": "11.0.0-alpha.0",
-    "@verdaccio/hooks": "6.0.0-alpha.0",
-    "@verdaccio/loaders": "6.0.0-alpha.0",
-    "@verdaccio/logger": "6.0.0-alpha.0",
-    "@verdaccio/logger-prettify": "6.0.0-alpha.0",
-    "@verdaccio/middleware": "6.0.0-alpha.0",
-    "@verdaccio/mock": "6.0.0-alpha.0",
-    "@verdaccio/node-api": "6.0.0-alpha.0",
-    "@verdaccio/proxy": "6.0.0-alpha.0",
-    "@verdaccio/server": "6.0.0-alpha.0",
-    "@verdaccio/store": "6.0.0-alpha.0",
-    "@verdaccio/dev-types": "6.0.0-alpha.0",
-    "@verdaccio/utils": "6.0.0-alpha.0",
-    "verdaccio": "6.0.0-alpha.0",
-    "@verdaccio/web": "6.0.0-alpha.0",
-    "@verdaccio/active-directory": "11.0.0-alpha.0",
-    "verdaccio-audit": "11.0.0-alpha.0",
-    "verdaccio-auth-memory": "11.0.0-alpha.0",
-    "verdaccio-aws-s3-storage": "11.0.0-alpha.0",
-    "verdaccio-google-cloud": "11.0.0-alpha.0",
-    "verdaccio-memory": "11.0.0-alpha.0",
-    "@verdaccio/ui-theme": "6.0.0-alpha.1",
-    "@verdaccio/e2e-cli": "1.0.0",
-    "@verdaccio/e2e-ui": "1.0.0",
-    "@verdaccio/cli-standalone": "6.0.0-alpha.3",
-    "@verdaccio/tarball": "11.0.0-alpha.3",
-    "@verdaccio/url": "11.0.0-alpha.3",
-    "@verdaccio/fastify-migration": "6.0.0-6-next.9",
-    "@verdaccio/eslint-config": "1.0.0",
-    "@verdaccio/benchmark": "1.0.0",
-    "@verdaccio/website": "5.1.3"
-  },
-  "changesets": [
-    "afraid-mice-obey",
-    "big-lobsters-sin",
-    "calm-pants-impress",
-    "few-cooks-destroy",
-    "few-mangos-grow",
-    "fifty-jars-rest",
-    "gentle-parrots-lay",
-    "gentle-trains-switch",
-    "gold-vans-tease",
-    "healthy-bikes-behave",
-    "healthy-poets-compare",
-    "heavy-ravens-lay",
-    "hip-hounds-destroy",
-    "late-adults-love",
-    "late-parents-act",
-    "little-stingrays-rule",
-    "many-vans-care",
-    "modern-spies-tell",
-    "neat-toes-report",
-    "perfect-kangaroos-agree",
-    "plenty-news-remember",
-    "plenty-spiders-melt",
-    "plenty-tables-refuse",
-    "pretty-hounds-tap",
-    "red-chefs-float",
-    "shiny-chefs-heal",
-    "smart-apricots-kneel",
-    "spicy-frogs-press",
-    "tender-bags-call",
-    "three-pots-sit",
-    "two-dolls-check",
-    "wild-jokes-beam"
-  ]
-}

.changeset/pretty-hounds-tap.md

@@ -1,29 +0,0 @@
----
-'@verdaccio/api': patch
-'@verdaccio/auth': patch
-'@verdaccio/cli': patch
-'@verdaccio/config': patch
-'@verdaccio/commons-api': patch
-'@verdaccio/file-locking': patch
-'verdaccio-htpasswd': patch
-'@verdaccio/local-storage': patch
-'@verdaccio/readme': patch
-'@verdaccio/streams': patch
-'@verdaccio/types': patch
-'@verdaccio/hooks': patch
-'@verdaccio/loaders': patch
-'@verdaccio/logger': patch
-'@verdaccio/logger-prettify': patch
-'@verdaccio/middleware': patch
-'@verdaccio/mock': patch
-'@verdaccio/node-api': patch
-'@verdaccio/proxy': patch
-'@verdaccio/server': patch
-'@verdaccio/store': patch
-'@verdaccio/dev-types': patch
-'@verdaccio/utils': patch
-'verdaccio': patch
-'@verdaccio/web': patch
----
-
-Enable prerelease mode with **changesets**

.changeset/red-chefs-float.md

@@ -1,11 +0,0 @@
----
-'@verdaccio/store': patch
-'@verdaccio/web': patch
----
-
-Fix the search by exact name of the package
-
-Full package name queries was not finding anithing. It was happening
-becouse of stemmer of [lunr.js](https://lunrjs.com/).
-
-To fix this, the stemmer of [lunr.js](https://lunrjs.com/) was removed from search pipeline.

.changeset/shiny-chefs-heal.md

@@ -1,5 +0,0 @@
----
-'@verdaccio/api': patch
----
-
-testing changesets

.changeset/smart-apricots-kneel.md

@@ -1,79 +0,0 @@
----
-'@verdaccio/ui-theme': major
-'@verdaccio/cli-standalone': major
-'@verdaccio/web': major
----
-
-feat: flexible user interface generator
-
-**breaking change**
-
-The UI does not provide a pre-generated `index.html`, instead the server generates
-the body of the web application based in few parameters:
-
-- Webpack manifest
-- User configuration details
-
-It allows inject html tags, javascript and new CSS to make the page even more flexible.
-
-### Web new properties for dynamic template
-
-The new set of properties are made in order allow inject _html_ and _JavaScript_ scripts within the template. This
-might be useful for scenarios like Google Analytics scripts or custom html in any part of the body.
-
-- metaScripts: html injected before close the `head` element.
-- scriptsBodyAfter: html injected before close the `body` element.
-- bodyAfter: html injected after _verdaccio_ JS scripts.
-
-```yaml
-web:
-  scriptsBodyAfter:
-    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
-  metaScripts:
-    - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
-    - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
-    - '<meta name="robots" content="noindex" />'
-  bodyBefore:
-    - '<div id="myId">html before webpack scripts</div>'
-  bodyAfter:
-    - '<div id="myId">html after webpack scripts</div>'
-```
-
-### UI plugin changes
-
-- `index.html` is not longer used, template is generated based on `manifest.json` generated by webpack.
-- Plugin must export:
-  - the manifest file.
-  - the manifest files: matcher (array of id that generates required scripts to run the ui)
-  - static path: The absolute path where the files are located in `node_modules`
-
-```
-exports.staticPath = path.join(__dirname, 'static');
-exports.manifest = require('./static/manifest.json');
-exports.manifestFiles = {
-  js: ['runtime.js', 'vendors.js', 'main.js'],
-  css: [],
-  ico: 'favicon.ico',
-};
-```
-
-- Remove font files
-- CSS is inline on JS (this will help with #2046)
-
-### Docker v5 Examples
-
-- Move all current examples to v4 folder
-- Remove any v3 example
-- Create v5 folder with Nginx Example
-
-#### Related tickets
-
-https://github.com/verdaccio/verdaccio/issues/1523
-https://github.com/verdaccio/verdaccio/issues/1297
-https://github.com/verdaccio/verdaccio/issues/1593
-https://github.com/verdaccio/verdaccio/discussions/1539
-https://github.com/verdaccio/website/issues/264
-https://github.com/verdaccio/verdaccio/issues/1565
-https://github.com/verdaccio/verdaccio/issues/1251
-https://github.com/verdaccio/verdaccio/issues/2029
-https://github.com/verdaccio/docker-examples/issues/29

.changeset/spicy-frogs-press.md

@@ -1,32 +0,0 @@
----
-'verdaccio-htpasswd': major
----
-
-feat: allow other password hashing algorithms (#1917)
-
-**breaking change**
-
-The current implementation of the `htpasswd` module supports multiple hash formats on verify, but only `crypt` on sign in.
-`crypt` is an insecure old format, so to improve the security of the new `verdaccio` release we introduce the support of multiple hash algorithms on sign in step.
-
-### New hashing algorithms
-
-The new possible hash algorithms to use are `bcrypt`, `md5`, `sha1`. `bcrypt` is chosen as a default, because of its customizable complexity and overall reliability. You can read more about them [here](https://httpd.apache.org/docs/2.4/misc/password_encryptions.html).
-
-Two new properties are added to `auth` section in the configuration file:
-
-- `algorithm` to choose the way you want to hash passwords.
-- `rounds` is used to determine `bcrypt` complexity. So one can improve security according to increasing computational power.
-
-Example of the new `auth` config file section:
-
-```yaml
-auth:
-htpasswd:
-  file: ./htpasswd
-  max_users: 1000
-  # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
-  algorithm: bcrypt
-  # Rounds number for "bcrypt", will be ignored for other algorithms.
-  rounds: 10
-```

.changeset/tender-bags-call.md

@@ -1,9 +0,0 @@
----
-'@verdaccio/logger': major
----
-
-logging prettifier only in development mode
-
-- Verdaccio prettify `@verdaccio/logger-prettify` the logging which looks beautiful. But there are scenarios which does not make sense in production. This feature enables disable by default the prettifies if production `NODE_ENV` is enabled.
-- Updates pino.js to `^6.7.0`.
-- Suppress the warning when prettifier is enabled `suppressFlushSyncWarning`

.changeset/three-pots-sit.md

@@ -1,33 +0,0 @@
----
-'@verdaccio/api': patch
-'@verdaccio/auth': patch
-'@verdaccio/cli': patch
-'@verdaccio/config': patch
-'@verdaccio/commons-api': patch
-'@verdaccio/file-locking': patch
-'verdaccio-htpasswd': patch
-'@verdaccio/local-storage': patch
-'@verdaccio/readme': patch
-'@verdaccio/types': patch
-'@verdaccio/hooks': patch
-'@verdaccio/loaders': patch
-'@verdaccio/logger': patch
-'@verdaccio/logger-prettify': patch
-'@verdaccio/middleware': patch
-'@verdaccio/mock': patch
-'@verdaccio/node-api': patch
-'@verdaccio/proxy': patch
-'@verdaccio/server': patch
-'@verdaccio/store': patch
-'@verdaccio/dev-types': patch
-'@verdaccio/utils': patch
-'verdaccio': patch
----
-
-ESLint Warnings Fixed
-
-Related to issue #1461
-
-- max-len: most of the sensible max-len errors are fixed
-- no-unused-vars: most of these types of errors are fixed by deleting not needed declarations
-- @typescript-eslint/no-unused-vars: same as above

.changeset/two-dolls-check.md

@@ -1,28 +0,0 @@
----
-'@verdaccio/cli': major
-'@verdaccio/config': major
-'@verdaccio/types': major
-'@verdaccio/logger': major
-'@verdaccio/node-api': major
-'verdaccio-google-cloud': major
-'verdaccio': major
----
-
-feat: node api new structure based on promise
-
-```js
-import { runServer } from '@verdaccio/node-api';
-// or
-import { runServer } from 'verdaccio';
-
-const app = await runServer(); // default configuration
-const app = await runServer('./config/config.yaml');
-const app = await runServer({ configuration });
-app.listen(4000, (event) => {
-  // do something
-});
-```
-
-### Breaking Change
-
-If you are using the node-api, the new structure is Promise based and less arguments.

.changeset/wild-jokes-beam.md

@@ -1,32 +0,0 @@
----
-'@verdaccio/types': minor
-'@verdaccio/ui-theme': minor
-'@verdaccio/web': minor
----
-
-web: allow ui hide package managers on sidebar
-
-If there is a package manager of preference over others, you can define the package managers to be displayed on the detail page and sidebar, just define in the `config.yaml` and web section the list of package managers to be displayed.
-
-```
-web:
-  title: Verdaccio
-  sort_packages: asc
-  primary_color: #cccccc
-  pkgManagers:
-    - pnpm
-    - yarn
-    # - npm
-```
-
-To disable all package managers, just define empty:
-
-```
-web:
-  title: Verdaccio
-  sort_packages: asc
-  primary_color: #cccccc
-  pkgManagers:
-```
-
-and the section would be hidden.

