chore: update versions (next-8) (#5178)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.changeset/early-trainers-grin.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/api': patch
+---
+
+chore(api): avoid double registration of JSON bodyParser

.changeset/few-ears-deny.md

@@ -0,0 +1,13 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/middleware': patch
+'@verdaccio/core': patch
+'@verdaccio/config': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+'@verdaccio/api': patch
+'@verdaccio/web': patch
+---
+
+chore: cleanup utils

.changeset/fresh-owls-hunt.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/config': patch
+---
+
+chore: expose config utils

.changeset/hip-suns-jam.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/e2e-cli-npm10': patch
+---
+
+fix(e2e): name for npm10 test

.changeset/large-turkeys-change.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/auth': patch
+---
+
+feat: add legacyMergeConfigs as option

.changeset/nasty-experts-bow.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/server': patch
+'@verdaccio/types': patch
+'@verdaccio/middleware': patch
+'@verdaccio/ui-components': patch
+---
+
+chore(config): harmonize configuration options

.changeset/odd-fishes-cry.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+fix(middleware): scoped package for allow checks

.changeset/pre.json

@@ -60,7 +60,8 @@
     "@verdaccio/e2e-cli-pnpm-common": "1.0.2-next-8.0",
     "@verdaccio/e2e-cli-pnpm10": "1.0.0",
     "docusaurus-plugin-downloads": "2.0.0",
-    "@verdaccio/local-publish": "0.0.2"
+    "@verdaccio/local-publish": "0.0.2",
+    "@verdaccio/e2e-cli-npm10": "1.0.1"
   },
   "changesets": [
     "angry-doors-tan",
@@ -79,11 +80,14 @@
     "curvy-rockets-camp",
     "cyan-snakes-kiss",
     "early-eyes-float",
+    "early-trainers-grin",
     "eight-countries-think",
     "eighty-apes-think",
     "eleven-rocks-dream",
+    "few-ears-deny",
     "fifty-falcons-design",
     "forty-hounds-matter",
+    "fresh-owls-hunt",
     "funny-fireants-tan",
     "gentle-stingrays-repeat",
     "gold-files-speak",
@@ -92,15 +96,19 @@
     "healthy-ducks-drive",
     "healthy-zoos-lie",
     "hip-eggs-serve",
+    "hip-suns-jam",
     "hot-crews-live",
     "itchy-glasses-end",
+    "large-turkeys-change",
     "long-eyes-drum",
     "long-singers-drive",
     "lucky-crabs-enjoy",
+    "nasty-experts-bow",
     "nice-garlics-tie",
     "nine-countries-remember",
     "ninety-geese-do",
     "ninety-hotels-dance",
+    "odd-fishes-cry",
     "old-clocks-destroy",
     "pink-jeans-lick",
     "popular-trees-grin",
@@ -127,6 +135,7 @@
     "stupid-camels-build",
     "sweet-crabs-deliver",
     "ten-jeans-approve",
+    "tender-buckets-smoke",
     "thirty-comics-trade",
     "tricky-impalas-shake",
     "tricky-knives-end",
@@ -135,6 +144,7 @@
     "violet-bobcats-allow",
     "violet-boxes-float",
     "weak-cherries-serve",
-    "wet-cats-behave"
+    "wet-cats-behave",
+    "yellow-flies-sniff"
   ]
 }

.changeset/tender-buckets-smoke.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore: fix ui-component npmignore and readme

.changeset/yellow-flies-sniff.md

@@ -0,0 +1,10 @@
+---
+'@verdaccio/search-indexer': patch
+'@verdaccio/server': patch
+'@verdaccio/loaders': patch
+'@verdaccio/store': patch
+'@verdaccio/auth': patch
+'@verdaccio/web': patch
+---
+
+fix: add legacyMergeConfigs legacy plugins

docker-examples/v6/README.md

@@ -1,6 +1,6 @@
 # Verdaccio 6 Examples
 
-> We recommend to have installed [docker-compose >= 1.29.0](https://github.com/docker/compose/releases/tag/1.29.2)
+> We recommend to have installed the latest docker-compose
 
 ## Mapping Volumes
 
@@ -20,3 +20,5 @@ Using plugins without `docker-compose` mapping volumes, all withing the `Dockerf
 
 - [Docker + Local Build Auth Plugin (local development)](plugins/docker-build-install-plugin/README.md)
 - [Docker + Auth Plugin (from a registry)](plugins/docker-local-plugin/README.md)
+- [Docker + Localstack S3 + Verdaccio](amazon-s3-docker-example/README.md)
+- [Docker + GitHub OAuth + verdaccio-github-oauth-ui + Verdaccio](verdaccio-github-oauth-ui/README.md)

docker-examples/v6/amazon-s3-docker-example/README.md

@@ -0,0 +1,17 @@
+# Amazon S3 Bucket (Localstack) and Verdaccio 6.x
+
+This setup runs Verdaccio alongside Localstack, providing a simple test/mocking environment for
+developing cloud applications. In this case, we are simulating AWS S3 functionality.
+
+## Usage
+
+> You might need to create bucket manually here
+> aws --endpoint-url=http://localhost:4566 s3 mb s3://localstack.s3.plugin.test
+
+```
+docker-compose up --force-recreate --build --always-recreate-deps
+```
+
+## Articles
+
+- [Set up S3 bucket using Docker / Compose](https://discuss.localstack.cloud/t/set-up-s3-bucket-using-docker-compose/646.html)

docker-examples/v6/amazon-s3-docker-example/docker-compose.yaml

@@ -0,0 +1,29 @@
+version: '3.8'
+
+services:
+  localstack-s3:
+    container_name: '${LOCALSTACK_DOCKER_NAME-localstack-main}'
+    image: localstack/localstack:s3-latest
+    ports:
+      - '127.0.0.1:4566:4566'
+    volumes:
+      - './init-s3.py:/etc/localstack/init/ready.d/init-s3.py'
+  verdaccio:
+    container_name: verdaccio-s3-plugin
+    build: s3Plugin/
+    environment:
+      - DEBUG=verdaccio:*
+      - AWS_ACCESS_KEY_ID=foobar
+      - AWS_SECRET_ACCESS_KEY=foobar
+      - AWS_DEFAULT_REGION=eu-west-2
+      - AWS_S3_ENDPOINT=http://localstack-s3:4566
+      - AWS_S3_PATH_STYLE=true
+    ports:
+      - '4874:4873'
+    depends_on:
+      - localstack-s3
+    networks:
+      - default
+networks:
+  default:
+    name: verdaccio-network

docker-examples/v6/amazon-s3-docker-example/init-s3.py

@@ -0,0 +1,10 @@
+import boto3
+
+s3_client = boto3.client(
+    "s3",
+    endpoint_url=f"http://localhost:4566",
+    aws_access_key_id="test",
+    aws_secret_access_key="test"
+)
+
+s3_client.create_bucket(Bucket="localstack.s3.plugin.test")

docker-examples/v6/amazon-s3-docker-example/s3Plugin/Dockerfile

@@ -0,0 +1,9 @@
+FROM verdaccio/verdaccio:6.x-next
+LABEL Juan Picado <jotadeveloper@gmail.com>
+# Copy the configuration file into the container
+ADD config.yaml /verdaccio/conf/config.yaml
+USER root
+# This is the best way to install a plugin in Verdaccio
+RUN npm install --global verdaccio-aws-s3-storage
+USER $VERDACCIO_USER_UID
+

docker-examples/v6/amazon-s3-docker-example/s3Plugin/config.yaml

@@ -0,0 +1,27 @@
+storage: /verdaccio/storage
+
+store:
+  aws-s3-storage:
+    bucket: localstack.s3.plugin.test
+    keyPrefix: docker-test-prefix
+    region: eu-west-2
+    endpoint: http://localstack-s3:4566
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+
+packages:
+  '@*/*':
+    access: $all
+    publish: $all
+    proxy: npmjs
+  '**':
+    access: $all
+    publish: $all
+    proxy: npmjs
+
+log: { type: stdout, format: pretty, level: trace }
+
+listen:
+  - 0.0.0.0:4873

docker-examples/v6/verdaccio-github-oauth-ui/README.md

@@ -0,0 +1,18 @@
+# GitHub OAuth Login with verdaccio-github-oauth-ui plugin and Verdaccio 6.x
+
+This setup runs Verdaccio alongside Localstack, providing a simple test/mocking environment for
+developing cloud applications. In this case, we are simulating AWS S3 functionality.
+
+https://github.com/n4bb12/verdaccio-github-oauth-ui
+
+## Configuration
+
+Open `config.yaml` and modify the required properties follow the official documentation.
+
+https://github.com/n4bb12/verdaccio-github-oauth-ui/blob/main/docs/configuration.md
+
+## Usage
+
+```bash
+docker-compose up --force-recreate --build --always-recreate-deps
+```

docker-examples/v6/verdaccio-github-oauth-ui/docker-compose.yaml

@@ -0,0 +1,15 @@
+version: '3.8'
+
+services:
+  verdaccio:
+    container_name: verdaccio-oauth-plugin
+    build: plugin/
+    environment:
+      - DEBUG=verdaccio:*
+    ports:
+      - '4874:4873'
+    networks:
+      - default
+networks:
+  default:
+    name: verdaccio-network

docker-examples/v6/verdaccio-github-oauth-ui/plugin/Dockerfile

@@ -0,0 +1,9 @@
+FROM verdaccio/verdaccio:6.x-next
+LABEL Juan Picado <jotadeveloper@gmail.com>
+# Copy the configuration file into the container
+ADD config.yaml /verdaccio/conf/config.yaml
+USER root
+# This is the best way to install a plugin in Verdaccio
+RUN npm install --global verdaccio-github-oauth-ui
+USER $VERDACCIO_USER_UID
+

docker-examples/v6/verdaccio-github-oauth-ui/plugin/config.yaml

@@ -0,0 +1,34 @@
+storage: /verdaccio/storage
+
+middlewares:
+  github-oauth-ui:
+    enabled: true
+
+auth:
+  # READ HERE https://github.com/n4bb12/verdaccio-github-oauth-ui/blob/main/docs/configuration.md
+  github-oauth-ui:
+    client-id: take_this_from_github
+    client-secret: take_this_from_github
+    token: my_github_token
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+
+packages:
+  '@*/*':
+    access: $all
+    publish: $all
+    proxy: npmjs
+  jquery:
+    # Limit access to users:
+    access: github/user/GITHUB_USER
+  '**':
+    access: $all
+    publish: $all
+    proxy: npmjs
+
+log: { type: stdout, format: pretty, level: trace }
+
+listen:
+  - 0.0.0.0:4873

e2e/cli/cli-commons/package.json

@@ -4,16 +4,16 @@
   "version": "2.0.0-next-8.0",
   "main": "src/index.ts",
   "devDependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "debug": "4.4.0",
     "fs-extra": "11.2.0",
     "get-port": "5.1.1",
     "got": "11.8.6",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "verdaccio": "workspace:8.0.0-next-8.13"
+    "verdaccio": "workspace:8.0.0-next-8.15"
   },
   "scripts": {
     "test": "echo no test",

e2e/cli/e2e-npm10/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/e2e-cli-npm9
 
