chore(release): 4.12.1

.github/workflows/ci-e2e.yml

@@ -1,27 +0,0 @@
-name: E2E CLI
-
-on: [pull_request]
-
-jobs:
-  ci:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest]
-        node_version: [14]
-
-    name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2.3.1
-      - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: ${{ matrix.node_version }}
-      - name: Install
-        run: yarn install --immutable
-      - name: Build
-        run: yarn code:build
-      - name: Test CLI
-        run: yarn run test:e2e:cli

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node_version: [10, 12, 14, 15]
+        node_version: [10]
 
     runs-on: ubuntu-latest
 

.github/workflows/codeql-analysis.yml

@@ -1,52 +0,0 @@
-name: "Code scanning - action"
-
-on:
-  push:
-  pull_request:
-  schedule:
-    - cron: '0 2 * * 4'
-
-jobs:
-  CodeQL-Build:
-
-    # CodeQL runs on ubuntu-latest and windows-latest
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2.3.3
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-      
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1

.github/workflows/docker-publish.yml

@@ -36,7 +36,8 @@ jobs:
         with:
           images: ${{ github.repository }}
           tag-custom: 4.x-next
-          tag-custom-only: ${{ github.ref == 'refs/heads/master' }}
+          tag-custom-only: ${{ github.ref == 'refs/heads/4.x' }}
+          tag-latest: false
           tag-semver: |
             {{version}}
             {{major}}

.github/workflows/e2e-angular-cli-workflow.yml

@@ -1,153 +0,0 @@
-on:
-  schedule:
-  - cron: '0 3 * * 5'
-  pull_request:
-    branches:
-    - '**'
-
-name: 'E2E Angular CLI with verdaccio'
-jobs:
-# todo: fix yarn global issue, cannot find ng
-#  yarn:
-#    name: 'yarn:angular example'
-#    runs-on: ubuntu-latest
-#
-#    steps:
-#      - uses: actions/checkout@v2.3.3
-#
-#      - name: 'Use Node.js 10.x'
-#        uses: actions/setup-node@v2.1.5
-#        with:
-#          node-version: 10.x
-#      - name: Install Dependencies
-#        run: yarn install --pure-lockfile
-#      - name: 'Run verdaccio in the background'
-#        run: |
-#          nohup node ./scripts/run-verdaccio.js &
-#      - name: 'Ping to verdaccio'
-#        run: |
-#          npm ping --registry http://localhost:4873
-#      - name: 'Running the integration test'
-#        run: |
-#          source scripts/e2e-setup-ci.sh
-#          yarn init --yes
-#
-#          yarn global add @angular/cli
-#          which nodemon
-#          ng new verdaccio-angular --interactive=false
-#
-#          cd verdaccio-angular
-#          echo "registry=http://localhost:4873" > ~/.npmrc
-#          yarn add @angular-devkit/core@next @babel/preset-env @babel/core -D
-#
-#          ng build --aot
-  npm:
-    name: 'npm:angular example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 14.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 14.x
-      - name: 'install latest npm'
-        run: npm i -g npm@latest-6
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          echo "registry=http://localhost:4873" > ~/.npmrc
-          npm config set loglevel="http"
-          npm config set fetch-retries="5"
-          npm config set fetch-retry-factor="50"
-          npm config set fetch-retry-mintimeout="20000"
-          npm config set fetch-retry-maxtimeout="80000"
-          npm install -g @angular/cli
-          ng new verdaccio-angular --interactive=false
-
-          cd verdaccio-angular
-          npm install @angular-devkit/core@next @babel/preset-env @babel/core -D
-
-          npm run ng build --aot
-  npm7:
-    name: 'npm7:angular example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 14.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 14.x
-      - name: 'install latest npm'
-        run: npm i -g npm@next-7
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          echo "registry=http://localhost:4873" > ~/.npmrc
-          npm config set loglevel="silent"
-          npm config set fetch-retries="5"
-          npm config set fetch-retry-factor="50"
-          npm config set fetch-retry-mintimeout="20000"
-          npm config set fetch-retry-maxtimeout="80000"
-          npm install -g @angular/cli
-          ng new verdaccio-angular --interactive=false
-
-          cd verdaccio-angular
-          npm install @angular-devkit/core@next @babel/preset-env @babel/core -D
-
-          npm run ng build --aot
-
-#  pnpm throws errors worth to check why
-#  pnpm:
-#    name: 'pnpm:angular example'
-#    runs-on: ubuntu-latest
-#
-#    steps:
-#      - uses: actions/checkout@v2.3.3
-#
-#      - name: 'Use Node.js 10.x'
-#        uses: actions/setup-node@v2.1.1
-#        with:
-#          node-version: 10.x
-#      - name: 'install latest pnpm'
-#        run: npm i -g pnpm
-#      - name: Install Dependencies
-#        run: yarn install --pure-lockfile
-#      - name: 'Run verdaccio in the background'
-#        run: |
-#          nohup node ./scripts/run-verdaccio.js &
-#      - name: 'Ping to verdaccio'
-#        run: |
-#          pnpm ping --registry http://localhost:4873
-#      - name: 'Running the integration test'
-#        run: |
-#          source scripts/e2e-setup-ci.sh
-#          pnpm init --force
-#
-#          pnpm install -g @angular/cli
-#          ng new verdaccio-angular --interactive=false
-#
-#          cd verdaccio-angular
-#          echo "registry=http://localhost:4873" > ~/.npmrc
-#          pnpm install @angular-devkit/core@next @babel/preset-env @babel/core -D
-#
-#          pnpm run ng build --aot