.dockerignore

@@ -8,22 +8,22 @@
 .*
 # you can add exceptions like in .gitignore to maintain a whitelist:
 # e.g.
-!.babelrc
-!.eslintrc
-!.prettierrc.json
-!.prettierignore
+!babel.config.js
+!eslintrc.js
+!.prettierrc
 !.eslintignore
 !.stylelintrc
+!.jest.config.js
+!.jestEnvironment.js
+!.yarnrc.yml
+!.yarn/releases/yarn-*.cjs
+!.yarn/plugins/*
+!.pnp.js
 
-# do not copy over node_modules we will run `pnpm install` anyway
+# just in case, yarn 2 pnp is enabled
 node_modules
-website
-jest
-docs
-contrib
-docker-examples
-website
-systemd
+.husky/
+.git/
 
 # output from test runs and similar things
 *.log
@@ -33,7 +33,21 @@ coverage/
 # IDE config files
 jsconfig.json
 *.iml
-
 # let's not get too recursive ;)
 Dockerfile*
 docker-compose*.yaml
+.github/
+.husky/
+*.log
+coverage/
+.vscode/
+*.md
+contrib/
+docs/
+docker-examples/
+systemd/
+assets/
+jest*.js
+test/
+wiki/
+debug/

.editorconfig

@@ -7,7 +7,6 @@ end_of_line = lf
 insert_final_newline = true
 
 # 2 space indentation
-[{.,}*.{ts,tsx,js,jsx,yml,yaml}]
+[{.,}*.{js,jsx,yml,yaml}]
 indent_style = space
 indent_size = 2
-quote_type = single

.eslintignore

@@ -1,11 +1,25 @@
-**/fixtures/**
-**/mock/store/**
-**/partials/**
-**/types/custom.d.ts
-build/
+# files
+node_modules
 coverage/
-node_modules/
-static/
-website/
 wiki/
-dist/
+static/
+flow-typed/
+website/
+build/
+Dockerfile
+test/unit/partials/
+types/custom.d.ts
+LICENSE
+.pnp.js
+
+# extensions 
+*.md
+*.lock
+*.yaml
+*.rpi
+*.html
+*.scss
+*.png
+*.jpg
+*.sh
+*.ico

.eslintrc.js

@@ -1,3 +0,0 @@
-module.exports = {
-  extends: ['@verdaccio/eslint-config'],
-};

.gitattributes

@@ -1,199 +0,0 @@
-## GITATTRIBUTES FOR WEB PROJECTS
-#
-# These settings are for any web project.
-#
-# Details per file setting:
-#   text    These files should be normalized (i.e. convert CRLF to LF).
-#   binary  These files are binary and should be left untouched.
-#
-# Note that binary is a macro for -text -diff.
-######################################################################
-
-# Auto detect
-##   Handle line endings automatically for files detected as
-##   text and leave all files detected as binary untouched.
-##   This will handle all files NOT defined below.
-*                 text=lf
-
-# Source code
-*.bash            text eol=lf
-*.bat             text eol=crlf
-*.cmd             text eol=crlf
-*.coffee          text eol=lf
-*.css             text eol=lf
-*.htm             text diff=html
-*.html            text diff=html
-*.inc             text eol=lf
-*.ini             text eol=lf
-*.js              text eol=lf
-*.json            text eol=lf
-*.jsx             text eol=lf
-*.less            text eol=lf
-*.ls              text eol=lf
-*.map             text -diff
-*.od              text eol=lf
-*.onlydata        text eol=lf
-*.php             text diff=php
-*.pl              text eol=lf
-*.ps1             text eol=crlf
-*.py              text diff=python
-*.rb              text diff=ruby
-*.sass            text eol=lf
-*.scm             text eol=lf
-*.scss            text diff=css
-*.sh              text eol=lf
-*.sql             text eol=lf
-*.styl            text eol=lf
-*.tag             text eol=lf
-*.ts              text eol=lf
-*.tsx             text eol=lf
-*.xml             text eol=lf
-*.xhtml           text diff=html
-
-# Docker
-Dockerfile        text eol=lf
-
-# Documentation
-*.ipynb           text eol=lf
-*.markdown        text eol=lf
-*.md              text eol=lf
-*.mdwn            text eol=lf
-*.mdown           text eol=lf
-*.mkd             text eol=lf
-*.mkdn            text eol=lf
-*.mdtxt           text eol=lf
-*.mdtext          text eol=lf
-*.txt             text eol=lf
-AUTHORS           text eol=lf
-CHANGELOG         text eol=lf
-CHANGES           text eol=lf
-CONTRIBUTING      text eol=lf
-COPYING           text eol=lf
-copyright         text eol=lf
-*COPYRIGHT*       text eol=lf
-INSTALL           text eol=lf
-license           text eol=lf
-LICENSE           text eol=lf
-NEWS              text eol=lf
-readme            text eol=lf
-*README*          text eol=lf
-TODO              text eol=lf
-
-# Templates
-*.dot             text eol=lf
-*.ejs             text eol=lf
-*.haml            text eol=lf
-*.handlebars      text eol=lf
-*.hbs             text eol=lf
-*.hbt             text eol=lf
-*.jade            text eol=lf
-*.latte           text eol=lf
-*.mustache        text eol=lf
-*.njk             text eol=lf
-*.phtml           text eol=lf
-*.tmpl            text eol=lf
-*.tpl             text eol=lf
-*.twig            text eol=lf
-*.vue             text eol=lf
-
-# Configs
-*.cnf             text eol=lf
-*.conf            text eol=lf
-*.config          text eol=lf
-.editorconfig     text eol=lf
-.env              text eol=lf
-.gitattributes    text eol=lf
-.gitconfig        text eol=lf
-.htaccess         text eol=lf
-*.lock            text -diff
-package-lock.json text -diff
-*.toml            text eol=lf
-*.yaml            text eol=lf
-*.yml             text eol=lf
-browserslist      text eol=lf
-Makefile          text eol=lf
-makefile          text eol=lf
-
-# Heroku
-Procfile          text eol=lf
-
-# Graphics
-*.ai              binary
-*.bmp             binary
-*.eps             binary
-*.gif             binary
-*.gifv            binary
-*.ico             binary
-*.jng             binary
-*.jp2             binary
-*.jpg             binary
-*.jpeg            binary
-*.jpx             binary
-*.jxr             binary
-*.pdf             binary
-*.png             binary
-*.psb             binary
-*.psd             binary
-# SVG treated as an asset (binary) by default.
-*.svg             text eol=lf
-# If you want to treat it as binary,
-# use the following line instead.
-# *.svg           binary
-*.svgz            binary
-*.tif             binary
-*.tiff            binary
-*.wbmp            binary
-*.webp            binary
-
-# Audio
-*.kar             binary
-*.m4a             binary
-*.mid             binary
-*.midi            binary
-*.mp3             binary
-*.ogg             binary
-*.ra              binary
-
-# Video
-*.3gpp            binary
-*.3gp             binary
-*.as              binary
-*.asf             binary
-*.asx             binary
-*.fla             binary
-*.flv             binary
-*.m4v             binary
-*.mng             binary
-*.mov             binary
-*.mp4             binary
-*.mpeg            binary
-*.mpg             binary
-*.ogv             binary
-*.swc             binary
-*.swf             binary
-*.webm            binary
-
-# Archives
-*.7z              binary
-*.gz              binary
-*.jar             binary
-*.rar             binary
-*.tar             binary
-*.zip             binary
-
-# Fonts
-*.ttf             binary
-*.eot             binary
-*.otf             binary
-*.woff            binary
-*.woff2           binary
-
-# Executables
-*.exe             binary
-*.pyc             binary
-
-# RC files (like .babelrc or .eslintrc)
-*.*rc             text eol=lf
-
-# Ignore files (like .npmignore or .gitignore)
-*.*ignore         text eol=lf

.github/ISSUE_TEMPLATE/bug_report.md

@@ -6,31 +6,10 @@ title: ''
 assignees: ''
 ---
 
-<!-- PLEASE READ THIS:  
- - If you are not sure is a bug, OPEN a DISCUSSION, if is a legitimate bug, is easy to create a bug from a discussion.
- - Empty reports won't be considered and eventually be closed by a bot.
- - Include debugging notes will help to fix it faster, HOW TO: https://github.com/verdaccio/verdaccio/wiki/Debugging-Verdaccio 
- - If you remove this template, ticket will be closed immediately.
- - No English perfect is required, use public translators if is need it, we will do our best to help you.
- - Extra bonus: The most complete this report is delivered, the faster you will get a response.
- - Extra bonus: include screenshots, logs (remove sensitive data).
- - If you are willing to fix it, there is a checkbox at the bottom.
--->
-
-**Your Environment**
-  <!-- bug below the version 5.x will be closed, see SECURITY.md for more details -->
- * **verdaccio version**: 5.x.x
- * **node version** [12.x.x, 14.x.x]:
- * **package manager**: [npm@7, pnpm@6, yarn@2]
- * **os**: [mac, windows@10, linux]
- * **platform**: [npm, docker, helm, other]
-
 **Describe the bug**
-
 <!-- A clear and concise description of what the bug is. -->
 
 **To Reproduce**
-
 <!-- IMPORTANT:
  - How to reproduce the issue
  - Steps to reproduce the issue
@@ -39,11 +18,9 @@ Be aware, the lack of reproducible steps the issue might cause your ticket to be
 -->
 
 **Expected behavior**
-
 <!-- A clear and concise description of what you expected to happen. -->
 
-**Screenshots, server logs, package manager log**
-
+**Screenshots**
 <!-- If applicable, add screenshots to help explain your problem.  -->
 
 **Configuration File (cat ~/.config/verdaccio/config.yaml)**
@@ -51,21 +28,16 @@ Be aware, the lack of reproducible steps the issue might cause your ticket to be
 <!-- Please be careful do not leak any sensitive information, remove tokens -->
 
 **Environment information**
-
 <!-- Please paste the results of running `verdaccio --info` -->
 
 **Debugging output**
-
-- `$ NODE_DEBUG=request verdaccio` display request calls (verdaccio <--> uplinks)
-- `$ DEBUG=verdaccio* verdaccio` enable extreme verdaccio debug mode (verdaccio api)
-- `$ npm -ddd` prints:
-- `$ npm config get registry` prints:
-
-**Contribute to Verdaccio**
-
-- [ ] I'm willing to fix this bug 🥇 
+ - `$ NODE_DEBUG=request verdaccio` display request calls (verdaccio <--> uplinks)
+ - `$ DEBUG=express:* verdaccio` enable extreme verdaccio debug mode (verdaccio api)
+ - `$ npm -ddd` prints:
+ - `$ npm config get registry` prints:
 
 <!--
 
 IMPORTANT: please do not attach external files, all content should be visible from any device.
 -->
+

.github/ISSUE_TEMPLATE/feature.md

@@ -1,24 +1,21 @@
 ---
-name: 'Feature Request 🔮'
+name: "Feature Request \U0001F52E"
 about: You want a feature request.
 title: ''
 labels: 'topic: feature request'
 assignees: ''
+
 ---
 
 <!--
-IMPORTANT: If you don't have an action plan, please consider create a DISCUSSION (idea) instead for an open a feature request issue.
-
-https://github.com/verdaccio/verdaccio/discussions/new
 
 Verdaccio is a project addressed for voluntaries, if you appreciate this project consider to donate.
-1$/5$ or custom amount single contribution
-
-or monthly
 1$/month - minimal contribution
 5$/month - nice contribution
+500$ - help to promote this project, marketing, stickers.
+2000$/year - sponsor status, your company logo will be in our readme, meetups talks and your request will have high priority
 
-https://github.com/sponsors/verdaccio
+https://opencollective.com/verdaccio
 
 As reminder, the Open Source must be sustainable.
 -->

.github/dependabot.yml

@@ -5,21 +5,23 @@
 
 version: 2
 updates:
+
   # Maintain dependencies for GitHub Actions
-  - package-ecosystem: 'github-actions'
-    directory: '/'
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
-      interval: 'weekly'
+      interval: "weekly"
 
   # Maintain dependencies for npm
-  - package-ecosystem: 'npm'
-    directory: '/'
+  - package-ecosystem: "npm"
+    directory: "/"
     schedule:
-      interval: 'daily'
-    allow:
-      - dependency-name: '@verdaccio/*'
-      - dependency-name: 'verdaccio-*'
+      interval: "daily"
+    allow:   
+      - dependency-name: "@verdaccio/*"
+      - dependency-name: "verdaccio-*"
     assignees:
-      - 'verdacciobot'
+      - "verdacciobot"
     labels:
-      - 'bot: dependencies'
+      - "bot: dependencies"
+      