+## 1.0.2-next-8.0
+
+### Patch Changes
+
+- d4fc827: fix(e2e): name for npm10 test
+  - @verdaccio/test-cli-commons@2.0.0-next-8.0
+
 ## 1.0.1
 
 ### Patch Changes

e2e/cli/e2e-npm10/package.json

@@ -1,7 +1,7 @@
 {
   "private": true,
-  "name": "@verdaccio/e2e-cli-npm9",
-  "version": "1.0.1",
+  "name": "@verdaccio/e2e-cli-npm10",
+  "version": "1.0.2-next-8.0",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:2.0.0-next-8.0",
     "@verdaccio/e2e-cli-npm-common": "workspace:*",

e2e/ui/package.json

@@ -3,9 +3,9 @@
   "name": "@verdaccio/e2e-ui",
   "version": "2.0.0",
   "devDependencies": {
-    "verdaccio": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
+    "verdaccio": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
     "@verdaccio/test-helper": "workspace:4.0.0-next-8.4",
     "debug": "4.4.0",
     "cypress": "^13.6.0",

packages/api/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @verdaccio/api
 
+## 8.1.0-next-8.15
+
+### Patch Changes
+
+- Updated dependencies [1f25d5f]
+  - @verdaccio/auth@8.0.0-next-8.15
+  - @verdaccio/core@8.0.0-next-8.15
+  - @verdaccio/config@8.0.0-next-8.15
+  - @verdaccio/middleware@8.0.0-next-8.15
+  - @verdaccio/store@8.0.0-next-8.15
+  - @verdaccio/utils@8.1.0-next-8.15
+  - @verdaccio/logger@8.0.0-next-8.15
+
+## 8.1.0-next-8.14
+
+### Patch Changes
+
+- 1e2f503: chore(api): avoid double registration of JSON bodyParser
+- b9fea38: chore: cleanup utils
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+- Updated dependencies [2bcd3ca]
+- Updated dependencies [da1650c]
+- Updated dependencies [8f28186]
+  - @verdaccio/middleware@8.0.0-next-8.14
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/store@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/auth@8.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.1.0-next-8.13
 
 ### Patch Changes

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "8.1.0-next-8.13",
+  "version": "8.1.0-next-8.15",
   "description": "Verdaccio Registry API",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -42,13 +42,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "workspace:8.0.0-next-8.13",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/middleware": "workspace:8.0.0-next-8.13",
-    "@verdaccio/store": "workspace:8.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/auth": "workspace:8.0.0-next-8.15",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/middleware": "workspace:8.0.0-next-8.15",
+    "@verdaccio/store": "workspace:8.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "abortcontroller-polyfill": "1.7.8",
     "body-parser": "1.20.3",
     "cookies": "0.9.1",
@@ -60,7 +60,7 @@
   },
   "devDependencies": {
     "@verdaccio/test-helper": "workspace:4.0.0-next-8.4",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "mockdate": "3.0.5",
     "supertest": "7.0.0"
   },

packages/api/src/index.ts

@@ -1,3 +1,4 @@
+import buildDebug from 'debug';
 import express, { Router } from 'express';
 
 import { Auth } from '@verdaccio/auth';
@@ -24,6 +25,8 @@ import v1Search from './v1/search';
 import token from './v1/token';
 import whoami from './whoami';
 
+const debug = buildDebug('verdaccio:api');
+
 export default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {
   /* eslint new-cap:off */
   const app = express.Router();
@@ -44,7 +47,14 @@ export default function (config: Config, auth: Auth, storage: Storage, logger: L
   app.param('org_couchdb_user', match(/^org\.couchdb\.user:/));
 
   app.use(auth.apiJWTmiddleware());
-  app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));
+
+  // middleware might have registered a json parser already
+  if (hasBodyParser(app)) {
+    debug('json parser already registered');
+  } else {
+    app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));
+  }
+
   app.use(antiLoop(config));
   app.use(makeURLrelative);
   // encode / in a scoped package name to be matched as a single parameter in routes
@@ -63,3 +73,10 @@ export default function (config: Config, auth: Auth, storage: Storage, logger: L
   pkg(app, auth, storage, logger);
   return app;
 }
+
+function hasBodyParser(app: Router): boolean {
+  const stack = app.stack || [];
+  return stack.some((middleware) => {
+    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';
+  });
+}

packages/api/src/user.ts

@@ -10,7 +10,7 @@ import {
   HEADERS,
   HTTP_STATUS,
   errorUtils,
-  validatioUtils,
+  validationUtils,
 } from '@verdaccio/core';
 import { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';
 import { Logger } from '@verdaccio/types';
@@ -77,7 +77,7 @@ export default function (route: Router, auth: Auth, config: Config, logger: Logg
       debug('login or adduser');
       const remoteName = req?.remote_user?.name;
 
-      if (!validatioUtils.validateUserName(req.params.org_couchdb_user, name)) {
+      if (!validationUtils.validateUserName(req.params.org_couchdb_user, name)) {
         return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));
       }
 
@@ -119,7 +119,7 @@ export default function (route: Router, auth: Auth, config: Config, logger: Logg
       } else {
         debug('adduser: %o', name);
         if (
-          validatioUtils.validatePassword(
+          validationUtils.validatePassword(
             password,
             config?.serverSettings?.passwordValidationRegex
           ) === false

packages/api/src/v1/profile.ts

@@ -8,7 +8,7 @@ import {
   HTTP_STATUS,
   SUPPORT_ERRORS,
   errorUtils,
-  validatioUtils,
+  validationUtils,
 } from '@verdaccio/core';
 import { PROFILE_API_ENDPOINTS } from '@verdaccio/middleware';
 import { rateLimit } from '@verdaccio/middleware';
@@ -72,7 +72,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
 
       if (_.isNil(password) === false) {
         if (
-          validatioUtils.validatePassword(
+          validationUtils.validatePassword(
             password.new,
             config?.serverSettings?.passwordValidationRegex
           ) === false

packages/auth/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @verdaccio/auth
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- 1f25d5f: feat: add legacyMergeConfigs as option
+  - @verdaccio/core@8.0.0-next-8.15
+  - @verdaccio/config@8.0.0-next-8.15
+  - @verdaccio/loaders@8.0.0-next-8.6
+  - verdaccio-htpasswd@13.0.0-next-8.15
+  - @verdaccio/utils@8.1.0-next-8.15
+  - @verdaccio/signature@8.0.0-next-8.7
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- 8f28186: fix: add legacyMergeConfigs legacy plugins
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+- Updated dependencies [8f28186]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/loaders@8.0.0-next-8.6
+  - verdaccio-htpasswd@13.0.0-next-8.14
+  - @verdaccio/signature@8.0.0-next-8.6
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Authentication",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -42,19 +42,19 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/loaders": "workspace:8.0.0-next-8.5",
-    "@verdaccio/signature": "workspace:8.0.0-next-8.5",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/loaders": "workspace:8.0.0-next-8.6",
+    "@verdaccio/signature": "workspace:8.0.0-next-8.7",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "debug": "4.4.0",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "workspace:13.0.0-next-8.13"
+    "verdaccio-htpasswd": "workspace:13.0.0-next-8.15"
   },
   "devDependencies": {
-    "@verdaccio/middleware": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
+    "@verdaccio/middleware": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
     "express": "4.21.2",
     "supertest": "7.0.0"
   },

packages/auth/src/auth.ts

@@ -59,12 +59,14 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   public secret: string;
   public logger: Logger;
   public plugins: pluginUtils.Auth<Config>[];
+  public options: { legacyMergeConfigs: boolean };
 
-  public constructor(config: Config, logger: Logger) {
+  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {
     this.config = config;
     this.secret = config.secret;
     this.logger = logger;
     this.plugins = [];
+    this.options = options;
     if (!this.secret) {
       throw new TypeError('secret it is required value on initialize the auth class');
     }
@@ -123,6 +125,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
           typeof allow_publish !== 'undefined'
         );
       },
+      this.options.legacyMergeConfigs,
       this.config?.serverSettings?.pluginPrefix,
       PLUGIN_CATEGORY.AUTHENTICATION
     );

packages/cli/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @verdaccio/cli
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/node-api@8.0.0-next-8.15
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/config@8.0.0-next-8.15
+- @verdaccio/logger@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/node-api@8.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/cli",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "author": {
     "name": "Juan Picado",
     "email": "juanpicado19@gmail.com"
@@ -47,10 +47,10 @@
     "start": "ts-node src/index.ts"
   },
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/node-api": "workspace:8.0.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/node-api": "workspace:8.0.0-next-8.15",
     "clipanion": "4.0.0-rc.4",
     "envinfo": "7.14.0",
     "kleur": "4.1.5",

packages/config/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @verdaccio/config
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/utils@8.1.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- b9fea38: chore: cleanup utils
+- bb478f2: chore: expose config utils
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Configuration",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -42,8 +42,8 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "debug": "4.4.0",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",

packages/config/src/conf/default.yaml

@@ -4,34 +4,38 @@
 # improve security.
 #
 # Look here for more config file examples:
-# https://github.com/verdaccio/verdaccio/tree/5.x/packages/config/src/conf/default.yaml
+# https://github.com/verdaccio/verdaccio/blob/master/docker-examples/README.md
 #
 # Read about the best practices
 # https://verdaccio.org/docs/best
 