.github/workflows/e2e-gatsbyjs-cli-workflow.yml

@@ -1,44 +0,0 @@
-on:
-  schedule:
-    - cron: '0 3 * * 5'
-  pull_request:
-    branches:
-      - '**'
-
-name: 'E2E Gatsby.js CLI with verdaccio'
-jobs:
-  npm:
-    name: 'npm:gatsby example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 14.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 14.x
-      - name: 'install latest npm'
-        run: npm i -g npm@latest-6
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          echo "registry=http://localhost:4873
-          loglevel="silent"
-          fetch-retries=10
-          fetch-retry-factor=2
-          fetch-retry-mintimeout=10000
-          fetch-retry-maxtimeout=80000" > ~/.npmrc
-          npm config list
-          npm i -g gatsby
-          gatsby new my-gatsby
-          cd my-gatsby
-          npm run build

.github/workflows/e2e-jest-workflow.yml

@@ -1,209 +0,0 @@
-on:
-  schedule:
-    - cron: '0 3 * * 5'
-  pull_request:
-    branches:
-      - '**'
-
-name: 'E2E Jest with verdaccio'
-jobs:
-  yarn:
-    name: 'yarn:jest example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 10.x
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          yarn init --yes
-          yarn add jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-  yarn2:
-    name: 'yarn2:jest example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 10.x
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js --config ./scripts/e2e-config.yaml &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          yarn init --yes
-          yarn set version berry
-          yarn config set npmRegistryServer "http://localhost:4873"
-          yarn config set unsafeHttpWhitelist --json '["localhost"]'
-          yarn add jest@26.0.0
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-  npm:
-    name: 'npm:jest example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 10.x
-      - name: 'install latest npm'
-        run: npm i -g npm@latest-6
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js  --config ./scripts/e2e-config.yaml  &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          npm init --force
-          npm install jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-  npm7:
-    name: 'npm7:jest example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 10.x
-      - name: 'install latest npm'
-        run: npm i -g npm
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js  --config ./scripts/e2e-config.yaml  &
-      - name: 'Ping to verdaccio'
-        run: |
-          npm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          npm init --force
-          npm install jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-
-  pnpm:
-    name: 'pnpm:jest example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 10.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 10.x
-      - name: 'install latest pnpm'
-        run: npm i -g pnpm
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js &
-      - name: 'Ping to verdaccio'
-        run: |
-          pnpm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          pnpm init --force
-          pnpm install jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-  pnpm6:
-    name: 'pnpm6:jest example'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: 'Use Node.js 12.x'
-        uses: actions/setup-node@v2.1.5
-        with:
-          node-version: 12.x
-      - name: 'install latest pnpm'
-        run: sudo npm i pnpm@dev -g
-      - name: Install Dependencies
-        run: yarn install
-      - name: 'Run verdaccio in the background'
-        run: |
-          nohup node ./scripts/run-verdaccio.js &
-      - name: 'Ping to verdaccio'
-        run: |
-          pnpm ping --registry http://localhost:4873
-      - name: 'Running the integration test'
-        run: |
-          source scripts/e2e-setup-ci.sh
-          pnpm init --force
-          pnpm install jest --registry http://localhost:4873
-
-          echo "it('should pass', () => { expect(true).toBeTruthy(); });" | tee pass.test.js
-          yarn jest pass.test.js
-
-          yarn add left-pad --registry http://localhost:4873 --verbose
-          echo "const leftPad = require('left-pad'); it('should resolve a module', () => { expect(typeof leftPad).toBe('function');});" | tee module.test.js
-          yarn jest module.test.js
-
-

.prettierignore

@@ -27,3 +27,5 @@ test/functional/store/*
 storage_default_storage/*
 docker-examples/
 .prettierignore
+*.sh
+.secrets-baseline

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [4.12.1](https://github.com/verdaccio/verdaccio/compare/v4.12.0...v4.12.1) (2021-05-22)
+
+
+### Bug Fixes
+
+* emit warning for upgrade 5.x and publish on previous ([a760e68](https://github.com/verdaccio/verdaccio/commit/a760e6814d2f1e8e2385f11381ddc7212f6ed380))
+* update docker base 14.17.0 ([6870f99](https://github.com/verdaccio/verdaccio/commit/6870f990c464c9fc219c5550dd77e92651e4a600))
+
 ## [4.12.0](https://github.com/verdaccio/verdaccio/compare/v4.11.3...v4.12.0) (2021-03-17)
 