.github/disabled/e2e-angular-cli-workflow.yml

@@ -1,131 +0,0 @@
-on:
-  schedule:
-    - cron: '0 3 * * 5'
-  pull_request:
-    branches:
-      - '**'
-
-name: 'E2E Angular CLI with verdaccio'
-jobs:
-  # todo: fix yarn global issue, cannot find ng
-  #  yarn:
-  #    strategy:
-  #      fail-fast: false
-  #      matrix:
-  #        os: [ubuntu-latest, windows-latest]
-  #
-  #    name: '${{ matrix.os }} / yarn:angular example'
-  #    runs-on: ${{ matrix.os }}
-  #
-  #    steps:
-  #      - uses: actions/checkout@v2.3.1
-  #
-  #      - name: 'Use Node.js 10.x'
-  #        uses: actions/setup-node@v2.1.1
-  #        with:
-  #          node-version: 10.x
-  #      - name: Install Dependencies
-  #        run: yarn install --pure-lockfile
-  #      - name: 'Run verdaccio in the background'
-  #        run: |
-  #          nohup node ./scripts/run-verdaccio.js &
-  #      - name: 'Ping to verdaccio'
-  #        run: |
-  #          npm ping --registry http://localhost:4873
-  #      - name: 'Running the integration test'
-  #        run: |
-  #          source scripts/e2e-setup-ci.sh
-  #          yarn init --yes
-  #
-  #          yarn global add @angular/cli
-  #          which nodemon
-  #          ng new verdaccio-angular --interactive=false
-  #
-  #          cd verdaccio-angular
-  #          echo "registry=http://localhost:4873" > ~/.npmrc
-  #          yarn add @angular-devkit/core@next @babel/preset-env @babel/core -D
-  #
-  #          ng build --aot
-  npm:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-
-    name: '${{ matrix.os }} / npm:angular example'
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2.3.1
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.1
-        with:
-          node-version: 10.x
-      - name: 'install latest npm'
-        run: npm i -g npm
-      - name: Install Dependencies
-        run: yarn install --pure-lockfile
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          echo "registry=http://localhost:4873" > ~/.npmrc
-          npm config set loglevel="http"
-          npm config set fetch-retries="5"
-          npm config set fetch-retry-factor="50"
-          npm config set fetch-retry-mintimeout="20000"
-          npm config set fetch-retry-maxtimeout="80000"
-          npm install -g @angular/cli
-          ng new verdaccio-angular --interactive=false
-
-          cd verdaccio-angular
-          npm install @angular-devkit/core@next @babel/preset-env @babel/core -D
-
-          npm run ng build --aot
-
-#  pnpm throws errors worth to check why
-#  pnpm:
-#    strategy:
-#      fail-fast: false
-#      matrix:
-#        os: [ubuntu-latest, windows-latest]
-#
-#    name: '${{ matrix.os }} / pnpm:angular example'
-#    runs-on: ${{ matrix.os }}
-#
-#    steps:
-#      - uses: actions/checkout@v2.3.1
-#
-#      - name: 'Use Node.js 10.x'
-#        uses: actions/setup-node@v2.1.1
-#        with:
-#          node-version: 10.x
-#      - name: 'install latest pnpm'
-#        run: npm i -g pnpm
-#      - name: Install Dependencies
-#        run: yarn install --pure-lockfile
-#      - name: 'Run verdaccio in the background'
-#        run: |
-#          nohup node ./scripts/run-verdaccio.js &
-#      - name: 'Ping to verdaccio'
-#        run: |
-#          pnpm ping --registry http://localhost:4873
-#      - name: 'Running the integration test'
-#        run: |
-#          source scripts/e2e-setup-ci.sh
-#          pnpm init --force
-#
-#          pnpm install -g @angular/cli
-#          ng new verdaccio-angular --interactive=false
-#
-#          cd verdaccio-angular
-#          echo "registry=http://localhost:4873" > ~/.npmrc
-#          pnpm install @angular-devkit/core@next @babel/preset-env @babel/core -D
-#
-#          pnpm run ng build --aot

.github/disabled/e2e-gatsbyjs-cli-workflow.yml

@@ -1,49 +0,0 @@
-on:
-  schedule:
-    - cron: '0 3 * * 5'
-  pull_request:
-    branches:
-      - '**'
-
-name: 'E2E Gatsby.js CLI with verdaccio'
-jobs:
-  npm:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-
-    name: '${{ matrix.os }} / npm:gatsby example'
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 14.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 14.x
-      - name: 'install latest npm'
-        run: npm i -g npm@latest-6
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          echo "registry=http://localhost:4873
-          loglevel="silent"
-          fetch-retries=10
-          fetch-retry-factor=2
-          fetch-retry-mintimeout=10000
-          fetch-retry-maxtimeout=80000" > ~/.npmrc
-          npm config list
-          npm i -g gatsby
-          gatsby new my-gatsby
-          cd my-gatsby
-          npm run build

.github/disabled/e2e-jest-workflow.yml

@@ -1,121 +0,0 @@
-on:
-  schedule:
-    - cron: '0 3 * * 5'
-  pull_request:
-    branches:
-      - '**'
-
-name: 'E2E Jest with verdaccio'
-jobs:
-  yarn:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-
-    name: '${{ matrix.os }} / yarn:jest example'
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2.3.1
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.1
-        with:
-          node-version: 10.x
-      - name: Install Dependencies
-        run: yarn install --pure-lockfile
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          yarn init --yes
-          yarn add jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-  npm:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-
-    name: '${{ matrix.os }} / npm:jest example'
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2.3.1
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.1
-        with:
-          node-version: 10.x
-      - name: 'install latest npm'
-        run: npm i -g npm
-      - name: Install Dependencies
-        run: yarn install --pure-lockfile
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          npm init --force
-          npm install jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-  pnpm:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-
-    name: '${{ matrix.os }} / pnpm:jest example'
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2.3.1
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.1
-        with:
-          node-version: 10.x
-      - name: 'install latest pnpm'
-        run: npm i -g pnpm
-      - name: Install Dependencies
-        run: yarn install --pure-lockfile
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js &
-      - name: 'Ping to verdaccio'
-        run: |
-          pnpm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          pnpm init --force
-          pnpm install jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js

.github/disabled/registry.yml

@@ -1,13 +0,0 @@
-name: Test local registry for js vulnerabilities
-
-on:
-  schedule:
-    - cron: '0 4 * * 4'
-jobs:
-  security:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Test for public javascript library vulnerabilities
-        uses: lirantal/is-website-vulnerable@1.15.10
-        with:
-          scan-url: 'https://registry.verdaccio.org'

.github/disabled/release-canary.yml

@@ -1,35 +0,0 @@
-name: Canary Release to Verdaccio
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/release-canary.yml
-      - 'packages/**'
-      - 'package.json'
-      - 'lerna.json'
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Use Node (latest)
-        uses: actions/setup-node@v1
-        with:
-          node_version: 13
-      - name: Install
-        run: yarn --frozen-lockfile
-      - name: Clean
-        run: yarn clean
-      - name: Lint
-        run: yarn lint
-      - name: Build
-        run: yarn build
-      - name: Test
-        run: yarn test
-      - name: Publish
-        run: |
-          echo "//registry.verdaccio.org/:_authToken=${{ secrets.VERDACCIO_TOKEN }}" > .npmrc
-          git update-index --assume-unchanged .npmrc
-          yarn publish:canary

.github/lock.yml

@@ -13,10 +13,10 @@ lockLabel: false
 lockComment: >
   🤖This thread has been automatically locked 🔒 since there has not been
   any recent activity after it was closed. 
-
+  
   We lock tickets after 90 days with the idea to encourage you to open a ticket with new fresh data 
   and to provide you better feedback 🤝and better visibility 👀. 
-
+  
   If you consider, you can attach this ticket 📨 to the new one as a reference for better context.
 
   Thanks for being a part of the Verdaccio community! 💘
@@ -26,10 +26,10 @@ lockComment: >
 
 # Optionally, specify configuration settings just for `issues` or `pulls`
 issues:
-  exemptLabels:
-    - help-wanted
-  lockLabel: outdated
+ exemptLabels:
+   - help-wanted
+ lockLabel: outdated
 
 pulls:
-  daysUntilLock: 90
-  lockLabel: outdated
+ daysUntilLock: 90
+ lockLabel: outdated

.github/stale.yml

@@ -1,7 +1,7 @@
 # Number of days of inactivity before an issue becomes stale
-daysUntilStale: 365
+daysUntilStale: 15
 # Number of days of inactivity before a stale issue is closed
-daysUntilClose: 500
+daysUntilClose: 10
 # Issues with these labels will never be considered stale
 exemptLabels:
   - dev: high priority
@@ -10,17 +10,17 @@ exemptLabels:
   - issue: bug
   - dev: discuss
 # Label to use when marking an issue as stale
-staleLabel: 'issue: wontfix'
+staleLabel: issue: wontfix
 # Comment to post when marking an issue as stale. Set to `false` to disable
 markComment: >
-  Hi pal 👋🏼!
+ Hi pal 👋🏼!
 
-  This issue has gone quiet 😶.
+ This issue has gone quiet 😶.
 
-   We get a lot of issues, so we currently close issues after 180 days of inactivity. It’s been at least 90c days since the last update here.
-   If we missed this issue or if you want to keep it open, please reply here. You can also add/suggest the label "discuss" to keep this issue open!
-   As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out [https://github.com/verdaccio/contributing](https://github.com/verdaccio/contributing) for more information about opening PRs, triaging issues, and contributing!
+  We get a lot of issues, so we currently close issues after 25 days of inactivity. It’s been at least 15 days since the last update here.
+  If we missed this issue or if you want to keep it open, please reply here. You can also add/suggest the label "discuss" to keep this issue open!
+  As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out [https://github.com/verdaccio/contributing](https://github.com/verdaccio/contributing) for more information about opening PRs, triaging issues, and contributing!
 
-   Thanks for being a part of the Verdaccio community! 💘
+  Thanks for being a part of the Verdaccio community! 💘
 # Comment to post when closing a stale issue. Set to `false` to disable
 closeComment: false

.github/workflows/benckmark.yml

@@ -1,168 +0,0 @@
----
-name: ci - benchmark
-
-on:
-  schedule:
-    # 3 times day
-    # collecting enough data to draw some graphics
-    - cron: '0 1 * * *'
-  # push:
-  #   branches:
-  #     - master
-jobs:
-  prepare: 
-    name: Prepare build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: 14.x
-      - name: install pnpm
-        run: sudo npm i pnpm@6.6.1 -g
-      - name: set store
-        run: | 
-          mkdir ~/.pnpm-store
-          pnpm config set store-dir ~/.pnpm-store     
-      - name: setup pnpm config registry
-        run: pnpm config set registry https://registry.verdaccio.org
-      - name: install dependencies
-        run: pnpm install
-      - name: Cache .pnpm-store
-        uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-              
-      - name: build
-        run: pnpm build
-      - name: tar packages
-        run: |      
-          tar -czvf ${{ github.workspace }}/pkg.tar.gz -C ${{ github.workspace }}/packages .
-      - uses: actions/upload-artifact@v2
-        with:
-          name: verdaccio-artifact
-          path: pkg.tar.gz
-  benchmark-autocannon:
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        benchmark:
-          - info
-          - tarball
-        verdaccioVersion:
-          # - local
-          - 3.13.1
-          - 4.12.2
-          - 5.1.2
-    name: Benchmark autocannon
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: 14.x
-      - uses: actions/download-artifact@v2
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages          
-      - name: install pnpm
-        # require fixed version
-        run: sudo npm i pnpm@6.6.1 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}   
-      - name: install dependencies
-        run: pnpm install    
-      - name: start registry
-        run: ./scripts/benchmark-prepare.sh ${{matrix.verdaccioVersion}}        
-      - name: benchmark        
-        run: pnpm benchmark:api -- -v ${{matrix.verdaccioVersion}} -f ${{matrix.benchmark}}       
-        shell: bash
-        env:
-          DEBUG: metrics*
-      - uses: actions/upload-artifact@v2
-        with:
-          name: verdaccio-metrics-api
-          path: ./api-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json  
-          if-no-files-found: error
-          retention-days: 10 
-      - name: submit metrics
-        run: pnpm benchmark:submit
-        env:
-          DEBUG: metrics
-          METRICS_SOURCE: autocannon
-          METRICS_URL: ${{ secrets.METRICS_URL }}
-          METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
-          METRICS_BENCHMARK: ${{matrix.benchmark}}
-          METRICS_VERSION: ${{matrix.verdaccioVersion}}
-          METRICS_COMMIT_HASH: ${{ github.sha }}
-          METRICS_FILE_NAME: 'api-results'   
-  benchmark:
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        benchmark:
-          - info
-          - tarball
-        verdaccioVersion:
-          # future 6.x (wip)
-          # - local (master branch)
-          # old versions to compare same test along previous releases
-          - 3.13.1
-          - 4.12.2
-          - 5.1.2
-    name: Benchmark hyperfine
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: 14.x
-      - uses: actions/download-artifact@v2
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages          
-      - name: install pnpm
-        # require fixed version
-        run: sudo npm i pnpm@6.6.1 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}   
-      - name: install dependencies
-        run: pnpm install
-      - name: install hyperfine
-        run: |
-          wget https://github.com/sharkdp/hyperfine/releases/download/v1.11.0/hyperfine_1.11.0_amd64.deb
-          sudo dpkg -i hyperfine_1.11.0_amd64.deb
-      - name: start registry
-        run: ./scripts/benchmark-prepare.sh ${{matrix.verdaccioVersion}}
-      - name: benchmark        
-        run: ./scripts/benchmark-run.sh ${{matrix.benchmark}}
-        # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
-        shell: bash
-      - name: rename
-        run: mv ./hyper-results.json ./hyper-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json
-      - uses: actions/upload-artifact@v2
-        with:
-          name: verdaccio-metrics
-          path: ./hyper-results-${{matrix.verdaccioVersion}}-${{matrix.benchmark}}.json  
-          if-no-files-found: error
-          retention-days: 10 
-      - name: submit metrics
-        run: pnpm benchmark:submit
-        env:
-          DEBUG: metrics
-          METRICS_SOURCE: hyperfine
-          METRICS_URL: ${{ secrets.METRICS_URL }}
-          METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
-          METRICS_BENCHMARK: ${{matrix.benchmark}}
-          METRICS_VERSION: ${{matrix.verdaccioVersion}}
-          METRICS_COMMIT_HASH: ${{ github.sha }}