-# path to a directory with all packages
+# Path to a directory with all packages
 storage: ./storage
-# path to a directory with plugins to include, the plugins folder has the higher priority for loading plugins
-# disable this folder to avoid warnings if is not used
+
+# Path to a directory with plugins to include, the plugins folder has the higher priority for loading plugins
+# Disable this folder to avoid warnings if is not used
 # plugins: ./plugins
 
+# Web UI settings
 # https://verdaccio.org/docs/webui
 web:
   title: Verdaccio
-  # custom colors for header background and font
+  # Disable complete web UI
+  # enabled: false
+  # Custom colors for header background and font
   # primaryColor: "#4b5e40"
-  # custom logos and favicon
+  # Custom logos and favicon
   # logo: ./path/to/logo.png
   # logoDark: ./path/to/logoDark.png
   # favicon: ./path/to/favicon.ico
-  # comment out to disable gravatar support
+  # Disable gravatar support
   # gravatar: false
-  # by default packages are ordercer ascendant (asc|desc)
-  # sort_packages: asc
-  # convert your UI to the dark side
+  # By default, packages are ordered ascending
+  # sort_packages: asc | desc
+  # Convert your UI to the dark side
   # darkMode: true
   # html_cache: true
-  # by default all features are displayed
+  # By default, all features are displayed
   # login: true
   # showInfo: true
   # showSettings: true
@@ -42,20 +46,25 @@ web:
   # showRaw: true
   # showDownloadTarball: true
   # showUplinks: true
-  #  HTML tags injected after manifest <scripts/>
+  #
+  # HTML tags injected before ends </head>
+  # metaScripts:
+  #   - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
+  #   - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
+  #   - '<meta name="robots" content="noindex">'
+  #
+  # HTML tags injected as first child in <body>
+  # scriptsBodyBefore:
+  #   - '<div id="myId">html before webpack scripts</div>'
+  #
+  # HTML tags injected as last child in </body>
   # scriptsBodyAfter:
-  #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
-  #  HTML tags injected before ends </head>
-  #  metaScripts:
-  #    - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
-  #    - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
-  #    - '<meta name="robots" content="noindex" />'
-  #  HTML tags injected first child at <body/>
-  #  bodyBefore:
-  #    - '<div id="myId">html before webpack scripts</div>'
-  #  Public path for template manifest scripts (only manifest)
-  #  publicPath: http://somedomain.org/
+  #   - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
+  #
+  # Public path for template manifest scripts (only manifest)
+  # publicPath: http://somedomain.org/
 
+# Settings for authentication plugin
 # https://verdaccio.org/docs/configuration#authentication
 auth:
   htpasswd:
@@ -64,8 +73,8 @@ auth:
     # You can set this to -1 to disable registration.
     # max_users: 1000
 
+# A list of other known repositories we can talk to
 # https://verdaccio.org/docs/configuration#uplinks
-# a list of other known repositories we can talk to
 uplinks:
   npmjs:
     url: https://registry.npmjs.org/
@@ -97,7 +106,7 @@ packages:
     # if package is not available locally, proxy requests to 'npmjs' registry
     proxy: npmjs
 
-# To improve your security configuration and  avoid dependency confusion
+# To improve your security configuration and avoid dependency confusion
 # consider removing the proxy property for private packages
 # https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
 
@@ -107,14 +116,14 @@ packages:
 # WORKAROUND: Through given configuration you can workaround following issue https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
 server:
   keepAliveTimeout: 60
-  # The pluginPrefix replaces the default plugins prefix which is `verdaccio`, please don't include `-`. If `something` is provided
-  # the resolve package will be `something-xxxx`.
+  # The pluginPrefix replaces the default plugins prefix which is `verdaccio`. Please don't include `-`. If `something` is provided
+  # the resolved package will be `something-xxxx`.
   # pluginPrefix: something
   # A regex for the password validation /.{3}$/ (3 characters min)
   # An example to limit to 10 characters minimum
   # passwordValidationRegex: /.{10}$/
   # Allow `req.ip` to resolve properly when Verdaccio is behind a proxy or load-balancer
-  # See: https://expressjs.com/en/guide/behind-proxies.html
+  # https://expressjs.com/en/guide/behind-proxies.html
   # trustProxy: '127.0.0.1'
 
 # https://verdaccio.org/docs/configuration#offline-publish
@@ -123,18 +132,24 @@ server:
 #   check_owners: false
 #   keep_readmes: 'latest' | 'tagged' | 'all'
 
+# Define public URL of registry in combination with VERDACCIO_PUBLIC_URL environment variable
 # https://verdaccio.org/docs/configuration#url-prefix
 # url_prefix: /verdaccio/
-# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+#
+# Examples:
+# VERDACCIO_PUBLIC_URL='https://somedomain.org'
 # url_prefix: '/my_prefix'
 # // url -> https://somedomain.org/my_prefix/
-# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+#
+# VERDACCIO_PUBLIC_URL='https://somedomain.org'
 # url_prefix: '/'
 # // url -> https://somedomain.org/
-# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix';
+#
+# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix'
 # url_prefix: '/second_prefix'
-# // url -> https://somedomain.org/second_prefix/'
+# // url -> https://somedomain.org/second_prefix/
 
+# Security settings
 # https://verdaccio.org/docs/configuration#security
 # security:
 #   api:
@@ -160,12 +175,12 @@ server:
 
 # https://verdaccio.org/docs/configuration#listen-port
 # listen:
-# - localhost:4873            # default value
-# - http://localhost:4873     # same thing
-# - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
-# - https://example.org:4873  # if you want to use https
-# - "[::1]:4873"                # ipv6
-# - unix:/tmp/verdaccio.sock    # unix socket
+#   - localhost:4873            # default value
+#   - http://localhost:4873     # same thing
+#   - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
+#   - https://example.org:4873  # if you want to use https
+#   - "[::1]:4873"              # ipv6
+#   - unix:/tmp/verdaccio.sock  # unix socket
 
 # The HTTPS configuration is useful if you do not consider use a HTTP Proxy
 # https://verdaccio.org/docs/configuration#https
@@ -177,36 +192,46 @@ server:
 # https://verdaccio.org/docs/configuration#proxy
 # http_proxy: http://something.local/
 # https_proxy: https://something.local/
+# no_proxy: localhost,127.0.0.1,server.local
 
 # https://verdaccio.org/docs/configuration#notifications
 # notify:
-#   method: POST
-#   headers: [{ "Content-Type": "application/json" }]
-#   endpoint: https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken
+#   method: 'POST'
+#   headers: '[{ "Content-Type": "application/json" }]'
+#   endpoint: 'https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken'
 #   content: '{"color":"green","message":"New package published: * {{ name }}*","notify":true,"message_format":"text"}'
 
+# Settings for middleware plugins
+# https://verdaccio.org/docs/plugins#middleware-configuration
 middlewares:
   audit:
     enabled: true
     # timeout: 10000
 
+# Log settings
 # https://verdaccio.org/docs/logger
-# log settings
 log: { type: stdout, format: pretty, level: http }
-#experiments:
-#  # support for npm token command
+
+# Feature flags (experimental settings that can be changed or removed in the future)
+# https://verdaccio.org/docs/configuration#experiments
+# experiments:
+#  # Support for npm token command
 #  token: false
-#  # disable writing body size to logs, read more on ticket 1912
-#  bytesin_off: false
-#  # enable tarball URL redirect for hosting tarball with a different server, the tarball_url_redirect can be a template string
+#  # Enable tarball URL redirect for hosting tarball with a different server.
+#  # The tarball_url_redirect can be a template string
 #  tarball_url_redirect: 'https://mycdn.com/verdaccio/${packageName}/${filename}'
-#  # the tarball_url_redirect can be a function, takes packageName and filename and returns the url, when working with a js configuration file
+#  # The tarball_url_redirect can be a function, takes packageName and filename and returns the url,
+#  # when working with a js configuration file
 #  tarball_url_redirect(packageName, filename) {
 #    const signedUrl = // generate a signed url
 #    return signedUrl;
 #  }
+# Renamed from "experiments" to "flags" in next major release
+# flags:
+#  changePassword: true
+#  searchRemote: true
 
-# translate your registry, api i18n not available yet
+# Translate your registry, API and web UI
+# List of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
 i18n:
-  # list of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
   web: en-US

packages/config/src/conf/docker.yaml

@@ -1,75 +1,80 @@
 #
-# This is the default configuration file. As it allows all users to do anything,
-# please read carefully the documentation and best practices to improve security.
-#
-# Do not configure host and port under `listen` in this file
-# as it will be ignored when using docker.
-# see https://verdaccio.org/docs/en/docker#docker-and-custom-port-configuration
+# This is the default configuration file. It allows all users to do anything,
+# please read carefully the documentation and best practices to
+# improve security.
 #
 # Look here for more config file examples:
-# https://github.com/verdaccio/verdaccio/tree/5.x/packages/config/src/conf/docker.yaml
+# https://github.com/verdaccio/verdaccio/blob/master/docker-examples/README.md
 #
 # Read about the best practices
 # https://verdaccio.org/docs/best
 