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} node:14.16.0-alpine as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} node:14.17.0-alpine as builder
 
 ENV NODE_ENV=production \
     VERDACCIO_BUILD_REGISTRY=https://registry.verdaccio.org
@@ -23,7 +23,7 @@ RUN yarn config set npmRegistryServer $VERDACCIO_BUILD_REGISTRY && \
 
 
 
-FROM node:14.16.0-alpine
+FROM node:14.17.0-alpine
 LABEL maintainer="https://github.com/verdaccio/verdaccio"
 
 ENV VERDACCIO_APPDIR=/opt/verdaccio \

README.md

@@ -4,6 +4,8 @@
 
 # Version 4
 
+⚠️ **Branch in mainteance mode, only security fix**
+
 [Verdaccio](https://verdaccio.org/) is a simple, **zero-config-required local private npm registry**.
 No need for an entire database just to get started! Verdaccio comes out of the box with
 **its own tiny database**, and the ability to proxy other registries (eg. npmjs.org),
@@ -34,7 +36,7 @@ Google Cloud Storage** or create your own plugin.
 Install with npm:
 
 ```bash
-npm install --global verdaccio
+npm install --global verdaccio@4.12.0
 ```
 
 ## Donations
@@ -134,13 +136,6 @@ This will prompt you for user credentials which will be saved on the `verdaccio`
 Below are the most commonly needed information,
 every aspect of Docker and verdaccio is [documented separately](https://www.verdaccio.org/docs/en/docker.html)
 
-
-```
-docker pull verdaccio/verdaccio
-```
-
-Available as [tags](https://hub.docker.com/r/verdaccio/verdaccio/tags/).
-
 ```
 docker pull verdaccio/verdaccio:4
 ```

package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "description": "A lightweight private npm proxy registry",
   "author": {
     "name": "Verdaccio Maintainers",

scripts/publish.sh

@@ -10,4 +10,4 @@ echo "Bumping version to new tag: ${lastTag}"
 echo "//$REGISTRY_URL/:_authToken=$REGISTRY_AUTH_TOKEN" > .npmrc
 
 # Publish to NPM
-npm publish --registry https://$REGISTRY_URL/
+npm publish --registry https://$REGISTRY_URL/ --tag previous

src/lib/cli.ts

@@ -13,21 +13,13 @@ import { parseConfigFile } from './utils';
 require('pkginfo')(module);
 
 if (process.getuid && process.getuid() === 0) {
-  global.console.warn(
-    bgYellow().red(
-      "*** WARNING: Verdaccio doesn't need superuser privileges. Don't run it under root! ***"
-    )
-  );
+  global.console.warn(bgYellow().red("*** WARNING: Verdaccio doesn't need superuser privileges. Don't run it under root! ***"));
 }
 
 const MIN_NODE_VERSION = '6.9.0';
 
 if (semver.satisfies(process.version, `>=${MIN_NODE_VERSION}`) === false) {
-  global.console.error(
-    bgRed(
-      `Verdaccio requires at least Node.js ${MIN_NODE_VERSION} or higher, please upgrade your Node.js distribution`
-    )
-  );
+  global.console.error(bgRed(`Verdaccio requires at least Node.js ${MIN_NODE_VERSION} or higher, please upgrade your Node.js distribution`));
   process.exit(1);
 }
 
@@ -67,20 +59,11 @@ function init() {
     }
 
     logger.logger.warn({ file: configPathLocation }, 'config file  - @{file}');
-
-    startVerdaccio(
-      verdaccioConfiguration,
-      cliListener,
-      configPathLocation,
-      pkgVersion,
-      pkgName,
-      listenDefaultCallback
-    );
+    process.emitWarning(`verdaccio 4.x is deprecated and won't longer receive security support, please
+    update to 5.x or higher`);
+    startVerdaccio(verdaccioConfiguration, cliListener, configPathLocation, pkgVersion, pkgName, listenDefaultCallback);
   } catch (err) {
-    logger.logger.fatal(
-      { file: configPathLocation, err: err },
-      'cannot open config file @{file}: @{!err.message}'
-    );
+    logger.logger.fatal({ file: configPathLocation, err: err }, 'cannot open config file @{file}: @{!err.message}');
     process.exit(1);
   }
 }
@@ -94,7 +77,7 @@ if (commander.info) {
       Binaries: ['Node', 'Yarn', 'npm'],
       Virtualization: ['Docker'],
       Browsers: ['Chrome', 'Edge', 'Firefox', 'Safari'],
-      npmGlobalPackages: ['verdaccio']
+      npmGlobalPackages: ['verdaccio'],
     });
     // eslint-disable-next-line no-console
     console.log(data);
@@ -113,7 +96,7 @@ if (commander.info) {
 process.on('uncaughtException', function (err) {
   logger.logger.fatal(
     {
-      err: err
+      err: err,
     },
     'uncaught exception, please report this\n@{err.stack}'
   );