.github/workflows/changesets.yml

@@ -1,63 +0,0 @@
-name: Changesets
-
-on:
-  schedule:
-    - cron: '0 0 * * *'
-
-  push:
-    branches:
-      - master
-
-env:
-  CI: true
-  PNPM_CACHE_FOLDER: .pnpm-store
-
-jobs:
-  # Update package versions from changesets.
-  version:
-    timeout-minutes: 14
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio'
-    steps:
-      - name: checkout code repository
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-
-      - name: setup node.js
-        uses: actions/setup-node@v2
-        with:
-          node-version: 14
-          registry-url: 'https://registry.verdaccio.org'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.VERDACCIO_TOKEN }}
-
-      - name: install pnpm
-        run: npm i pnpm@6.10.3 -g
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.VERDACCIO_TOKEN }}
-
-      - name: setup pnpm config
-        run: pnpm config set store-dir $PNPM_CACHE_FOLDER
-      - name: setup pnpm config registry
-        run: pnpm config set registry https://registry.verdaccio.org
-
-      - name: install dependencies
-        run: pnpm install
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.VERDACCIO_TOKEN }}
-
-      - name: build
-        run: pnpm build
-
-      - name: create versions
-        uses: verdaccio/changeset-action@master
-        with:
-          version: pnpm ci:version
-          commit: 'chore: update versions'
-          title: 'chore: update versions'
-          publish: pnpm ci:publish
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.VERDACCIO_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.VERDACCIO_TOKEN }}

.github/workflows/ci-lint.yml

@@ -0,0 +1,11 @@
+name: CI Lint
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:  
+    uses: verdaccio/verdaccio/.github/workflows/yarn-ci-lint.yml@master
+

.github/workflows/ci.yml

@@ -1,217 +1,19 @@
 name: CI
 
-on:
-  push:
-    branches:
-      - master
-      - 'changeset-release/master'
-  pull_request:
-    paths:
-      - .changeset/**
-      - .github/workflows/ci.yml
-      - 'packages/**'
-      - 'jest/**'
-      - 'package.json'
-      - 'pnpm-workspace.yaml'
+on: [push, pull_request]
+
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
 jobs:
-  prepare:
-    runs-on: ubuntu-latest
-    name: setup verdaccio
-    services:
-      verdaccio:
-        image: verdaccio/verdaccio:5
-        ports:
-          - 4873:4873
-    steps:
-    - uses: actions/checkout@v2.3.1
-    - name: Use Node 14
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14 
-    - name: Install pnpm
-      run: npm i pnpm@6.10.3 -g
-    - name: set store
-      run: | 
-        mkdir ~/.pnpm-store
-        pnpm config set store-dir ~/.pnpm-store
-    - name: Install
-      run: pnpm recursive install --frozen-lockfile --registry http://localhost:4873
-    - name: Cache .pnpm-store
-      uses: actions/cache@v2
-      with:
-        path: ~/.pnpm-store
-        key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-        restore-keys: |
-          pnpm-
-  lint:
-    runs-on: ubuntu-latest
-    name: Lint
-    needs: prepare
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - name: Use Node 16
-        uses: actions/setup-node@v1
-        with:
-          node-version: 16
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}     
-      - name: Install
-        run: pnpm recursive install --frozen-lockfile --ignore-scripts
-      - name: Lint
-        run: pnpm lint
-  format:
-    runs-on: ubuntu-latest
-    name: Format
-    needs: prepare
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - name: Use Node 16
-        uses: actions/setup-node@v1
-        with:
-          node-version: 16
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}     
-      - name: Install
-        run: pnpm recursive install --frozen-lockfile --ignore-scripts
-      - name: Lint
-        run: pnpm format:check
-  build:
-    runs-on: ubuntu-latest
-    name: build
-    needs: [format, lint]
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - name: Use Node 16
-        uses: actions/setup-node@v1
-        with:
-          node-version: 16
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}     
-      - name: Install
-        run: pnpm recursive install --frozen-lockfile --ignore-scripts
-      - name: build
-        run: pnpm build
-      - name: tar packages
-        run: |      
-          tar -czvf ${{ github.workspace }}/pkg.tar.gz -C ${{ github.workspace }}/packages .
-      - uses: actions/upload-artifact@v2
-        with:
-          name: verdaccio-artifact
-          path: pkg.tar.gz            
-  test:
-    needs: build
+  build: 
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest]
-        node_version: [14]
-    name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node_version }}
-      - uses: actions/download-artifact@v2
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages    
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}                                          
-      - name: Install
-        run: pnpm recursive install --frozen-lockfile --ignore-scripts 
-      - name: Test
-        run: pnpm test
-  ci-e2e-ui:
-    needs: build
-    runs-on: ubuntu-latest
-    name: UI Test E2E Node 14
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - uses: actions/setup-node@v1
-        with:
-          node-version: 14
-      - uses: actions/download-artifact@v2
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages    
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}                                          
-      - name: Install
-        ## we need scripts, pupetter downloads aditional content
-        run: pnpm recursive install --frozen-lockfile 
-      - name: Test UI
-        run: pnpm test:e2e:ui
-        env:
-          DEBUG: verdaccio:e2e*       
-  ci-e2e-cli:
-    needs: build
-    runs-on: ubuntu-latest
-    name: CLI Test E2E Node 14
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - uses: actions/setup-node@v1
-        with:
-          node-version: 14
-      - uses: actions/download-artifact@v2
-        with:
-          name: verdaccio-artifact
-      - name: untar packages
-        run: tar -xzvf pkg.tar.gz -C ${{ github.workspace }}/packages    
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}                                          
-      - name: Install
-        ## we need scripts, pupetter downloads aditional content
-        run: pnpm recursive install --frozen-lockfile
-      - name: Test CLI
-        run: pnpm test:e2e:cli
-  test-windows:
-    needs: [format, lint]
-    runs-on: windows-latest
-    name: windows test node 14
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - name: Use Node 14
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14
-      - name: Install pnpm
-        run: npm i pnpm@6.10.3 -g
-       # pnpm cache is not working for windows (we need a solution)
-      - uses: actions/cache@v2
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}                                            
-      - name: Install
-        run: pnpm recursive install --frozen-lockfile --ignore-scripts 
-      - name: build
-        run: pnpm build
-      - name: Test
-        run: pnpm test
+        node_version: [20, 22]    
+    uses: verdaccio/verdaccio/.github/workflows/yarn-ci.yml@master
+    with:
+      node_version: ${{ matrix.node_version }}

.github/workflows/codeql-analysis.yml

@@ -1,52 +0,0 @@
-name: 'Code scanning - action'
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/codeql-analysis.yml
-      - 'packages/**'
-  schedule:
-    - cron: '0 2 * * 4'
-
-jobs:
-  CodeQL-Build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2.3.1
-        with:
-          # We must fetch at least the immediate parents so that if this is
-          # a pull request then we can checkout the head.
-          fetch-depth: 2
-
-      # If this run was triggered by a pull request event, then checkout
-      # the head of the pull request instead of the merge commit.
-      - run: git checkout HEAD^2
-        if: ${{ github.event_name == 'pull_request' }}
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
-
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
-      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-      # If this step fails, then you should remove it and run the build manually (see below)
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v1
-
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 https://git.io/JvXDl
-
-      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-      #    and modify them (or add more) to build your code if your project
-      #    uses a compiled language
-
-      #- run: |
-      #   make bootstrap
-      #   make release
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1

.github/workflows/docker-publish.yml

@@ -1,51 +1,29 @@
-name: Docker publish to docker.io
+name: Docker publish to docker.io 
 
 on:
   push:
     paths:
       - .github/workflows/docker-publish.yml
-      - .github/workflows/docker-publish.yml
-      - 'packages/**'
+      - 'src/**'
+      - 'conf/**'
+      - 'types/**'
       - 'docker-bin/**'
+      - 'bin/**'
       - 'package.json'
-      - 'pnpm-*.yaml'
-      - 'Dockerfile'
-      - '.dockerignore'
+      - 'yarn.lock'
+      - '.yarn/**'
+      - '.yarnrc.yaml'
+      - '.pnp.js'
     branches:
-      - 'master'
+      - '7.x'
     tags:
-      - 'v*'
+     - 'v*'
+
 jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: docker/setup-qemu-action@v1
-      - uses: docker/setup-buildx-action@v1
-        with:
-          driver-opts: network=host
-      - uses: docker/login-action@v1
-        name: Login Docker Hub
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Prepare docker image tags
-        id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
-        with:
-          images: ${{ github.repository }}
-          tag-custom: nightly-master
-          tag-custom-only: ${{ github.ref == 'refs/heads/master' }}
-          tag-semver: |
-            {{version}}
-            {{major}}
-            {{major}}.{{minor}}
-      - name: Build & Push
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
+  docker-publish:
+      secrets: inherit
+      uses: verdaccio/verdaccio/.github/workflows/shared-docker-publish.yml@master    
+      with:
+        tag-latest: false
+        tag-custom: 7.x-next
+        tag-custom-only: ${{ github.ref == 'refs/heads/7.x' }}

.github/workflows/e2e-angular-cli-workflow.yml

@@ -0,0 +1,12 @@
+on:
+  pull_request:
+  push:
+
+concurrency:
+  group: e2e-angular-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
+name: 'E2E Angular CLI with verdaccio'
+jobs:
+  e2e:  
+    uses: verdaccio/verdaccio/.github/workflows/x-e2e-angular-cli-workflow.yml@master

.github/workflows/e2e-audit-workflow.yml

@@ -0,0 +1,12 @@
+on:
+  pull_request:
+  push:
+
+concurrency:
+  group: e2e-audit-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
+name: 'Plugin Audit E2E'
+jobs:
+  e2e:  
+    uses: verdaccio/verdaccio/.github/workflows/x-e2e-audit-workflow.yml@master

.github/workflows/e2e-gatsbyjs-cli-workflow.yml

@@ -0,0 +1,12 @@
+on:
+  pull_request:
+  push:
+        
+concurrency:
+  group: e2e-gastbyjs-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
+name: 'E2E Gatsby.js CLI with verdaccio'
+jobs:
+  e2e:  
+    uses: verdaccio/verdaccio/.github/workflows/x-e2e-gatsbyjs-cli-workflow.yml@master

.github/workflows/e2e-jest-workflow.yml

@@ -0,0 +1,12 @@
+on:
+  pull_request:
+  push:
+
+concurrency:
+  group: e2e-jest-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
+name: 'E2E Jest with verdaccio'
+jobs:
+  e2e:  
+    uses: verdaccio/verdaccio/.github/workflows/x-e2e-jest-workflow.yml@master

.github/workflows/release-snapshot.yml

@@ -0,0 +1,11 @@
+name: Release Canary
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 7.x
+jobs:
+  snapshot:
+    secrets: inherit
+    uses: verdaccio/verdaccio/.github/workflows/x-release-snapshot.yml@master

.github/workflows/release.yml

@@ -0,0 +1,11 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - '*'
+jobs:
+  snapshot:
+    secrets: inherit
+    uses: verdaccio/verdaccio/.github/workflows/x-release.yml@master
+

.github/workflows/smoke-test-docker.yml

@@ -0,0 +1,17 @@
+name: Docker Smoke Test
+on:
+  workflow_dispatch:
+  push:
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-docker-pkgs-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
+jobs:
+  smoke:  
+    uses: verdaccio/verdaccio/.github/workflows/x-smok-test-docker.yml@master
+    with:
+      docker_tag: '7.x-next'
+

.github/workflows/smoke-test-module.yml

@@ -0,0 +1,17 @@
+name: Module Smoke Test
+on:
+  workflow_dispatch:
+  push:
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-test-pkgs-${{ github.ref }}-7.x
+  cancel-in-progress: true  
+
+jobs:
+  smoke:  
+    uses: verdaccio/verdaccio/.github/workflows/x-smok-test-module.yml@master
+    with:
+      docker_tag: '7.x-next'
+

.github/workflows/test-docker-publish.yml

@@ -0,0 +1,7 @@
+name: Test Docker Build
+
+on: [push, pull_request]
+
+jobs:
+  testDocker:
+   uses: verdaccio/verdaccio/.github/workflows/test-docker-build.yml@master  

.github/workflows/test-publish-package.yml

@@ -0,0 +1,7 @@
+name: Test Publish Package
+
+on: [push, pull_request]
+
+jobs:
+  testVerdaccio:
+    uses: verdaccio/verdaccio/.github/workflows/test-publish-package.yml@master    