-# path to a directory with all packages
+# Path to a directory with all packages
 storage: /verdaccio/storage/data
-# path to a directory with plugins to include, the plugins folder has the higher priority for loading plugins
-# disable this folder to avoid warnings if is not used
+
+# Path to a directory with plugins to include, the plugins folder has the higher priority for loading plugins
+# Disable this folder to avoid warnings if is not used
 plugins: /verdaccio/plugins
 
+# Web UI settings
 # https://verdaccio.org/docs/webui
 web:
   title: Verdaccio
-  # custom colors for header background and font
+  # Disable complete web UI
+  # enabled: false
+  # Custom colors for header background and font
   # primaryColor: "#4b5e40"
-  # custom logos and favicon
+  # Custom logos and favicon
   # logo: ./path/to/logo.png
   # logoDark: ./path/to/logoDark.png
   # favicon: ./path/to/favicon.ico
-  # Comment out to disable gravatar support
+  # Disable gravatar support
   # gravatar: false
-  # By default packages are ordered ascendant (asc|desc)
-  # sort_packages: asc
+  # By default, packages are ordered ascending
+  # sort_packages: asc | desc
   # Convert your UI to the dark side
   # darkMode: true
   # html_cache: true
-  # By default all features are displayed
+  # By default, all features are displayed
   # login: true
   # showInfo: true
   # showSettings: true
-  # In combination with darkMode you can force a specific theme
+  # In combination with darkMode you can force specific theme
   # showThemeSwitch: true
   # showFooter: true
   # showSearch: true
   # showRaw: true
   # showDownloadTarball: true
   # showUplinks: true
-  #  HTML tags injected after manifest <scripts/>
+  #
+  # HTML tags injected before ends </head>
+  # metaScripts:
+  #   - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
+  #   - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
+  #   - '<meta name="robots" content="noindex">'
+  #
+  # HTML tags injected as first child in <body>
+  # scriptsBodyBefore:
+  #   - '<div id="myId">html before webpack scripts</div>'
+  #
+  # HTML tags injected as last child in </body>
   # scriptsBodyAfter:
-  #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
-  #  HTML tags injected before end </head>
-  #  metaScripts:
-  #    - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
-  #    - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
-  #    - '<meta name="robots" content="noindex" />'
-  #  HTML tags injected as first child at <body/>
-  #  bodyBefore:
-  #    - '<div id="myId">html before webpack scripts</div>'
-  #  Public path for template manifest scripts (only manifest)
-  #  publicPath: http://somedomain.org/
+  #   - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
+  #
+  # Public path for template manifest scripts (only manifest)
+  # publicPath: http://somedomain.org/
 
+# Settings for authentication plugin
 # https://verdaccio.org/docs/configuration#authentication
-
 auth:
   htpasswd:
     file: /verdaccio/storage/htpasswd
-    # Maximum amount of users allowed to register, defaults to "+infinity".
+    # Maximum amount of users allowed to register, defaults to "+inf".
     # You can set this to -1 to disable registration.
     # max_users: 1000
 
-# https://verdaccio.org/docs/configuration#uplinks
 # A list of other known repositories we can talk to
+# https://verdaccio.org/docs/configuration#uplinks
 uplinks:
   npmjs:
     url: https://registry.npmjs.org/
@@ -86,14 +91,14 @@ packages:
     proxy: npmjs
 
   '**':
-    # Allow all users (including non-authenticated users) to read and
+    # allow all users (including non-authenticated users) to read and
     # publish all packages
     #
-    # You can specify usernames/groupnames (depending on your auth plugin)
+    # you can specify usernames/groupnames (depending on your auth plugin)
     # and three keywords: "$all", "$anonymous", "$authenticated"
     access: $all
 
-    # Allow all known users to publish/unpublish packages
+    # allow all known users to publish/unpublish packages
     # (anyone can register by default, remember?)
     publish: $authenticated
     unpublish: $authenticated
@@ -106,21 +111,19 @@ packages:
 # https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
 
 # https://verdaccio.org/docs/configuration#server
-# You can specify the HTTP/1.1 server keep alive timeout in seconds for incoming connections.
-# A value of 0 makes the http server behave similarly to Node.js versions prior to 8.0.0, which did not have a
-# keep-alive timeout.
-# WORKAROUND: Through given configuration you can work around the following issue:
-# https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
+# You can specify HTTP/1.1 server keep alive timeout in seconds for incoming connections.
+# A value of 0 makes the http server behave similarly to Node.js versions prior to 8.0.0, which did not have a keep-alive timeout.
+# WORKAROUND: Through given configuration you can workaround following issue https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
 server:
   keepAliveTimeout: 60
-  # The pluginPrefix replaces the default plugins prefix which is `verdaccio`, please don't include `-`. If `something` is provided
-  # the resolve package will be `something-xxxx`.
+  # The pluginPrefix replaces the default plugins prefix which is `verdaccio`. Please don't include `-`. If `something` is provided
+  # the resolved package will be `something-xxxx`.
   # pluginPrefix: something
   # A regex for the password validation /.{3}$/ (3 characters min)
   # An example to limit to 10 characters minimum
   # passwordValidationRegex: /.{10}$/
   # Allow `req.ip` to resolve properly when Verdaccio is behind a proxy or load-balancer
-  # See: https://expressjs.com/en/guide/behind-proxies.html
+  # https://expressjs.com/en/guide/behind-proxies.html
   # trustProxy: '127.0.0.1'
 
 # https://verdaccio.org/docs/configuration#offline-publish
@@ -129,18 +132,24 @@ server:
 #   check_owners: false
 #   keep_readmes: 'latest' | 'tagged' | 'all'
 
+# Define public URL of registry in combination with VERDACCIO_PUBLIC_URL environment variable
 # https://verdaccio.org/docs/configuration#url-prefix
 # url_prefix: /verdaccio/
-# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+#
+# Examples:
+# VERDACCIO_PUBLIC_URL='https://somedomain.org'
 # url_prefix: '/my_prefix'
 # // url -> https://somedomain.org/my_prefix/
-# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+#
+# VERDACCIO_PUBLIC_URL='https://somedomain.org'
 # url_prefix: '/'
 # // url -> https://somedomain.org/
-# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix';
+#
+# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix'
 # url_prefix: '/second_prefix'
-# // url -> https://somedomain.org/second_prefix/'
+# // url -> https://somedomain.org/second_prefix/
 
+# Security settings
 # https://verdaccio.org/docs/configuration#security
 # security:
 #   api:
@@ -166,14 +175,14 @@ server:
 
 # https://verdaccio.org/docs/configuration#listen-port
 # listen:
-# - localhost:4873            # default value
-# - http://localhost:4873     # same thing
-# - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
-# - https://example.org:4873  # if you want to use https
-# - "[::1]:4873"                # ipv6
-# - unix:/tmp/verdaccio.sock    # unix socket
+#   - localhost:4873            # default value
+#   - http://localhost:4873     # same thing
+#   - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
+#   - https://example.org:4873  # if you want to use https
+#   - "[::1]:4873"              # ipv6
+#   - unix:/tmp/verdaccio.sock  # unix socket
 
-# The HTTPS configuration is useful if you do not consider using an HTTP Proxy
+# The HTTPS configuration is useful if you do not consider use a HTTP Proxy
 # https://verdaccio.org/docs/configuration#https
 # https:
 #   key: ./path/verdaccio-key.pem
@@ -183,23 +192,29 @@ server:
 # https://verdaccio.org/docs/configuration#proxy
 # http_proxy: http://something.local/
 # https_proxy: https://something.local/
+# no_proxy: localhost,127.0.0.1,server.local
 
 # https://verdaccio.org/docs/configuration#notifications
 # notify:
-#   method: POST
-#   headers: [{ "Content-Type": "application/json" }]
-#   endpoint: https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken
+#   method: 'POST'
+#   headers: '[{ "Content-Type": "application/json" }]'
+#   endpoint: 'https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken'
 #   content: '{"color":"green","message":"New package published: * {{ name }}*","notify":true,"message_format":"text"}'
 
+# Settings for middleware plugins
+# https://verdaccio.org/docs/plugins#middleware-configuration
 middlewares:
   audit:
     enabled: true
     # timeout: 10000
 
+# Log settings
 # https://verdaccio.org/docs/logger
-# log settings
 log: { type: stdout, format: pretty, level: http }
-#experiments:
+
+# Feature flags (experimental settings that can be changed or removed in the future)
+# https://verdaccio.org/docs/configuration#experiments
+# experiments:
 #  # Support for npm token command
 #  token: false
 #  # Enable tarball URL redirect for hosting tarball with a different server.
@@ -211,8 +226,12 @@ log: { type: stdout, format: pretty, level: http }
 #    const signedUrl = // generate a signed url
 #    return signedUrl;
 #  }
+# Renamed from "experiments" to "flags" in next major release
+# flags:
+#  changePassword: true
+#  searchRemote: true
 
-# Translate your registry, api i18n not available yet
-# i18n:
-# list of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
-#   web: en-US
+# Translate your registry, API and web UI
+# List of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
+i18n:
+  web: en-US

packages/config/src/config.ts

@@ -2,7 +2,7 @@ import assert from 'assert';
 import buildDebug from 'debug';
 import _ from 'lodash';
 
-import { APP_ERROR, warningUtils } from '@verdaccio/core';
+import { APP_ERROR, validationUtils, warningUtils } from '@verdaccio/core';
 import { Codes } from '@verdaccio/core/build/warning-utils';
 import {
   Config as AppConfig,
@@ -15,7 +15,7 @@ import {
   Security,
   ServerSettingsConf,
 } from '@verdaccio/types';
-import { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';
+import { generateRandomHexString, getMatchedPackagesSpec } from '@verdaccio/utils';
 
 import { getUserAgent } from './agent';
 import { normalisePackageAccess } from './package-access';
@@ -124,7 +124,7 @@ class Config implements AppConfig {
     this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };
 
     // some weird shell scripts are valid yaml files parsed as string
-    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);
+    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);
 
     // sanity check for strategic config properties
     strategicConfigProps.forEach(function (x): void {
@@ -132,7 +132,7 @@ class Config implements AppConfig {
         self[x] = {};
       }
 
-      assert(isObject(self[x]), `CONFIG: bad "${x}" value (object expected)`);
+      assert(validationUtils.isObject(self[x]), `CONFIG: bad "${x}" value (object expected)`);
     });
 
     this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));

packages/config/src/index.ts

@@ -1,6 +1,7 @@
 export * from './config';
 export * from './config-path';
 export * from './token';
+export * from './config-utils';
 export * from './package-access';
 export { fromJStoYAML, parseConfigFile } from './parse';
 export * from './uplinks';

packages/core/core/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @verdaccio/core
 
+## 8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- b9fea38: chore: cleanup utils
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/core/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/core",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Core Components",
   "keywords": [
     "private",
@@ -41,7 +41,7 @@
     "semver": "7.7.1"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "lodash": "4.17.21",
     "typedoc": "0.23.25",
     "typedoc-plugin-missing-exports": "latest"

packages/core/core/src/index.ts

@@ -7,7 +7,7 @@ import * as searchUtils from './search-utils';
 import * as streamUtils from './stream-utils';
 import * as stringUtils from './string-utils';
 import * as tarballUtils from './tarball-utils';
-import * as validatioUtils from './validation-utils';
+import * as validationUtils from './validation-utils';
 import * as warningUtils from './warning-utils';
 
 export { VerdaccioError, API_ERROR, SUPPORT_ERRORS, APP_ERROR } from './error-utils';
@@ -28,15 +28,12 @@ export {
   PLUGIN_CATEGORY,
   HtpasswdHashAlgorithm,
 } from './constants';
-const validationUtils = validatioUtils;
 export {
   fileUtils,
   pkgUtils,
   searchUtils,
   streamUtils,
   errorUtils,
-  // TODO: remove this typo
-  validatioUtils,
   validationUtils,
   stringUtils,
   constants,

packages/core/file-locking/package.json

@@ -39,7 +39,7 @@
     "lockfile": "1.0.4"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4"
+    "@verdaccio/types": "workspace:13.0.0-next-8.5"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/core/tarball/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/url@13.0.0-next-8.15
+- @verdaccio/utils@8.1.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/url@13.0.0-next-8.14
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/core/tarball/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/tarball",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Verdaccio Tarball Utilities",
   "keywords": [
     "private",
@@ -33,16 +33,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/url": "workspace:13.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/url": "workspace:13.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "debug": "4.4.0",
     "gunzip-maybe": "^1.4.2",
     "lodash": "4.17.21",
     "tar-stream": "^3.1.7"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "node-mocks-http": "1.14.1"
   },
   "scripts": {

packages/core/types/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## 13.0.0-next-8.5
+
+### Patch Changes
+
+- 2bcd3ca: chore(config): harmonize configuration options
+
 ## 13.0.0-next-8.4
 
 ### Patch Changes

packages/core/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/types",
-  "version": "13.0.0-next-8.4",
+  "version": "13.0.0-next-8.5",
   "description": "Verdaccio Type Definitions",
   "keywords": [
     "private",

packages/core/types/src/configuration.ts

@@ -77,7 +77,7 @@ export type FlagsConfig = {
   changePassword?: boolean;
 };
 
-export type PackageManagers = 'pnpm' | 'yarn' | 'npm';
+export type PackageManagers = 'pnpm' | 'yarn' | 'npm' | string;
 
 // FUTURE: WebConf and TemplateUIOptions should be merged .
 export type CommonWebConf = {
@@ -101,7 +101,7 @@ export type CommonWebConf = {
   showDownloadTarball?: boolean;
   showUplinks?: boolean;
   hideDeprecatedVersions?: boolean;
-  primaryColor: string;
+  primaryColor?: string;
   showRaw?: boolean;
 };
 
@@ -116,7 +116,7 @@ export type TemplateUIOptions = {
   basename?: string;
   base: string;
   version?: string;
-  flags: FlagsConfig;
+  flags?: FlagsConfig;
 } & CommonWebConf;
 
 /**
@@ -126,10 +126,14 @@ export type WebConf = {
   // @deprecated use primaryColor
   primary_color?: string;
   primaryColor?: string;
+  // @deprecated use enabled
   enable?: boolean;
+  enabled?: boolean;
   scriptsHead?: string[];
   scriptsBodyAfter?: string[];
+  // @deprecated use scriptsBodyBefore
   scriptsbodyBefore?: string[];
+  scriptsBodyBefore?: string[];
   metaScripts?: string[];
   bodyBefore?: string[];
   bodyAfter?: string[];

packages/core/url/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/core/url/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/url",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Verdaccio URL Utilities",
   "keywords": [
     "private",
@@ -33,13 +33,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "debug": "4.4.0",
     "lodash": "4.17.21",
     "validator": "13.12.0"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "node-mocks-http": "1.14.1"
   },
   "scripts": {

packages/hooks/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @verdaccio/hooks
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/logger@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/hooks",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Hooks",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,17 +33,17 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
     "core-js": "3.40.0",
     "debug": "4.4.0",
     "got-cjs": "12.5.4",
     "handlebars": "4.7.8"
   },
   "devDependencies": {
-    "@verdaccio/auth": "workspace:8.0.0-next-8.13",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4"
+    "@verdaccio/auth": "workspace:8.0.0-next-8.15",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/loaders/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/loaders
 
+## 8.0.0-next-8.6
+
+### Patch Changes
+
+- 8f28186: fix: add legacyMergeConfigs legacy plugins
+
 ## 8.0.0-next-8.5
 
 ### Patch Changes

packages/loaders/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/loaders",
-  "version": "8.0.0-next-8.5",
+  "version": "8.0.0-next-8.6",
   "description": "Verdaccio Loader Logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -21,10 +21,10 @@
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "@verdaccio-scope/verdaccio-auth-foo": "0.0.2",
     "verdaccio-auth-memory": "workspace:*",
     "customprefix-auth": "workspace:2.0.0"

packages/loaders/src/plugin-async-loader.ts

@@ -1,5 +1,6 @@
 import buildDebug from 'debug';
 import fs from 'fs';
+import _ from 'lodash';
 import { dirname, isAbsolute, join, resolve } from 'path';
 
 import { pluginUtils } from '@verdaccio/core';
@@ -15,6 +16,10 @@ async function isDirectory(pathFolder: string) {
   return stat.isDirectory();
 }
 
+function mergeConfig(appConfig: unknown, pluginConfig: unknown) {
+  return _.merge({}, appConfig, pluginConfig);
+}
+
 // type Plugins<T> =
 //   | pluginUtils.Auth<T>
 //   | pluginUtils.Storage<T>
@@ -47,6 +52,7 @@ export async function asyncLoadPlugin<T extends pluginUtils.Plugin<T>>(
   pluginConfigs: any = {},
   pluginOptions: pluginUtils.PluginOptions,
   sanityCheck: (plugin: PluginType<T>) => boolean,
+  legacyMergeConfigs: boolean = false,
   prefix: string = 'verdaccio',
   pluginCategory: string = ''
 ): Promise<PluginType<T>[]> {
@@ -82,7 +88,12 @@ export async function asyncLoadPlugin<T extends pluginUtils.Plugin<T>>(
           logger.error(a, b);
         });
         if (plugin && isValid(plugin)) {
-          plugin = executePlugin(plugin, pluginConfigs[pluginId], pluginOptions);
+          plugin = executePlugin(
+            plugin,
+            pluginConfigs[pluginId],
+            pluginOptions,
+            legacyMergeConfigs
+          );
           if (!sanityCheck(plugin)) {
             logger.error(
               { content: externalFilePlugin },
@@ -115,7 +126,7 @@ export async function asyncLoadPlugin<T extends pluginUtils.Plugin<T>>(
         logger.error(a, b);
       });
       if (plugin && isValid(plugin)) {
-        plugin = executePlugin(plugin, pluginConfigs[pluginId], pluginOptions);
+        plugin = executePlugin(plugin, pluginConfigs[pluginId], pluginOptions, legacyMergeConfigs);
         if (!sanityCheck(plugin)) {
           logger.error({ content: pluginName }, "@{content} doesn't look like a valid plugin");
           continue;
@@ -143,8 +154,15 @@ export async function asyncLoadPlugin<T extends pluginUtils.Plugin<T>>(
 export function executePlugin<T>(
   plugin: PluginType<T>,
   pluginConfig: unknown,
-  pluginOptions: pluginUtils.PluginOptions
+  pluginOptions: pluginUtils.PluginOptions,
+  legacyMergeConfigs: boolean = false
 ): PluginType<T> {
+  // this is a legacy support for plugins that are not using the new API
+  if (legacyMergeConfigs) {
+    debug('>>> plugin merge config enabled');
+    let originalConfig = pluginOptions.config;
+    pluginConfig = mergeConfig(originalConfig, pluginConfig);
+  }
   if (isES6(plugin)) {
     debug('plugin is ES6');
     // @ts-expect-error no relevant for the code

packages/loaders/test/partials/test-plugin-storage/verdaccio-plugin/index.js

@@ -1,7 +1,13 @@
-function ValidVerdaccioPlugin() {
-  return {
-    authenticate: function () {},
-  };
+class ValidVerdaccioPlugin {
+  config;
+  options;
+  constructor(config, options) {
+    console.log('ValidVerdaccioPlugin constructor', config);
+    this.config = config;
+    this.options = options;
+  }
+
+  authenticate() {}
 }
 
-module.exports = ValidVerdaccioPlugin;
+module.exports = (...rest) => new ValidVerdaccioPlugin(...rest);

packages/loaders/test/plugin_loader_async.spec.ts

@@ -5,7 +5,7 @@ import { Config, parseConfigFile } from '@verdaccio/config';
 import { pluginUtils } from '@verdaccio/core';
 import { logger, setup } from '@verdaccio/logger';
 