.github/workflows/website.yml

@@ -1,148 +0,0 @@
-name: Verdaccio Website CI
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-    paths:
-      - 'website/**'
-      - 'package.json'
-      - './.github/workflows/website.yml'
-  push:
-    branches:
-      - 'master'
-    paths:
-      - 'website/**'
-      - 'package.json'
-      - './.github/workflows/website.yml'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    env:
-      NODE_OPTIONS: --max_old_space_size=4096
-    steps:
-      - uses: actions/checkout@v2.3.1
-
-      - name: Use Node 14
-        uses: actions/setup-node@v2
-        with:
-          node-version: 14
-
-      - name: Cache pnpm modules
-        uses: actions/cache@v2
-        env:
-          cache-name: cache-pnpm-modules
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-
-
-      - uses: pnpm/action-setup@v2.0.1
-        with:
-          version: 6.10.2
-          run_install: |
-            - recursive: true
-              args: [--frozen-lockfile]
-
-      - name: Lint And Pretty
-        run: |
-          pnpm eslint:check --filter ...@verdaccio/website
-          pnpm prettier:check --filter ...@verdaccio/website
-
-      - name: Cache Docusaurus Build
-        uses: actions/cache@v2
-        with:
-          path: website/node_modules/.cache/webpack
-          key: cache/webpack-${{github.ref}}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: cache/webpack-${{github.ref}}
-
-      # Will deploy to production on:
-        # 1st: When a push occurs on master branch
-        # 2nd: When we force the worflow dispatch through the UI
-      - name: Build Production
-        if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
-        env:
-          CROWDIN_VERDACCIO_PROJECT_ID: ${{ secrets.CROWDIN_VERDACCIO_PROJECT_ID }}
-          CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
-          CONTEXT: production
-        run: pnpm netlify:build:production --filter ...@verdaccio/website
-
-      - name: 🔥 Deploy Production Netlify
-        if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
-        uses: semoal/action-netlify-deploy@master
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          netlify-site-id: ${{ secrets.NETLIFY_SITE_ID }}
-          build-dir: './website/build'
-
-      # Will deploy to Preview URL, only when a pull request is open with changes on the website
-      - name: Build Deployment Preview
-        if: github.event_name == 'pull_request' && github.ref != 'refs/heads/master'
-        env:
-          CONTEXT: deploy-preview
-        run: pnpm netlify:build:deployPreview --filter ...@verdaccio/website
-
-      - name: 🤖 Deploy Preview Netlify
-        if: github.event_name == 'pull_request' && github.ref != 'refs/heads/master'
-        uses: semoal/action-netlify-deploy@master
-        id: netlify_preview
-        with:
-          draft: true
-          comment-on-pull-request: true
-          github-deployment-is-production: false
-          github-deployment-is-transient: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          netlify-site-id: ${{ secrets.NETLIFY_SITE_ID }}
-          build-dir: './website/build'
-
-      - name: Audit preview URL with Lighthouse
-        if: github.event_name == 'pull_request' && github.ref != 'refs/heads/master'
-        id: lighthouse_audit
-        uses: treosh/lighthouse-ci-action@v3
-        with:
-          urls: |
-            ${{ steps.netlify_preview.outputs.preview-url }}
-          uploadArtifacts: true
-          temporaryPublicStorage: true
-
-      - name: Format lighthouse score
-        if: github.event_name == 'pull_request' && github.ref != 'refs/heads/master'
-        id: format_lighthouse_score
-        uses: actions/github-script@v3
-        with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
-          script: |
-            const result = ${{ steps.lighthouse_audit.outputs.manifest }}[0].summary
-            const links = ${{ steps.lighthouse_audit.outputs.links }}
-            const formatResult = (res) => Math.round((res * 100))
-            Object.keys(result).forEach(key => result[key] = formatResult(result[key]))
-            const score = res => res >= 90 ? '🟢' : res >= 50 ? '🟠' : '🔴'
-            const comment = [
-                `⚡️ [Lighthouse report](${Object.values(links)[0]}) for the changes in this PR:`,
-                '| Category | Score |',
-                '| --- | --- |',
-                `| ${score(result.performance)} Performance | ${result.performance} |`,
-                `| ${score(result.accessibility)} Accessibility | ${result.accessibility} |`,
-                `| ${score(result['best-practices'])} Best practices | ${result['best-practices']} |`,
-                `| ${score(result.seo)} SEO | ${result.seo} |`,
-                ' ',
-                `*Lighthouse ran on [${Object.keys(links)[0]}](${Object.keys(links)[0]})*`
-            ].join('\n')
-             core.setOutput("comment", comment);
-
-      - name: Add comment to PR
-        if: github.event_name == 'pull_request' && github.ref != 'refs/heads/master'
-        id: comment_to_pr
-        uses: marocchino/sticky-pull-request-comment@v1
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          number: ${{ github.event.issue.number }}
-          header: lighthouse
-          message: |
-            ${{ steps.format_lighthouse_score.outputs.comment }}

.gitignore

@@ -1,45 +1,39 @@
-*.log*
+
 verdaccio-*.tgz
 .DS_Store
 build/
-dist/
-.eslintcache
-node_modules
 
-### database
+### Test
+
+test/unit/partials/store/test-*-storage/*
+test/unit/partials/store/*-storage/*
+test/unit/partials/store/storage_default_storage/*
 .verdaccio-db.json
 .sinopia-db.json
 
-### test
+###
+!bin/verdaccio
 test-storage*
+access-storage*
 .verdaccio_test_env
+node_modules
+package-lock.json
+npm_test-fails-add-tarball*
+yarn-error.log
 
-# docker examples
-docker-examples/v5/reverse_proxy/nginx/relative_path/storage/*
-docker-examples/v5/**/storage/*
-
-# jest
+# coverage
 reports/
 coverage/
 
-## IDE
+# IDE
 .idea/
 
 # Compiled script
-packages/partials
-tsconfig.tsbuildinfo
+static/*
 
-## bundle files
-packages/standalone/dist/
+# This is the Yarn build state; it's local to each clone
+/.yarn/build-state.yml
 
-## ui
-packages/plugins/ui-theme/static
-
-# CI Pnpm cache
-.pnpm-store/
-
-# benchmark
-api-results.json
-hyper-results.json
-hyper-results*.json
-api-results*.json
+# This is the Yarn install state cache, it can be rebuilt anytime
+/.yarn/install-state.gz
+.history

.netlify/netlify-plugin-pnpm/index.js

@@ -1,10 +0,0 @@
-module.exports = {
-  onPreBuild: async ({ utils: { build, run } }) => {
-    try {
-      await run.command("npm install -g pnpm")
-      await run.command("pnpm install --ignore-scripts --frozen-lockfile")
-    } catch (error) {
-      return build.failBuild(error)
-    }
-  }
-}

.netlify/netlify-plugin-pnpm/manifest.yml

@@ -1,2 +0,0 @@
-name: netlify-plugin-pnpm
-inputs: []

.npmignore

@@ -1,3 +1,4 @@
+
 ## npm
 npm-debug.log
 yarn-error.log
@@ -11,7 +12,6 @@ src/
 /.*
 .vscode/
 .circleci/
-debug/
 docker-examples/
 reports/
 ## assets and website
@@ -22,6 +22,7 @@ docs/
 wiki/
 
 ## flow
+flow-typed/
 types/
 
 # jest
@@ -38,3 +39,9 @@ jest.config.js
 contrib/
 storage_default_storage/
 docker-bin/
+yarn-plugins/
+tsconfig.json
+CHANGELOG.md
+SECURITY.md
+CONTRIBUTING.md
+CONTRIBUTORS.md

.npmrc

@@ -1,5 +1,2 @@
 always-auth = true
-recursive-install = true
-registry = https://registry.verdaccio.org
-loglevel=warn
 fetch-retries="10"

.nvmrc

@@ -1 +1 @@
-14
+22

.prettierignore

@@ -6,21 +6,31 @@
 **/pnpm-lock.yaml
 **/verdaccio-corrupted.db.json
 **/wrong.package.json
-crowdin.yaml
-/docs/website
-/website/*
-/website/translated_docs/
+/website/.cache/
+/website/crowdin/
+/website/public/
+/website/src/dictionaries/
 CHANGELOG.md
+README.md
+CHANGELOG.v5.md
 CONTRIBUTORS.md
 node_modules/
 **/coverage/**
-**/static/*.js
 **/build/*.js
-packages/core/local-storage/_storage/**
-packages/standalone/dist/bundle.js
-docker-examples/v5/reverse_proxy/nginx/relative_path/storage/*
-docker-examples/
-build/
-.vscode/
+test/unit/partials/*
+build/*
 .github/
-.netlify/
+.vscode/
+wiki/
+.yarnrc.yml
+yarn-error.log
+.yarn/
+test/functional/store/*
+storage_default_storage/*
+docker-examples/
+.prettierignore
+.npmignore
+.gitignore
+*.ico
+.pnp.js
+babel.config.js

.prettierrc

@@ -1,11 +0,0 @@
-{
-  "endOfLine": "lf",
-  "useTabs": false,
-  "printWidth": 100,
-  "tabWidth": 2,
-  "singleQuote": true,
-  "bracketSpacing": true,
-  "jsxBracketSameLine": true,
-  "trailingComma": "es5",
-  "semi": true
-}

.project

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<projectDescription>
-	<name>verdaccio-dev</name>
-	<comment></comment>
-	<projects>
-	</projects>
-	<buildSpec>
-	</buildSpec>
-	<natures>
-	</natures>
-	<filteredResources>
-		<filter>
-			<id>1630305579538</id>
-			<name></name>
-			<type>26</type>
-			<matcher>
-				<id>org.eclipse.ui.ide.multiFilter</id>
-				<arguments>1.0-name-matches-true-false-node_modules</arguments>
-			</matcher>
-		</filter>
-	</filteredResources>
-</projectDescription>

.sonarcloud.properties

@@ -0,0 +1 @@
+

.stylelintrc

@@ -26,7 +26,7 @@
       "no-descending-specificity": [true, { "severity": "warning" }],
       "no-duplicate-at-import-rules": true,
       "no-duplicate-selectors": true,
-      "no-empty-source": null,
+      "no-empty-source": true,
       "no-extra-semicolons": true,
       "no-invalid-double-slash-comments": true,
       "property-no-unknown": true,
@@ -38,3 +38,4 @@
    }
 
 }
+

.vscode/extensions.json

@@ -0,0 +1,12 @@
+{
+  // See http://go.microsoft.com/fwlink/?LinkId=827846 to learn about workspace recommendations.
+  // Extension identifier format: ${publisher}.${name}. Example: vscode.csharp
+  // List of extensions which should be recommended for users of this workspace.
+  "recommendations": [
+    "EditorConfig.EditorConfig",
+    "dbaeumer.vscode-eslint",
+    "esbenp.prettier-vscode"
+  ],
+  // List of extensions recommended by VS Code that should not be recommended for users of this workspace.
+  "unwantedRecommendations": []
+}

.vscode/launch.json

@@ -1,81 +1,14 @@
 {
-  // Use IntelliSense to learn about possible Node.js debug attributes.
-  // Hover to view descriptions of existing attributes.
-  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "name": "Verdaccio Debug",
-      "port": 9229,
-      "request": "attach",
-      "skipFiles": ["<node_internals>/**"],
-      "type": "pwa-node"
-    },
-    {
-      "type": "node",
-      "request": "launch",
-      "name": "CLI Babel Registry",
-      "stopOnEntry": false,
-      "program": "${workspaceFolder}/debug/bootstrap.js",
-      "args": ["-l", "0.0.0.0:4873"],
-      "env": {
-        "BABEL_ENV": "registry"
-      },
-      "preLaunchTask": "npm: build:webui",
-      "console": "integratedTerminal"
-    },
-    {
-      "name": "Unit Tests",
-      "type": "node",
-      "request": "launch",
-      "program": "${workspaceRoot}/node_modules/bin/jest",
-      "stopOnEntry": false,
-      "args": ["--debug=true"],
-      "cwd": "${workspaceRoot}",
-      "runtimeExecutable": null,
-      "runtimeArgs": ["--nolazy"],
-      "env": {
-        "NODE_ENV": "test",
-        "TZ": "UTC"
-      },
-      "console": "integratedTerminal"
-    },
-    {
-      "name": "Functional Tests",
-      "type": "node",
-      "request": "launch",
-      "program": "${workspaceRoot}/node_modules/.bin/jest",
-      "stopOnEntry": false,
-      "args": [
-        "--config",
-        "./test/jest.config.functional.js",
-        "--testPathPattern",
-        "./test/functional/index*",
-        "--debug=false",
-        "--verbose",
-        "--useStderr",
-        "--detectOpenHandles"
-      ],
-      "cwd": "${workspaceRoot}",
-      "env": {
-        "BABEL_ENV": "testOldEnv",
-        "VERDACCIO_DEBUG": "true",
-        "VERDACCIO_DEBUG_INJECT": "true",
-        "NODE_DEBUG": "TO_DEBUG_REQUEST_REMOVE_THIS_request"
-      },
-      "preLaunchTask": "pre-test",
-      "console": "integratedTerminal",
-      "runtimeExecutable": null,
-      "runtimeArgs": ["--nolazy"]
-    },
-    {
-      "type": "node",
-      "request": "launch",
-      "name": "Verdaccio Compiled",
-      "preLaunchTask": "npm: code:build",
-      "program": "${workspaceRoot}/bin/verdaccio",
-      "args": ["-l", "0.0.0.0:4873"],
-      "console": "integratedTerminal"
-    }
-  ]
+	"version": "0.2.0",
+	"configurations": [
+	{
+		"name": "Attach by Process ID",
+		"processId": "${command:PickProcess}",
+		"request": "attach",
+		"skipFiles": [
+			"<node_internals>/**"
+		],
+		"type": "node"
+	}
+	]
 }

.vscode/settings.json

@@ -1,12 +1,15 @@
 // Place your settings in this file to overwrite default and user settings.
 {
+  "eslint.validate": [
+    "javascript",
+    "typescript"
+  ],
   "files.exclude": {
-    "**/.nyc_output": true,
-    "**/build": true,
-    "**/coverage": true,
-    ".idea": true,
-    "storage_default_storage": true,
-    ".yarn": true
+    "**/.idea": false,
+    "**/coverage": true
   },
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "editor.formatOnSave": true,
+  "search.exclude": {
+    "**/.yarn": true,
+  }
 }

.vscode/tasks.json

@@ -1,21 +0,0 @@
-{
-  // See https://go.microsoft.com/fwlink/?LinkId=733558
-  // for the documentation about the tasks.json format
-  "version": "2.0.0",
-  "tasks": [
-    {
-      "type": "npm",
-      "script": "build:webui",
-      "problemMatcher": []
-    },
-    {
-      "type": "npm",
-      "script": "code:build",
-      "problemMatcher": []
-    },
-    {
-      "label": "pre-test",
-      "dependsOn": ["npm: code:build", "npm: test:clean"]
-    }
-  ]
-}

.yarnrc.yml

@@ -0,0 +1,11 @@
+compressionLevel: mixed
+
+defaultSemverRangePrefix: ""
+
+enableGlobalCache: true
+
+nodeLinker: node-modules
+
+npmRegistryServer: "https://registry.npmjs.org"
+
+yarnPath: .yarn/releases/yarn-4.5.0.cjs

CONTRIBUTING.md

@@ -1,391 +1,13 @@
-# Contributing
+# Contributing to Verdaccio
 
-> Any change matters, whatever the size, just do it.
+Full text for contributing can be read [here](https://verdaccio.org/community/contributing).
 
-We're happy that you're considering contributing! To help, we've prepared these
-guidelines for you:
+## Especifics for the branch 7.x
 
-**Table of Contents**
+The 7.x uses `yarn berry` with Plug and Play enabled, thus some advices are required for helping contributing:
 
-- [Contributing](#contributing)
-  - [How Do I Contribute?](#how-do-i-contribute)
-  - [Development Setup](#development-setup)
-    - [Building the project](#building-the-project)
-    - [Running test](#running-test)
-    - [Running and debugging](#running-and-debugging)
-    - [Debugging compiled code](#debugging-compiled-code)
-  - [Reporting Bugs](#reporting-bugs)
-    - [Read the documentation](#read-the-documentation)
-    - [What's is not considered a bug?](#whats-is-not-considered-a-bug)
-    - [Issue Search](#issue-search)
-    - [Chat](#chat)
-  - [Request Features](#request-features)
-  - [Contributing Guidelines](#contributing-guidelines)
-    - [Submitting a Pull Request](#submitting-a-pull-request)
-    - [Make Changes and Commit](#make-changes-and-commit)
-      - [Caveats](#caveats)
-      - [Before Commit](#before-commit)
-      - [Commit Guidelines](#commit-guidelines)
-    - [Adding a changeset](#adding-a-changeset)
-    - [Update Tests](#update-tests)
-  - [Develop Plugins](#develop-plugins)
-
-## How Do I Contribute?
-
-There are many ways to contribute:
-
-- Report a bug
-- Request a feature you think would be great for Verdaccio
-- Fix bugs
-- Test and triage bugs reported by others
-- Work on requested/approved features
-- Improve the codebase (linting, naming, comments, test descriptions, etc...)
-
-The Verdaccio project is split into several areas:
-
-- **Core**: The [core](https://github.com/verdaccio/verdaccio) is the main repository, built with **Node.js**.
-- **Website**: we use [**Docusaurus**](https://docusaurus.io/) for the **website** and if you are familiar with this technology, you might become the official webmaster.
-- **User Interface**: The [user Interface](https://github.com/verdaccio/ui) is based in **react** and **material-ui** and looking for front-end contributors.
-- **Kubernetes and Helm**: Ts the official repository for the [**Helm chart**](https://github.com/verdaccio/charts).
-
-> There are other areas to contribute, like documentation, translation which are
-> not hosted on this repo but check the last section of this notes for further
-> information.
-
-## Development Setup
-
-Verdaccio uses [pnpm](https://pnpm.io) as the package manager for development in this repository.
-
-If you are using pnpm for the first time the [pnpm configuration documentation](https://pnpm.io/configuring) may be useful to avoid any potential problems with the following steps.
-
-**Note**: pnpm uses npm's configuration formats so check that your global `.npmrc` file does not inadvertently disable package locks. In other words, your `.npmrc` file **should not** contain
-
-```
-package-lock=false
-```
-
-This setting would cause the `pnpm install` command to install incorrect versions of package dependencies and the subsequent `pnpm build` step would likely fail.
-
-To begin your development setup, please install the latest version of pnpm globally:
-
-```
-npm i -g pnpm
-```
-
-With pnpm installed, the first step is installing all dependencies:
-
-```
-pnpm install
-```
-
-### Building the project
-
-To build the project run
-
-```
-pnpm build
-```
-
-### Running test
-
-```
-pnpm test
-```
-
-Verdaccio is a mono repository. To run the tests for for a specific package:
-
-```
-cd packages/store
-pnpm test
-```
-
-or an specific test in that package:
-
-```
-pnpm test test/merge.dist.tags.spec.ts
-```
-
-or a single test unit:
-
-```
-pnpm test test/merge.dist.tags.spec.ts -- -t 'simple'
-```
-
-Coverage reporting is enabled by default, but you can turn it off to speed up
-test runs:
-
-```
-pnpm test test/merge.dist.tags.spec.ts -- -t 'simple' --coverage=false
-```
-
-You can enable increased [`debug`](https://www.npmjs.com/package/debug) output:
-
-```
-DEBUG=verdaccio:* pnpm test
-```
-
-More details in the debug section
-
-### Running and debugging
-
-We use [`debug`](https://www.npmjs.com/package/debug) to add helpful debugging
-output to the code. Each package has it owns namespace.
-
-#### Debugging compiled code
-
-Currently you can only run pre-compiled packages in debug mode. To enable debug
-while running add the `verdaccio` namespace using the `DEBUG` environment
-variable, like this:
-
-```
-DEBUG=verdaccio:* node packages/verdaccio/debug/bootstrap.js
-```
-
-You can filter this output to just the packages you're interested in using
-namespaces:
-
-```
-DEBUG=verdaccio:plugin:* node packages/verdaccio/debug/bootstrap.js
-```
-
-The debug code is intended to analyze what is happening under the hood and none
-of the output is sent to the logger module.
-
-## Reporting Bugs
-
-**Bugs are considered features that are not working as described in
-documentation.**
-
-If you've found a bug in Verdaccio **that isn't a security risk**, please file
-a report in our [issue tracker](https://github.com/verdaccio/verdaccio/issues).
-
-> **NOTE: Verdaccio still does not support all npm commands. Some were not
-> considered important and others have not been requested yet.**
-
-### What's is not considered a bug?
-
-- _Third party integrations_: proxies integrations, external plugins
-- _Package managers_: If a package manager does not support a specific command
-  or cannot be reproduced with another package manager
-- _Features clearly flagged as not supported_
-- _Node.js issues installation in any platform_: If you cannot install the
-  global package (this is considered external issue)
-- Any ticket which has beed flagged as an [external issue
-  ](https://github.com/verdaccio/verdaccio/labels/external-issue)
-
-If you intend to report a **security** issue, please follow our [Security policy
-guidelines](https://github.com/verdaccio/verdaccio/security/policy).
-
-### Issue Search
-
-Before reporting a bug please:
-
-- Search for existing issues to see if it has already been reported
-- Look for the **question** label: we have labelled questions for easy follow-up
-  as [questions](https://github.com/verdaccio/verdaccio/labels/question)
-
-In case any of those match with your search, up-vote it (using GitHub reactions)
-or add additional helpful details to the existing issue to show that it's
-affecting multiple people.
-
-### Chat
-
-Questions can be asked via [Discord](http://chat.verdaccio.org/)
-
-**Please use the `#help` channel.**
-
-## Request Features
-
-New feature requests are welcome. Analyse whether the idea fits within scope of
-the project. Adding in context and the use-case will really help!
-
-**Please provide:**
-
-- A detailed description the advantages of your request
-- Whether or not it's compatible with `npm`, `pnpm` and [_yarn classic_
-  ](https://github.com/yarnpkg/yarn) or [_yarn berry_
-  ](https://github.com/yarnpkg/berry).
-- A potential implementation or design
-- Whatever else is on your mind! 🤓
-
-## Contributing Guidelines
-
-It's very exciting to become a Verdaccio contributor 🙌🏼. To ensure a fast code
-review and merge, please follow the next guidelines:
-
-> Any contribution gives you the right to be part of this organization as
-> _collaborator_.
-
-### Submitting a Pull Request
-
-The following are the steps you should follow when creating a pull request.
-Subsequent pull requests only need to follow step 3 and beyond.
-
-1. Fork the repository on GitHub
-2. Clone the forked repository to your machine
-3. Make your changes and commit them to your local repository
-4. Rebase and push your commits to your GitHub remote fork/repository
-5. Issue a Pull Request to the official repository
-6. Your Pull Request is reviewed by a committer and merged into the repository
-
-**NOTE**: While there are other ways to accomplish the steps using other tools,
-the examples here will assume most actions will be performed via `git` on
-command line.
-
-For more information on maintaining a fork, please see the GitHub Help article
-titled [Fork a Repo](https://help.github.com/articles/fork-a-repo/), and
-information on [rebasing](https://git-scm.com/book/en/v2/Git-Branching-Rebasing).
-
-### Make Changes and Commit
-
-#### Caveats
-
-Feel free to commit as much times you want in your branch, but keep on mind on
-this repository we `git squash` on merge by default, as we like to maintain a
-clean git history.
-
-#### Before Commit
-
-Before committing, **you must ensure there are no linting errors and
-all tests pass.** To do this, run these commands before create the PR:
+### Debugging Jest
 
 ```bash
-pnpm lint
-pnpm format
-pnpm build
-pnpm test
+yarn node --inspect-brk --expose-gc $(yarn bin jest) test --runInBand --silent --logHeapUsage test/unit/modules/api/publish.spec.ts
 ```
-
-> note: eslint and formatting are run separately, keep code formatting
-> before push.
-
-All good? Perfect! You should create the pull request.
-
-#### Commit Guidelines
-
-For example:
-
-- `feat: A new feature`
-- `fix: A bug fix`
-
-A commit of the type feat introduces a new feature to the codebase (this
-correlates with MINOR in semantic versioning).
-
-e.g.:
-
-```
-feat: xxxxxxxxxx
-```
-
-A commit of the type fix patches a bug in your codebase (this correlates with
-PATCH in semantic versioning).
-
-e.g.:
-
-```
-fix: xxxxxxxxxxx
-```
-
-Commits types such as as `docs:`,`style:`,`refactor:`,`perf:`,`test:` and
-`chore:` are valid but have no effect on versioning: **please use them!**
-
-All commits message are going to be validated when they are created using
-_husky_ hooks.
-
-> Please try to provide one single commit to help a clean and easy merge process
-
-### Adding a changeset
-
-We use [changesets](https://github.com/atlassian/changesets) in order to
-generate a detailed Changelog as possible.
-
-Adding a changeset with your Pull Request is essential if you want your
-contribution to get merged (unless is a change that does not affect library
-functionality, eg: typo, docs, readme, add additional test or linting code). To
-create a changeset please run:
-
-```
-pnpm changeset
-```
-
-Then select the packages you want to include in your changeset navigating
-through them and press the spacebar to check it, on finish press enter to move
-to the next step.
-
-```
-🦋  Which packages would you like to include? …
-✔ changed packages
- changed packages
-  ✔ @verdaccio/api
-  ✔ @verdaccio/auth
-  ✔ @verdaccio/cli
-  ✔ @verdaccio/config
-  ✔ @verdaccio/commons-api
-```
-
-The next question would be if you want a _major bump_. This is not the usual
-scenario, most likely you want a patch, and in that case press enter 2 times
-(to skip minor)
-
-```
-🦋  Which packages should have a major bump? …
-✔ all packages
-  ✔ @verdaccio/config@5.0.0-alpha.0
-```
-
-Once you have the desired bump you need, the CLI will ask for a summary. Here
-you have full freedom on what to include:
-
-```
-🦋  Which packages would you like to include? · @verdaccio/config
-🦋  Which packages should have a major bump? · No items were selected
-🦋  Which packages should have a minor bump? · No items were selected
-🦋  The following packages will be patch bumped:
-🦋  @verdaccio/config@5.0.0-alpha.0
-🦋  Please enter a summary for this change (this will be in the changelogs). Submit empty line to open external editor
-🦋  Summary ›
-```
-
-The last step is to confirm your changeset or abort the operation:
-
-```
-🦋  Is this your desired changeset? (Y/n) · true
-🦋  Changeset added! - you can now commit it
-🦋
-🦋  If you want to modify or expand on the changeset summary, you can find it here
-🦋  info /Users/user/verdaccio.clone/.changeset/light-scissors-smell.md
-```
-
-Once the changeset is added (all will have an unique name) you can freely edit
-using markdown, adding additional information, code snippets or whatever else
-you consider to be relevant.
-
-All that information will be part of the **changelog**. Be concise but
-informative! It's recommended to add your nickname and GitHub link to your
-profile.
-
-**PRs that do not follow the commit message guidelines will not be merged.**
-
-### Update Tests
-
-**Any change in source code must include test updates**.
-
-If you need help with how testing works, please [refer to the following guide
-](https://github.com/verdaccio/verdaccio/wiki/Running-and-Debugging-tests).
-
-**If you are introducing new features, you MUST include new tests. PRs for
-features without tests will not be merged.**
-
-## Develop Plugins
-
-Plugins are add-ons that extend the functionality of the application.
-
-If you want to develop your own plugin:
-
-1. Check whether there is a legacy Sinopia plugin for the feature that you need
-   via [npmjs](https://www.npmjs.com/search?q=sinopia)
-2. Keep in mind the [life-cycle to load a plugin
-   ](https://verdaccio.org/docs/en/dev-plugins)
-3. You are free to host your plugin in your repository
-4. Provide a detailed description of your plugin to help users understand how to
-   use it