-import { asyncLoadPlugin } from '../src/plugin-async-loader';
+import { asyncLoadPlugin } from '../src/index';
 
 function getConfig(file: string) {
   const conPath = path.join(__dirname, './partials/config', file);
@@ -71,6 +71,7 @@ describe('plugin loader', () => {
         expect(plugins).toHaveLength(0);
       });
     });
+
     describe('relative path', () => {
       test('should resolve plugin based on relative path', async () => {
         const config = getConfig('relative-plugins.yaml');
@@ -93,6 +94,7 @@ describe('plugin loader', () => {
       });
 
       // config.config_path is not considered for loading plugins due legacy support
+      // @ts-ignore
       test('should fails if config path is missing (only config_path)', async () => {
         const config = getConfig('relative-plugins.yaml');
         // @ts-expect-error
@@ -142,6 +144,7 @@ describe('plugin loader', () => {
         config.auth,
         { config, logger },
         authSanitize,
+        false,
         'customprefix'
       );
 
@@ -172,4 +175,27 @@ describe('plugin loader', () => {
       expect(plugins).toHaveLength(1);
     });
   });
+
+  describe('legacy merge configs', () => {
+    // whenever 6.x and 7.x version are out of support, we can remove this test
+    test('should merge configuration with plugin configuration', async () => {
+      const config = getConfig('relative-plugins.yaml');
+      // force file instead a folder.
+      const plugins = await asyncLoadPlugin(config.auth, { config, logger }, authSanitize, true);
+
+      expect(plugins).toHaveLength(1);
+      const plugin = plugins[0];
+      // just check if the plugin has the main config
+      expect(plugin.config).toHaveProperty('self_path');
+      expect(plugin.config).toHaveProperty('storage');
+      // assume all config props are merged
+      // check if the plugin has the auth config
+      expect(plugin.config).toHaveProperty('auth');
+      expect(plugin.config.auth).toEqual({
+        plugin: {
+          enabled: true,
+        },
+      });
+    });
+  });
 });

packages/logger/logger-commons/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @verdaccio/logger-commons
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/logger/logger-commons/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/logger-commons",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Logger Commons",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -42,14 +42,14 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "@verdaccio/logger-prettify": "workspace:8.0.0-next-8.2",
     "debug": "4.4.0",
     "colorette": "2.0.20"
   },
   "devDependencies": {
     "pino": "9.6.0",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4"
+    "@verdaccio/types": "workspace:13.0.0-next-8.5"
   },
   "funding": {
     "type": "opencollective",

packages/logger/logger/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @verdaccio/logger
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/logger-commons@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- @verdaccio/logger-commons@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/logger/logger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/logger",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -42,11 +42,11 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/logger-commons": "workspace:8.0.0-next-8.13",
+    "@verdaccio/logger-commons": "workspace:8.0.0-next-8.15",
     "pino": "9.6.0"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4"
+    "@verdaccio/types": "workspace:13.0.0-next-8.5"
   },
   "funding": {
     "type": "opencollective",

packages/middleware/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @verdaccio/middleware
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/config@8.0.0-next-8.15
+- @verdaccio/url@13.0.0-next-8.15
+- @verdaccio/utils@8.1.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- b9fea38: chore: cleanup utils
+- 2bcd3ca: chore(config): harmonize configuration options
+- da1650c: fix(middleware): scoped package for allow checks
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/url@13.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/middleware/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Express Middleware",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -42,10 +42,10 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/url": "workspace:13.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/url": "workspace:13.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "debug": "4.4.0",
     "express": "4.21.2",
     "express-rate-limit": "5.5.1",
@@ -58,7 +58,7 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
     "body-parser": "1.20.3",
     "supertest": "7.0.0",
     "jsdom": "25.0.1"

packages/middleware/src/middlewares/allow.ts

@@ -20,7 +20,7 @@ export function allow<T>(
     return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
       req.pause();
       const packageName = req.params.scope
-        ? `@${req.params.scope}/${req.params.package}`
+        ? `${req.params.scope}/${req.params.package}`
         : req.params.package;
       const packageVersion = req.params.filename
         ? tarballUtils.getVersionFromTarball(req.params.filename)

packages/middleware/src/middlewares/json.ts

@@ -1,5 +1,4 @@
-import { errorUtils } from '@verdaccio/core';
-import { isObject } from '@verdaccio/utils';
+import { errorUtils, validationUtils } from '@verdaccio/core';
 
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 
@@ -8,7 +7,7 @@ export function expectJson(
   res: $ResponseExtend,
   next: $NextFunctionVer
 ): void {
-  if (!isObject(req.body)) {
+  if (!validationUtils.isObject(req.body)) {
     return next(errorUtils.getBadRequest("can't parse incoming json"));
   }
   next();

packages/middleware/src/middlewares/web/utils/renderHTML.ts

@@ -80,7 +80,7 @@ export default function renderHTML(
   const {
     scriptsBodyAfter,
     metaScripts,
-    scriptsbodyBefore,
+    scriptsbodyBefore, // deprecated
     showInfo,
     showSettings,
     showThemeSwitch,
@@ -98,6 +98,11 @@ export default function renderHTML(
     },
     config?.web
   );
+  // Fallback
+  let scriptsBodyBefore = config?.web?.scriptsBodyBefore;
+  if (scriptsbodyBefore && !scriptsBodyBefore) {
+    scriptsBodyBefore = scriptsbodyBefore;
+  }
   const options: TemplateUIOptions = {
     showInfo,
     showSettings,
@@ -136,7 +141,7 @@ export default function renderHTML(
           options,
           scriptsBodyAfter,
           metaScripts,
-          scriptsbodyBefore,
+          scriptsBodyBefore,
         },
         manifest
       );

packages/middleware/src/middlewares/web/utils/template.ts

@@ -11,7 +11,7 @@ export type Template = {
   options: TemplateUIOptions;
   metaScripts?: string[];
   scriptsBodyAfter?: string[];
-  scriptsbodyBefore?: string[];
+  scriptsBodyBefore?: string[];
 };
 
 // the outcome of the Webpack Manifest Plugin
@@ -30,15 +30,15 @@ export default function renderTemplate(template: Template, manifest: WebpackMani
         <meta charset="utf-8">
         <base href="${template?.options.base}">
         <title>${template?.options?.title ?? ''}</title>
-        <link rel="icon" href="${template?.options.base}-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link rel="icon" href="${template?.options.base}-/static/favicon.ico">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
         <script>
             window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(template.options)}
         </script>
         ${template?.metaScripts ? template.metaScripts.join('') : ''}
       </head>
       <body class="body">
-        ${template?.scriptsbodyBefore ? template.scriptsbodyBefore.join('') : ''}
+        ${template?.scriptsBodyBefore ? template.scriptsBodyBefore.join('') : ''}
         <div id="root"></div>
         ${getManifestValue(template.manifest.js, manifest, template?.options.base)
           .map((item) => `<script defer="defer" src="${item}"></script>`)

packages/middleware/test/__snapshots__/template.test.ts.snap

@@ -8,8 +8,8 @@ exports[`template > custom body after 1`] = `
         <meta charset="utf-8">
         <base href="http://domain.com/">
         <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link rel="icon" href="http://domain.com/-/static/favicon.ico">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
         <script>
             window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
         </script>
@@ -34,8 +34,8 @@ exports[`template > custom body before 1`] = `
         <meta charset="utf-8">
         <base href="http://domain.com/">
         <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link rel="icon" href="http://domain.com/-/static/favicon.ico">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
         <script>
             window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
         </script>
@@ -60,8 +60,8 @@ exports[`template > custom render 1`] = `
         <meta charset="utf-8">
         <base href="http://domain.com/">
         <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link rel="icon" href="http://domain.com/-/static/favicon.ico">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
         <script>
             window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
         </script>
@@ -86,8 +86,8 @@ exports[`template > custom title 1`] = `
         <meta charset="utf-8">
         <base href="http://domain.com/">
         <title>foo title</title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link rel="icon" href="http://domain.com/-/static/favicon.ico">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
         <script>
             window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/","title":"foo title"}
         </script>
@@ -112,8 +112,8 @@ exports[`template > meta scripts 1`] = `
         <meta charset="utf-8">
         <base href="http://domain.com/">
         <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link rel="icon" href="http://domain.com/-/static/favicon.ico">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
         <script>
             window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
         </script>

packages/middleware/test/allow.spec.ts

@@ -13,7 +13,6 @@ test('should allow request', async () => {
     },
   });
   const app = getApp([]);
-  // @ts-ignore
   app.get('/:package', can('publish'), (req, res) => {
     res.status(HTTP_STATUS.OK).json({});
   });
@@ -28,8 +27,7 @@ test('should allow scope request', async () => {
     },
   });
   const app = getApp([]);
-  // @ts-ignore
-  app.get('/:package/:scope', can('publish'), (req, res) => {
+  app.get('/:scope/:package', can('publish'), (req, res) => {
     res.status(HTTP_STATUS.OK).json({});
   });
 
@@ -43,7 +41,6 @@ test('should allow filename request', async () => {
     },
   });
   const app = getApp([]);
-  // @ts-ignore
   app.get('/:filename', can('publish'), (req, res) => {
     res.status(HTTP_STATUS.OK).json({});
   });
@@ -58,7 +55,6 @@ test('should not allow request', async () => {
     },
   });
   const app = getApp([]);
-  // @ts-ignore
   app.get('/sec', can('publish'), (req, res) => {
     res.status(HTTP_STATUS.OK).json({});
   });
@@ -73,7 +69,6 @@ test('should handle error request', async () => {
     },
   });
   const app = getApp([]);
-  // @ts-ignore
   app.get('/err', can('publish'));
 
   return request(app).get('/err').expect(HTTP_STATUS.INTERNAL_ERROR);
@@ -82,11 +77,12 @@ test('should handle error request', async () => {
 test('should allow request with version', async () => {
   const can = allow({
     allow_publish: (params, remove, cb) => {
-      return params.packageVersion === '1.0.0' ? cb(null, true) : cb(null, false);
+      return params.packageName === 'pacman' && params.packageVersion === '1.0.0'
+        ? cb(null, true)
+        : cb(new Error('not allowed'), false);
     },
   });
   const app = getApp([]);
-  // @ts-ignore
   app.get('/:package/:version', can('publish'), (req, res) => {
     res.status(HTTP_STATUS.OK).json({});
   });
@@ -94,14 +90,31 @@ test('should allow request with version', async () => {
   return request(app).get('/pacman/1.0.0').expect(HTTP_STATUS.OK);
 });
 