CONTRIBUTORS.md

@@ -1,4 +1,5 @@
 <!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
 <!-- markdownlint-disable -->
 <table>
   <tr>
@@ -36,4 +37,5 @@
 </table>
 
 <!-- markdownlint-enable -->
+<!-- prettier-ignore-end -->
 <!-- ALL-CONTRIBUTORS-LIST:END -->

Dockerfile

@@ -1,25 +1,37 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} node:14.17.6-alpine as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} node:22.14.0-alpine as builder
 
-ENV NODE_ENV=development \
-    VERDACCIO_BUILD_REGISTRY=https://registry.verdaccio.org
+ENV NODE_ENV=production \
+    VERDACCIO_BUILD_REGISTRY=https://registry.npmjs.org  \
+    HUSKY_SKIP_INSTALL=1 \
+    CI=true \
+    HUSKY_DEBUG=1
 
-RUN apk --no-cache add openssl ca-certificates wget && \
-    apk --no-cache add g++ gcc libgcc libstdc++ linux-headers make python && \
+RUN apk add --force-overwrite && \
+    apk --no-cache add openssl ca-certificates wget && \
+    apk --no-cache add g++ gcc libgcc libstdc++ linux-headers make python3 && \
     wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \
-    wget -q https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.25-r0/glibc-2.25-r0.apk && \
-    apk add glibc-2.25-r0.apk
+    wget -q https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r0/glibc-2.35-r0.apk && \
+    apk add --force-overwrite glibc-2.35-r0.apk
 
 WORKDIR /opt/verdaccio-build
 COPY . .
 
-RUN npm -g i pnpm@6.10.3 && \
-    pnpm config set registry $VERDACCIO_BUILD_REGISTRY && \
-    pnpm recursive install --frozen-lockfile --ignore-scripts && \
-    pnpm run build
-# FIXME: need to remove devDependencies from the build
-# RUN pnpm install --prod --ignore-scripts
+## build the project and create a tarball of the project for later
+## global installation
+RUN yarn config set npmRegistryServer $VERDACCIO_BUILD_REGISTRY && \
+    yarn config set enableProgressBars true && \
+    yarn config set enableScripts false && \
+    yarn install --immutable && \
+    yarn build
+## pack the project
+RUN yarn pack --dry-run \
+    && yarn pack --out verdaccio.tgz \
+    && mkdir -p /opt/tarball \
+    && mv /opt/verdaccio-build/verdaccio.tgz /opt/tarball
+## clean up and reduce bundle size
+RUN rm -Rf /opt/verdaccio-build
 
-FROM node:14.17.6-alpine
+FROM node:22.14.0-alpine
 LABEL maintainer="https://github.com/verdaccio/verdaccio"
 
 ENV VERDACCIO_APPDIR=/opt/verdaccio \
@@ -32,17 +44,30 @@ ENV PATH=$VERDACCIO_APPDIR/docker-bin:$PATH \
 
 WORKDIR $VERDACCIO_APPDIR
 
+# https://github.com/Yelp/dumb-init
 RUN apk --no-cache add openssl dumb-init
 
 RUN mkdir -p /verdaccio/storage /verdaccio/plugins /verdaccio/conf
 
-COPY --from=builder /opt/verdaccio-build .
+COPY --from=builder /opt/tarball .
 
-RUN ls packages/config/src/conf
-ADD packages/config/src/conf/docker.yaml /verdaccio/conf/config.yaml
+USER root
+# install verdaccio as a global package so is fully handled by npm
+# ensure none dependency is being missing and is prod by default
+RUN npm install -g $VERDACCIO_APPDIR/verdaccio.tgz \
+    ## clean up cache
+    && npm cache clean --force \
+    && rm -Rf .npm/ \
+    && rm $VERDACCIO_APPDIR/verdaccio.tgz \
+    # yarn is not need it after this step
+    # Also remove the symlinks added in the [`node:alpine` Docker image](https://github.com/nodejs/docker-node/blob/02a64a08a98a472c6141cd583d2e9fc47bcd9bfd/18/alpine3.16/Dockerfile#L91-L92).
+    && rm -Rf /opt/yarn-v1.22.19/ /usr/local/bin/yarn /usr/local/bin/yarnpkg
+
+ADD conf/docker.yaml /verdaccio/conf/config.yaml
+ADD docker-bin $VERDACCIO_APPDIR/docker-bin
 
 RUN adduser -u $VERDACCIO_USER_UID -S -D -h $VERDACCIO_APPDIR -g "$VERDACCIO_USER_NAME user" -s /sbin/nologin $VERDACCIO_USER_NAME && \
-    chmod -R +x $VERDACCIO_APPDIR/packages/verdaccio/bin $VERDACCIO_APPDIR/docker-bin && \
+    chmod -R +x /usr/local/lib/node_modules/verdaccio/bin/verdaccio $VERDACCIO_APPDIR/docker-bin && \
     chown -R $VERDACCIO_USER_UID:root /verdaccio/storage && \
     chmod -R g=u /verdaccio/storage /etc/passwd
 
@@ -54,4 +79,4 @@ VOLUME /verdaccio/storage
 
 ENTRYPOINT ["uid_entrypoint"]
 
-CMD $VERDACCIO_APPDIR/packages/verdaccio/bin/verdaccio --config /verdaccio/conf/config.yaml --listen $VERDACCIO_PROTOCOL://0.0.0.0:$VERDACCIO_PORT
+CMD verdaccio --config /verdaccio/conf/config.yaml --listen $VERDACCIO_PROTOCOL://0.0.0.0:$VERDACCIO_PORT

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Verdaccio contributors
+Copyright (c) 2023 Verdaccio contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -2,9 +2,7 @@
 
 ![verdaccio gif](https://cdn.verdaccio.dev/readme/readme-website.png)
 
-# Version 6 (Development branch)
-
-> Looking for Verdaccio 5? Check branch `5.x`.
+# Version 7.x
 
 [Verdaccio](https://verdaccio.org/) is a simple, **zero-config-required local private npm registry**.
 No need for an entire database just to get started! Verdaccio comes out of the box with
@@ -20,28 +18,75 @@ Google Cloud Storage** or create your own plugin.
 [![backers](https://opencollective.com/verdaccio/tiers/backer/badge.svg?label=Backer&color=brightgreen)](https://opencollective.com/verdaccio)
 [![stackshare](https://img.shields.io/badge/Follow%20on-StackShare-blue.svg?logo=stackshare&style=flat)](https://stackshare.io/verdaccio)
 
-[![discord](https://img.shields.io/discord/388674437219745793.svg)](http://chat.verdaccio.org/)
+[![discord](https://img.shields.io/discord/388674437219745793.svg)](https://discord.gg/7qWJxBf)
 [![MIT](https://img.shields.io/github/license/mashape/apistatus.svg)](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)
 [![Crowdin](https://d322cqt584bo4o.cloudfront.net/verdaccio/localized.svg)](https://crowdin.com/project/verdaccio)
 
-[![Twitter followers](https://img.shields.io/twitter/follow/verdaccio_npm.svg?style=social&label=Follow)](https://twitter.com/verdaccio_npm)
 [![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)
+[![StandWithUkraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
 
 ## Install
 
 Install with npm:
 
+> Consider `latest-6` tag as not a definitive release. 
+
 ```bash
-npm install --global verdaccio@6-next --registry https://registry.verdaccio.org/
+npm install --location=global verdaccio@latest-6
 ```
 
-> Published on a temporary registry while setup is ready to publish on npmjs
+> Node.js v18 or higher is required for Verdaccio 6
+
+or pull [Docker official image](https://verdaccio.org/docs/docker)
+
+```bash
+docker pull verdaccio/verdaccio
+```
+
+and run
+
+```bash
+docker run -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio
+```
+
+or with _helm_ [official chart](https://github.com/verdaccio/charts).
+
+```bash
+helm repo add verdaccio https://charts.verdaccio.org
+helm repo update
+helm install verdaccio/verdaccio
+```
+
+## Programmatic API
+
+Verdaccio can be used as a module for launch a server programmatically, [you can find more info at the website](https://verdaccio.org/docs/verdaccio-programmatically#using-the-module-api).
+
+```
+ const {runServer} = require('verdaccio');
+ const app = await runServer(); // default configuration
+ const app = await runServer('./config/config.yaml');
+ const app = await runServer({ configuration });
+ app.listen(4873, (event) => {
+   // do something
+ });
+```
+
+## Plugins
+
+You can develop your own [plugins](https://verdaccio.org/docs/plugins) with the [verdaccio generator](https://github.com/verdaccio/generator-verdaccio-plugin). Installing [Yeoman](https://yeoman.io/) is required.
+
+```
+npm install --location=global yo
+npm install --location=global generator-verdaccio-plugin
+```
+
+Learn more [here](https://verdaccio.org/docs/dev-plugins) how to develop plugins. Share your plugins with the community.
 
 ## Donations
 
-Verdaccio is run by **volunteers**; nobody is working full-time on it. If you find this project to be useful and would like to support its development, consider making a donation - **your logo might end up in this readme.** 😉
+Verdaccio is run by **volunteers**; nobody is working full-time on it. If you find this project to be useful and would like to support its development and maintenance.
 
-**[Donate](https://github.com/sponsors/verdaccio)** 💵👍🏻 starting from _$1/month_ or just one single contribution.
+You can donate **[GitHub Sponsors](https://github.com/sponsors/verdaccio)** or **[Open Collective](https://opencollective.com/verdaccio)** 💵👍🏻 starting from _$1/month_ or just one single contribution.
 
 ## What does Verdaccio do for me?
 
@@ -65,23 +110,21 @@ If you want to use a modified version of some 3rd-party package (for example, yo
 ### E2E Testing
 
 Verdaccio has proved to be a lightweight registry that can be
-booted in a couple of seconds, fast enough for any CI. Many open source projects use verdaccio for end to end testing, to mention some examples, **create-react-app**, **mozilla neutrino**, **pnpm**, **storybook**, **alfresco** or **eclipse theia**. You can read more in dedicated article to E2E in our blog.
+booted in a couple of seconds, fast enough for any CI. Many open source projects use verdaccio for end to end testing, to mention some examples, **create-react-app**, **mozilla neutrino**, **pnpm**, **storybook**, **babel.js**, **angular-cli** or **docusaurus**. You can read more in [here](https://verdaccio.org/docs/e2e).
+
+Furthermore, here few examples how to start:
+
+- [e2e-ci-example-gh-actions](https://github.com/juanpicado/e2e-ci-example-gh-actions)
+- [verdaccio-end-to-end-tests](https://github.com/juanpicado/verdaccio-end-to-end-tests)
+- [verdaccio-fork](https://github.com/juanpicado/verdaccio-fork)
 
 ## Talks
 
-### **Testing the integrity of your React components by publishing in a private registry - React Finland 2021**.
+- [**NodeTLV 2022** - Deep dive into Verdaccio, a lightweight Node.js registry - **Juan Picado**](https://portal.gitnation.org/contents/five-ways-of-taking-advantage-of-verdaccio-your-private-and-proxy-nodejs-registry)
+- [Five Ways of Taking Advantage of Verdaccio, Your Private and Proxy Node.js Registry **Node Congress 2022** - **Juan Picado**](https://portal.gitnation.org/contents/five-ways-of-taking-advantage-of-verdaccio-your-private-and-proxy-nodejs-registry)
+- [Using Docker and Verdaccio to make Integration Testing Easy - **Docker All Hands #4 December - 2021** - **Juan Picado**](https://www.youtube.com/watch?v=zRI0skF1f8I)
 
-[![beerjscrb](https://cdn.verdaccio.dev/readme/react-finland-2021-jpicado.jpeg)](https://react-finland.fi/schedule/#testing-the-integrity-of-your-react-components-by-publishing-in-a-private-registry)
-
-You might want to check out as well our previous talks:
-
-- [BeerJS Cba Meetup No. 53 May 2021 - **Juan Picado**](https://www.youtube.com/watch?v=6SyjqBmS49Y&ab_channel=BeerJSCba)
-- [Node.js Dependency Confusion Attacks - April 2021 - **Juan Picado\***](https://www.youtube.com/watch?v=qTRADSp3Hpo)
-- [**OpenJS World 2020** about \*Cover your Projects with a Multi purpose Lightweight Node.js Registry - **Juan Picado\***](https://www.youtube.com/watch?v=oVCjDWeehAQ)
-- [ViennaJS Meetup - Introduction to Verdaccio by **Priscila Olivera** and **Juan Picado**](https://www.youtube.com/watch?v=hDIFKzmoCa)
-- [Open Source? trivago - Verdaccio (**Ayush** and **Juan Picado**) January 2020](https://www.youtube.com/watch?v=A5CWxJC9xzc)
-- [GitNation Open Source Stage - How we have built a Node.js Registry with React - **Juan Picado** December 2019](https://www.youtube.com/watch?v=gpjC8Qp9B9A)
-- [Verdaccio - A lightweight Private Proxy Registry built in Node.js | **Juan Picado** at The Destro Dev Show](https://www.youtube.com/watch?reload=9&v=P_hxy7W-IL4&ab_channel=TheDestroDevShow)
+[View more in the YouTube channel](https://www.youtube.com/channel/UC5i20v6o7lSjXzAHOvatt0w).
 
 ## Get Started
 
@@ -135,11 +178,15 @@ Below are the most commonly needed information,
 every aspect of Docker and verdaccio is [documented separately](https://www.verdaccio.org/docs/en/docker.html)
 
 ```
-docker pull verdaccio/verdaccio:nightly-master
+docker pull verdaccio/verdaccio
 ```
 
 Available as [tags](https://hub.docker.com/r/verdaccio/verdaccio/tags/).
 
+```
+docker pull verdaccio/verdaccio:5.x-next
+```
+
 ### Running verdaccio using Docker
 
 To run the docker container:
@@ -156,27 +203,27 @@ Verdaccio aims to support all features of a standard npm client that make sense
 
 ### Basic features
 
-- Installing packages (npm install, npm upgrade, etc.) - **supported**
-- Publishing packages (npm publish) - **supported**
+- Installing packages (`npm install`, `npm upgrade`, etc.) - **supported**
+- Publishing packages (`npm publish`) - **supported**
 
 ### Advanced package control
 
-- Unpublishing packages (npm unpublish) - **supported**
-- Tagging (npm tag) - **supported**
-- Deprecation (npm deprecate) - **supported**
+- Unpublishing packages (`npm unpublish`) - **supported**
+- Tagging (`npm tag`) - **supported**
+- Deprecation (`npm deprecate`) - **supported**
 
 ### User management
 
-- Registering new users (npm adduser {newuser}) - **supported**
-- Change password (npm profile set password) - **supported**
-- Transferring ownership (npm owner add {user} {pkg}) - not supported, _PR-welcome_
-- Token (npm token) - **supported**
+- Registering new users (`npm adduser {newuser}`) - **supported**
+- Change password (`npm profile set password`) - **supported**
+- Transferring ownership (`npm owner add {user} {pkg}`) - not supported, _PR-welcome_
+- Token (`npm token`) - **supported** (under flag)
 
 ### Miscellany
 
-- Searching (npm search) - **supported** (cli / browser)
-- Ping (npm ping) - **supported**
-- Starring (npm star, npm unstar, npm stars) - **supported**
+- Search (`npm search`) - **supported** (cli (`/-/all` and `v1`) / browser)
+- Ping (`npm ping`) - **supported**
+- Starring (`npm star`, `npm unstar`, `npm stars`) - **supported**
 
 ### Security
 
@@ -186,38 +233,38 @@ Verdaccio aims to support all features of a standard npm client that make sense
 
 If you want to report a security vulnerability, please follow the steps which we have defined for you in our [security policy](https://github.com/verdaccio/verdaccio/security/policy).
 
-## Core Team
+## Contributors
 
-| [Juan Picado](https://github.com/juanpicado)                                   | [Ayush Sharma](https://github.com/ayusharma)                             | [Sergio Hg](https://github.com/sergiohgz)                                 |
-| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | ------------------------------------------------------------------------- |
-| ![jotadeveloper](https://avatars3.githubusercontent.com/u/558752?s=120&v=4)    | ![ayusharma](https://avatars2.githubusercontent.com/u/6918450?s=120&v=4) | ![sergiohgz](https://avatars2.githubusercontent.com/u/14012309?s=120&v=4) |
-| [@jotadeveloper](https://twitter.com/jotadeveloper)                            | [@ayusharma\_](https://twitter.com/ayusharma_)                           | [@sergiohgz](https://twitter.com/sergiohgz)                               |
-| [Priscila Oliveria](https://github.com/priscilawebdev)                         | [Daniel Ruf](https://github.com/DanielRuf)                               |
-| ![priscilawebdev](https://avatars2.githubusercontent.com/u/29228205?s=120&v=4) | ![DanielRuf](https://avatars3.githubusercontent.com/u/827205?s=120&v=4)  |
-| [@priscilawebdev](https://twitter.com/priscilawebdev)                          | [@DanielRufde](https://twitter.com/DanielRufde)                          |
+| [Juan Picado](https://github.com/juanpicado)                                  | [Ayush Sharma](https://github.com/ayusharma)                            | [Sergio Hg](https://github.com/sergiohgz)                                |
+| ----------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| ![jotadeveloper](https://avatars3.githubusercontent.com/u/558752?s=80&v=4)    | ![ayusharma](https://avatars2.githubusercontent.com/u/6918450?s=80&v=4) | ![sergiohgz](https://avatars2.githubusercontent.com/u/14012309?s=80&v=4) |
+| [@jotadeveloper](https://fosstodon.org/@jotadeveloper)                        | [@ayusharma\_](https://twitter.com/ayusharma_)                          | [@sergiohgz](https://twitter.com/sergiohgz)                              |
+| [Priscila Oliveria](https://github.com/priscilawebdev)                        | [Daniel Ruf](https://github.com/DanielRuf)                              |
+| ![priscilawebdev](https://avatars2.githubusercontent.com/u/29228205?s=80&v=4) | ![DanielRuf](https://avatars3.githubusercontent.com/u/827205?s=80&v=4)  |
+| [@priscilawebdev](https://twitter.com/priscilawebdev)                         | [@DanielRufde](https://twitter.com/DanielRufde)                         |
 
-You can find and chat with then over Discord, click [here](http://chat.verdaccio.org) or follow them at _Twitter_.
+[See the full list of contributors is at the website.](https://verdaccio.org/contributors)
 
 ## Who is using Verdaccio?
 
-- [create-react-app](https://github.com/facebook/create-react-app/blob/master/CONTRIBUTING.md#customizing-e2e-registry-configuration) _(+86.2k ⭐️)_
-- [Gatsby](https://github.com/gatsbyjs/gatsby) _(+49.2k ⭐️)_
-- [Babel.js](https://github.com/babel/babel) _(+38.5k ⭐️)_
-- [Vue CLI](https://github.com/vuejs/vue-cli) _(+27.4k ⭐️)_
-- [Angular CLI](https://github.com/angular/angular-cli) _(+24.3k ⭐️)_
-- [Uppy](https://github.com/transloadit/uppy) _(+23.8k ⭐️)_
-- [bit](https://github.com/teambit/bit) _(+13k ⭐️)_
+- [create-react-app](https://github.com/facebook/create-react-app/blob/master/CONTRIBUTING.md#customizing-e2e-registry-configuration) _(+96.2k ⭐️)_
+- [Gatsby](https://github.com/gatsbyjs/gatsby) _(+53.5k ⭐️)_
+- [Babel.js](https://github.com/babel/babel) _(+41.3k ⭐️)_
+- [Docusaurus](https://github.com/facebook/docusaurus) _(+37k ⭐️)_
+- [Vue CLI](https://github.com/vuejs/vue-cli) _(+29.4k ⭐️)_
+- [Angular CLI](https://github.com/angular/angular-cli) _(+25.6k ⭐️)_
+- [Uppy](https://github.com/transloadit/uppy) _(+25.8k ⭐️)_
+- [pnpm](https://github.com/pnpm/pnpm) _(+19.2k ⭐️)_
+- [bit](https://github.com/teambit/bit) _(+15k ⭐️)_
+- [NX](https://github.com/nrwl/nx) _(+14.1k ⭐️)_
 - [Aurelia Framework](https://github.com/aurelia/framework) _(+11.6k ⭐️)_
-- [pnpm](https://github.com/pnpm/pnpm) _(+10.1k ⭐️)_
 - [ethereum/web3.js](https://github.com/ethereum/web3.js) _(+9.8k ⭐️)_
-- [NX](https://github.com/nrwl/nx) _(+6.1k ⭐️)_
-- [webiny-js](https://github.com/webiny/webiny-js) _(+4.3k ⭐️)_
-- [Mozilla Neutrino](https://github.com/neutrinojs/neutrino) _(+3.7k ⭐️)_
+- [webiny-js](https://github.com/webiny/webiny-js) _(+5.9k ⭐️)_
 - [workshopper how to npm](https://github.com/workshopper/how-to-npm) _(+1k ⭐️)_
 - [Amazon SDK v3](https://github.com/aws/aws-sdk-js-v3)
 - [Amazon Encryption SDK for Javascript](https://github.com/aws/aws-encryption-sdk-javascript)
 
-🤓 Don't be shy, you also can be in [the list](https://github.com/verdaccio/website/blob/master/docs/who-is-using.md).
+🤓 Don't be shy, add yourself to this readme.
 
 ## Open Collective Sponsors
 
@@ -247,8 +294,6 @@ Thanks to the following companies to help us to achieve our goals providing free
 [![jetbrain](assets/thanks/jetbrains/logo.png)](https://www.jetbrains.com/)
 [![crowdin](assets/thanks/crowdin/logo.png)](https://crowdin.com/)
 [![browserstack](https://cdn.verdaccio.dev/readme/browserstack_logo.png)](https://www.browserstack.com/)
-[![netlify](https://www.netlify.com/img/global/badges/netlify-color-accent.svg)](https://www.netlify.com/)
-[![algolia](https://cdn.verdaccio.dev/sponsor/logo/algolia/logo.png)](https://algolia.com/)
 
 Verdaccio also is part of to the [Docker Open Source Program](https://www.docker.com/blog/expanded-support-for-open-source-software-projects/).
 
@@ -266,7 +311,7 @@ If you have any issue you can try the following options, do no desist to ask or
 - [Donations](https://github.com/sponsors/verdaccio)
 - [Reporting an issue](https://github.com/verdaccio/verdaccio/issues/new/choose)
 - [Running discussions](https://github.com/verdaccio/verdaccio/issues?q=is%3Aissue+is%3Aopen+label%3Adiscuss)
-- [Chat](http://chat.verdaccio.org/)
+- [Chat](https://discord.gg/7qWJxBf)
 - [Logos](https://verdaccio.org/docs/en/logo)
 - [Docker Examples](https://github.com/verdaccio/verdaccio/tree/master/docker-examples)
 - [FAQ](https://github.com/verdaccio/verdaccio/discussions/categories/q-a)

SECURITY.md

@@ -4,13 +4,13 @@
 
 The following table describes the versions of this project that are currently supported with security updates:
 
-| Version   | Supported          |
-| --------- | ------------------ |
-| 2.x       | :x:                |
-| 3.x       | :x:                |
-| 4.x       | :x:                |
-| 5.x       | :white_check_mark: |
-| 6.x alpha | :x:                |
+| Version | Supported                              |
+| ------- | -------------------------------------- |
+| 2.x     | :x:                                    |
+| 3.x     | :x:                                    |
+| 4.x     | :x:                                    |
+| 5.x     | :white_check_mark: (until end of 2024) |
+| 6.x     | :white_check_mark:                     |
 
 ## Responsible disclosure security policy
 
@@ -32,7 +32,7 @@ If you discover a security vulnerability, please use one of the following means
 
 Note that time-frame and processes are subject to each program’s own policy.
 
-- Report the security issue to the project maintainers directly at verdaccio@pm.me. If the report contains highly sensitive information, please be advised to encrypt your findings using our [PGP key](https://cdn.verdaccio.dev/gpg/publickey.verdaccio@pm.me.asc) which is also available in this document.
+- Report the security issue to the project maintainers directly at verdaccio@pm.me. If the report contains highly sensitive information, please be advised to encrypt your findings using our [PGP key](https://verdaccio.nyc3.digitaloceanspaces.com/gpg/publickey.verdaccio@pm.me.asc) which is also available in this document.
 
 Your efforts to responsibly disclose your findings are sincerely appreciated and will be taken into account to acknowledge your contributions.