-test('should not allow request with version', async () => {
+test('should allow request with scope and version', async () => {
   const can = allow({
     allow_publish: (params, remove, cb) => {
-      return params.packageVersion === '1.0.0' ? cb(null, true) : cb(null, false);
+      return params.packageName === '@verdaccio/core'
+        ? cb(null, true)
+        : cb(new Error('not allowed'), false);
+    },
+  });
+  const app = getApp([]);
+  app.get('/:scope/:package', can('publish'), (req, res) => {
+    res.status(HTTP_STATUS.OK).json({});
+  });
+
+  return request(app).get('/@verdaccio/core').expect(HTTP_STATUS.OK);
+});
+
+test('should not allow request with version', async () => {
+  const can = allow({
+    allow_publish: (params, remove, cb) => {
+      return params.packageName === 'pacman' && params.packageVersion === '2.0.0'
+        ? cb(new Error('not allowed'), false)
+        : cb(null, true);
     },
   });
   const app = getApp([]);
-  // @ts-ignore
   app.get('/:package/:version', can('publish'), (req, res) => {
     res.status(HTTP_STATUS.OK).json({});
   });

packages/middleware/test/template.test.ts

@@ -61,7 +61,7 @@ describe('template', () => {
       template(
         {
           options: { base: 'http://domain.com/' },
-          scriptsbodyBefore: [`<script src="fooBefore"/>`, `<script src="barBefore"/>`],
+          scriptsBodyBefore: [`<script src="fooBefore"/>`, `<script src="barBefore"/>`],
           manifest: exampleManifest,
         },
         manifest

packages/node-api/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @verdaccio/node-api
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/server@8.0.0-next-8.15
+- @verdaccio/server-fastify@8.0.0-next-8.15
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/config@8.0.0-next-8.15
+- @verdaccio/logger@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+- Updated dependencies [2bcd3ca]
+- Updated dependencies [8f28186]
+  - @verdaccio/server-fastify@8.0.0-next-8.14
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/server@8.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/node-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/node-api",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Node API",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -42,17 +42,17 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/server": "workspace:8.0.0-next-8.13",
-    "@verdaccio/server-fastify": "workspace:8.0.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/server": "workspace:8.0.0-next-8.15",
+    "@verdaccio/server-fastify": "workspace:8.0.0-next-8.15",
     "core-js": "3.40.0",
     "debug": "4.4.0",
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "selfsigned": "2.4.1",
     "supertest": "7.0.0"
   },

packages/plugins/audit/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/config@8.0.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/plugins/audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-audit",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Verdaccio Middleware plugin to bypass npmjs audit",
   "keywords": [
     "private",
@@ -30,16 +30,16 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "express": "4.21.2",
     "https-proxy-agent": "5.0.1",
     "node-fetch": "cjs"
   },
   "devDependencies": {
-    "@verdaccio/auth": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/auth": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "supertest": "7.0.0"
   },
   "scripts": {

packages/plugins/auth-memory/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/plugins/auth-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-auth-memory",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Auth plugin for Verdaccio that keeps users in memory",
   "keywords": [
     "private",
@@ -30,13 +30,13 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "debug": "4.4.0"
   },
   "devDependencies": {
     "@types/debug": "^4.1.12",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4"
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/plugins/htpasswd/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/file-locking@13.0.0-next-8.3
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/plugins/htpasswd/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-htpasswd",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Htpasswd Authentication Plugin for Verdaccio",
   "keywords": [
     "private",
@@ -33,7 +33,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "@verdaccio/file-locking": "workspace:13.0.0-next-8.3",
     "apache-md5": "1.1.8",
     "bcryptjs": "2.4.3",
@@ -44,9 +44,9 @@
   },
   "devDependencies": {
     "@types/bcryptjs": "2.4.6",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
     "mockdate": "3.0.5"
   },
   "scripts": {

packages/plugins/local-storage/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/utils@8.1.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- b9fea38: chore: cleanup utils
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/file-locking@13.0.0-next-8.3
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/plugins/local-storage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/local-storage",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Verdaccio Local Storage Plugin",
   "keywords": [
     "private",
@@ -36,9 +36,9 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "@verdaccio/file-locking": "workspace:13.0.0-next-8.3",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "core-js": "3.40.0",
     "debug": "4.4.0",
     "globby": "11.1.0",
@@ -50,10 +50,10 @@
   },
   "devDependencies": {
     "@types/minimatch": "5.1.2",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
     "@verdaccio/test-helper": "workspace:4.0.0-next-8.4",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "minimatch": "9.0.5"
   },
   "scripts": {

packages/plugins/local-storage/src/dir-utils.ts

@@ -2,7 +2,7 @@ import buildDebug from 'debug';
 import globby from 'globby';
 import { join } from 'path';
 
-import { searchUtils, validatioUtils } from '@verdaccio/core';
+import { searchUtils, validationUtils } from '@verdaccio/core';
 
 const debug = buildDebug('verdaccio:plugin:local-storage:utils');
 
@@ -12,14 +12,13 @@ const debug = buildDebug('verdaccio:plugin:local-storage:utils');
  * @return a promise that resolves to an array of absolute paths
  */
 export async function getFolders(storagePath: string, pattern = '*'): Promise<string[]> {
-  // @ts-ignore - check why this fails, types are correct
   const files = await globby(pattern, {
     // @ts-ignore
     cwd: storagePath,
     expandDirectories: true,
     onlyDirectories: true,
     onlyFiles: false,
-    // should not go deeper than the storage path (10 is reseaon for the storage))
+    // should not go deeper than the storage path (10 is reasonable for the storage)
     deep: 10,
     dot: false,
     followSymbolicLinks: true,
@@ -73,7 +72,7 @@ export async function searchOnStorage(
   );
 
   for (let store of basePathFolders) {
-    if (validatioUtils.isPackageNameScoped(store)) {
+    if (validationUtils.isPackageNameScoped(store)) {
       const scopedPackages = await getFolders(join(storagePath, store), '*');
       const listScoped = scopedPackages.map((scoped) => ({
         name: `${store}/${scoped}`,
@@ -91,7 +90,7 @@ export async function searchOnStorage(
   for (const store of storageFolders) {
     const foldersOnStorage = await getFolders(join(storagePath, store), '*');
     for (let pkgName of foldersOnStorage) {
-      if (validatioUtils.isPackageNameScoped(pkgName)) {
+      if (validationUtils.isPackageNameScoped(pkgName)) {
         const scopedPackages = await getFolders(join(storagePath, store, pkgName), '*');
         const listScoped = scopedPackages.map((scoped) => ({
           name: `${pkgName}/${scoped}`,

packages/plugins/memory/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Change Log
 
+## 13.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+
+## 13.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+  - @verdaccio/core@8.0.0-next-8.14
+
 ## 13.0.0-next-8.13
 
 ### Patch Changes

packages/plugins/memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-memory",
-  "version": "13.0.0-next-8.13",
+  "version": "13.0.0-next-8.15",
   "description": "Verdaccio Memory Storage Plugin",
   "keywords": [
     "private",
@@ -30,15 +30,15 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
     "memory-fs": "0.5.0",
     "debug": "4.4.0",
     "memfs": "3.5.3"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13"
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/plugins/ui-theme/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @verdaccio/ui-theme
 
+## 8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/plugins/ui-theme/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/ui-theme",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio User Interface (Theme)",
   "author": {
     "name": "Verdaccio Contributors",
@@ -31,9 +31,9 @@
     "@testing-library/dom": "10.4.0",
     "@testing-library/jest-dom": "6.6.3",
     "@testing-library/react": "16.1.0",
-    "@verdaccio/node-api": "workspace:8.0.0-next-8.13",
+    "@verdaccio/node-api": "workspace:8.0.0-next-8.15",
     "@verdaccio/types": "workspace:*",
-    "@verdaccio/ui-components": "workspace:4.0.0-next-8.7",
+    "@verdaccio/ui-components": "workspace:4.0.0-next-8.8",
     "@verdaccio/ui-i18n": "workspace:8.0.0-next-8.12",
     "@vitejs/plugin-react": "4.3.4",
     "babel-loader": "8.4.1",

packages/proxy/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @verdaccio/proxy
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/config@8.0.0-next-8.15
+- @verdaccio/utils@8.1.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/proxy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/proxy",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Proxy Fetcher",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -42,9 +42,9 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "JSONStream": "1.3.5",
     "debug": "4.4.0",
     "got-cjs": "12.5.4",
@@ -52,8 +52,8 @@
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "get-stream": "^6.0.1",
     "node-mocks-http": "1.14.1",
     "p-cancelable": "2.1.1",

packages/search-indexer/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/search-indexer
 
+## 8.0.0-next-8.4
+
+### Patch Changes
+
+- 8f28186: fix: add legacyMergeConfigs legacy plugins
+
 ## 8.0.0-next-8.3
 
 ### Patch Changes

packages/search-indexer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/search-indexer",
-  "version": "8.0.0-next-8.3",
+  "version": "8.0.0-next-8.4",
   "description": "Verdaccio Search Indexer",
   "main": "./build/dist.js",
   "types": "build/index.d.ts",
@@ -38,10 +38,10 @@
     "type-check": "tsc --noEmit -p tsconfig.build.json",
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
-    "build": "esbuild src/index.ts --bundle --outfile=build/dist.js --platform=node --target=node12  && pnpm run build:types"
+    "build": "esbuild src/index.ts --bundle --outfile=build/dist.js --platform=node --target=node18  && pnpm run build:types"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "@orama/orama": "1.2.4",
     "debug": "4.4.0",
     "esbuild": "0.24.2"

packages/search/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @verdaccio/search
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- @verdaccio/core@8.0.0-next-8.15
+- @verdaccio/config@8.0.0-next-8.15
+- @verdaccio/proxy@8.0.0-next-8.15
+- @verdaccio/logger@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/proxy@8.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/search/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/search",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Search Proxy",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -44,13 +44,13 @@
   "dependencies": {
     "debug": "4.4.0",
     "lodash": "4.17.21",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/proxy": "workspace:8.0.0-next-8.13"
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/proxy": "workspace:8.0.0-next-8.15"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "mockdate": "3.0.5",
     "node-mocks-http": "1.14.1"
   },

packages/server/express/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @verdaccio/server
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- Updated dependencies [1f25d5f]
+  - @verdaccio/auth@8.0.0-next-8.15
+  - @verdaccio/api@8.1.0-next-8.15
+  - verdaccio-audit@13.0.0-next-8.15
+  - @verdaccio/web@8.1.0-next-8.15
+  - @verdaccio/core@8.0.0-next-8.15
+  - @verdaccio/config@8.0.0-next-8.15
+  - @verdaccio/loaders@8.0.0-next-8.6
+  - @verdaccio/middleware@8.0.0-next-8.15
+  - @verdaccio/store@8.0.0-next-8.15
+  - @verdaccio/utils@8.1.0-next-8.15
+  - @verdaccio/logger@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- 2bcd3ca: chore(config): harmonize configuration options
+- 8f28186: fix: add legacyMergeConfigs legacy plugins
+- Updated dependencies [1e2f503]
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+- Updated dependencies [2bcd3ca]
+- Updated dependencies [da1650c]
+- Updated dependencies [8f28186]
+  - @verdaccio/api@8.1.0-next-8.14
+  - @verdaccio/middleware@8.0.0-next-8.14
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/store@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/web@8.1.0-next-8.14
+  - @verdaccio/loaders@8.0.0-next-8.6
+  - @verdaccio/auth@8.0.0-next-8.14
+  - verdaccio-audit@13.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/server/express/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/server",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Express Server",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,17 +33,17 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/api": "workspace:8.1.0-next-8.13",
-    "@verdaccio/auth": "workspace:8.0.0-next-8.13",
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/loaders": "workspace:8.0.0-next-8.5",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/middleware": "workspace:8.0.0-next-8.13",
-    "@verdaccio/store": "workspace:8.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
-    "@verdaccio/web": "workspace:8.1.0-next-8.13",
-    "verdaccio-audit": "workspace:13.0.0-next-8.13",
+    "@verdaccio/api": "workspace:8.1.0-next-8.15",
+    "@verdaccio/auth": "workspace:8.0.0-next-8.15",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/loaders": "workspace:8.0.0-next-8.6",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/middleware": "workspace:8.0.0-next-8.15",
+    "@verdaccio/store": "workspace:8.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
+    "@verdaccio/web": "workspace:8.1.0-next-8.15",
+    "verdaccio-audit": "workspace:13.0.0-next-8.15",
     "compression": "1.8.0",
     "cors": "2.8.5",
     "debug": "4.4.0",
@@ -51,7 +51,7 @@
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/proxy": "workspace:8.0.0-next-8.13",
+    "@verdaccio/proxy": "workspace:8.0.0-next-8.15",
     "@verdaccio/test-helper": "workspace:4.0.0-next-8.4",
     "http-errors": "2.0.0"
   },

packages/server/express/src/server.ts

@@ -22,7 +22,7 @@ import {
 import { Storage } from '@verdaccio/store';
 import { ConfigYaml } from '@verdaccio/types';
 import { Config as IConfig } from '@verdaccio/types';
-import webMiddleware from '@verdaccio/web';
+import webMiddleware, { PLUGIN_UI_PREFIX } from '@verdaccio/web';
 
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
 import hookDebug from './debug';
@@ -73,7 +73,8 @@ const defineAPI = async function (config: IConfig, storage: Storage): Promise<Ex
     function (plugin) {
       return typeof plugin.register_middlewares !== 'undefined';
     },
-    config?.serverSettings?.pluginPrefix ?? 'verdaccio',
+    false,
+    config?.serverSettings?.pluginPrefix ?? PLUGIN_UI_PREFIX,
     PLUGIN_CATEGORY.MIDDLEWARE
   );
 
@@ -98,7 +99,7 @@ const defineAPI = async function (config: IConfig, storage: Storage): Promise<Ex
   app.use(apiEndpoint(config, auth, storage, logger));
 
   // For WebUI & WebUI API
-  if (_.get(config, 'web.enable', true)) {
+  if (_.get(config, 'web.enabled', _.get(config, 'web.enable', true))) {
     app.use((_req, res, next) => {
       res.locals.app_version = version ?? '';
       next();

packages/server/express/test/config/web-enabled.yaml

@@ -0,0 +1,28 @@
+# storage: this is generated on _helper file
+
+auth:
+  htpasswd:
+    file: ./htpasswd-package
+
+# Use enabled instead of enable which is deprecated
+web:
+  enabled: true
+
+publish:
+  allow_offline: false
+
+uplinks:
+
+log: { type: stdout, format: pretty, level: trace }
+
+packages:
+  '@*/*':
+    access: $all
+    publish: $all
+    unpublish: none
+  '**':
+    access: $all
+    publish: $all
+    unpublish: none
+
+_debug: true

packages/server/express/test/server.spec.ts

@@ -99,6 +99,15 @@ describe('server api', () => {
     expect(response.body.error).toEqual(API_ERROR.WEB_DISABLED);
   });
 
+  test('should return homepage if web is enabled', async () => {
+    const app = await initializeServer('web-enabled.yaml');
+    const response = await supertest(app)
+      .get('/')
+      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_HTML_UTF8)
+      .expect(HTTP_STATUS.OK);
+    expect(response.text).toContain('<title>verdaccio</title>');
+  });
+
   test('should not display debug hook disabled by default', async () => {
     const app = await initializeServer('no_debug.yaml');
     await supertest(app)

packages/server/fastify/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @verdaccio/server-fastify
 
+## 8.0.0-next-8.15
+
+### Patch Changes
+
+- Updated dependencies [1f25d5f]
+  - @verdaccio/auth@8.0.0-next-8.15
+  - @verdaccio/core@8.0.0-next-8.15
+  - @verdaccio/config@8.0.0-next-8.15
+  - @verdaccio/tarball@13.0.0-next-8.15
+  - @verdaccio/store@8.0.0-next-8.15
+  - @verdaccio/utils@8.1.0-next-8.15
+  - @verdaccio/logger@8.0.0-next-8.15
+
+## 8.0.0-next-8.14
+
+### Patch Changes
+
+- b9fea38: chore: cleanup utils
+- Updated dependencies [b9fea38]
+- Updated dependencies [bb478f2]
+- Updated dependencies [8f28186]
+  - @verdaccio/core@8.0.0-next-8.14
+  - @verdaccio/config@8.0.0-next-8.14
+  - @verdaccio/store@8.0.0-next-8.14
+  - @verdaccio/utils@8.1.0-next-8.14
+  - @verdaccio/auth@8.0.0-next-8.14
+  - @verdaccio/tarball@13.0.0-next-8.14
+  - @verdaccio/logger@8.0.0-next-8.14
+
 ## 8.0.0-next-8.13
 
 ### Patch Changes

packages/server/fastify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/server-fastify",
-  "version": "8.0.0-next-8.13",
+  "version": "8.0.0-next-8.15",
   "description": "Verdaccio Fastify Server",
   "keywords": [
     "private",
@@ -33,13 +33,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:8.0.0-next-8.13",
-    "@verdaccio/config": "workspace:8.0.0-next-8.13",
-    "@verdaccio/auth": "workspace:8.0.0-next-8.13",
-    "@verdaccio/logger": "workspace:8.0.0-next-8.13",
-    "@verdaccio/store": "workspace:8.0.0-next-8.13",
-    "@verdaccio/tarball": "workspace:13.0.0-next-8.13",
-    "@verdaccio/utils": "workspace:8.1.0-next-8.13",
+    "@verdaccio/core": "workspace:8.0.0-next-8.15",
+    "@verdaccio/config": "workspace:8.0.0-next-8.15",
+    "@verdaccio/auth": "workspace:8.0.0-next-8.15",
+    "@verdaccio/logger": "workspace:8.0.0-next-8.15",
+    "@verdaccio/store": "workspace:8.0.0-next-8.15",
+    "@verdaccio/tarball": "workspace:13.0.0-next-8.15",
+    "@verdaccio/utils": "workspace:8.1.0-next-8.15",
     "core-js": "3.40.0",
     "debug": "4.4.0",
     "fastify": "4.25.2",
@@ -47,7 +47,7 @@
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:13.0.0-next-8.4",
+    "@verdaccio/types": "workspace:13.0.0-next-8.5",
     "ts-node": "10.9.2"
   },
   "scripts": {

packages/server/fastify/src/endpoints/user.ts

@@ -7,7 +7,7 @@ import _ from 'lodash';
 
 import { getApiToken } from '@verdaccio/auth';
 import { createRemoteUser } from '@verdaccio/config';
-import { validatioUtils } from '@verdaccio/core';
+import { validationUtils } from '@verdaccio/core';
 import { logger } from '@verdaccio/logger';
 import { RemoteUser } from '@verdaccio/types';
 import { getAuthenticatedMessage } from '@verdaccio/utils';
@@ -98,7 +98,7 @@ async function userRoute(fastify: FastifyInstance) {
       );
     } else {
       if (
-        validatioUtils.validatePassword(
+        validationUtils.validatePassword(
           password as string,
           fastify.configInstance?.server?.passwordValidationRegex
         ) === false