chore: update versions (next-8) (#5102)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.changeset/blue-paws-cheer.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/server': patch
+'@verdaccio/middleware': patch
+'@verdaccio/core': patch
+---
+
+chore: request header constants

.changeset/breezy-geckos-search.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/tarball': patch
+'@verdaccio/core': patch
+'@verdaccio/utils': patch
+'@verdaccio/middleware': patch
+'@verdaccio/store': patch
+---
+
+chore: move tarball utils to core

.changeset/bright-bobcats-ring.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui): sort versions

.changeset/brown-planets-approve.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/config': patch
+'@verdaccio/types': patch
+'@verdaccio/website': patch
+---
+
+chore: `keep_readmes` docs

.changeset/clean-beds-wash.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/logger-commons': patch
+---
+
+chore(logger): avoid message if level remains the same

.changeset/clever-bees-happen.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/proxy': patch
+---
+
+chore: move agent_options to config

.changeset/config.json

@@ -12,6 +12,25 @@
       "@verdaccio/ui-theme"
     ]
   ],
+  "ignoredPackages": [
+    "docusaurus-plugin-downloads",
+    "docusaurus-plugin-contributors",
+    "@verdaccio/test-cli-commons",
+    "@verdaccio/local-scripts",
+    "@verdaccio/e2e-cli-npm6",
+    "@verdaccio/e2e-cli-npm7",
+    "@verdaccio/e2e-cli-npm8",
+    "@verdaccio/e2e-cli-npm9",
+    "@verdaccio/e2e-cli-npm10",
+    "@verdaccio/e2e-cli-npm-common",
+    "@verdaccio/e2e-cli-yarn1",
+    "@verdaccio/e2e-cli-yarn2",
+    "@verdaccio/e2e-cli-yarn3",
+    "@verdaccio/e2e-cli-yarn4",
+    "@verdaccio/e2e-cli-pnpm8",
+    "@verdaccio/e2e-cli-pnpm9",
+    "@verdaccio/e2e-cli-pnpm10"
+  ],
   "access": "public",
   "baseBranch": "master",
   "updateInternalDependencies": "patch"

.changeset/cool-seals-watch.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/loaders': patch
+'@verdaccio/config': patch
+---
+
+chore(loader): fix types for plugin options

.changeset/curvy-rockets-camp.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/core': patch
+---
+
+chore(core): typing, naming, and docs of parameters

.changeset/cyan-snakes-kiss.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/web': patch
+---
+
+chore(web): fix syntax of test files

.changeset/early-eyes-float.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/types': patch
+---
+
+chore: add `error` to log level enum

.changeset/eleven-rocks-dream.md

@@ -0,0 +1,5 @@
+---
+'verdaccio': patch
+---
+
+chore: bump user agent

.changeset/fifty-falcons-design.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+fix(middleware): allow content-type with charset

.changeset/gentle-stingrays-repeat.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/store': patch
+---
+
+fix: code scan issues

.changeset/gold-squids-watch.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/server': patch
+'@verdaccio/store': patch
+'@verdaccio/auth': patch
+'@verdaccio/web': patch
+---
+
+chore: add info to log when audit, htpasswd, theme are used

.changeset/green-eagles-boil.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+---
+
+fix: E409 username is already registered (adduser)

.changeset/healthy-ducks-drive.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/config': patch
+---
+
+chore: fix typedocs warnings

.changeset/healthy-zoos-lie.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/store': patch
+---
+
+chore: add info to log when local storage is used

.changeset/hip-eggs-serve.md

@@ -0,0 +1,5 @@
+---
+'verdaccio-htpasswd': patch
+---
+
+chore: add debug code to htpasswd package

.changeset/hot-crews-live.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/core': patch
+'verdaccio': patch
+'@verdaccio/store': patch
+'@verdaccio/api': patch
+---
+
+fix: unpublish a package on storage package

.changeset/long-singers-drive.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/ui-theme': patch
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): vitest follow-ups

.changeset/lucky-crabs-enjoy.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/api': patch
+'@verdaccio/core': patch
+'@verdaccio/middleware': patch
+'@verdaccio/proxy': patch
+---
+
+fix(middleware): error 404 when getting scoped tarballs

.changeset/nine-countries-remember.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+fix(middleware): encoding of scope package name

.changeset/ninety-geese-do.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/config': patch
+---
+
+fix: runtime dependency missing as explicit dependency

.changeset/pre.json

@@ -49,13 +49,65 @@
     "generator-verdaccio-plugin": "5.0.0",
     "@verdaccio/test-helper": "3.0.0",
     "@verdaccio/local-publish": "0.0.2",
-    "@verdaccio/crowdin-translations": "1.0.0",
+    "@verdaccio/local-scripts": "1.0.0",
     "customprefix-auth": "2.0.0",
     "@verdaccio/ui-components": "3.0.0",
     "@verdaccio/utils": "7.0.0",
     "verdaccio": "7.0.0",
     "@verdaccio/web": "7.0.0",
-    "@verdaccio/website": "6.0.0"
+    "@verdaccio/website": "6.0.0",
+    "@verdaccio/e2e-cli-npm-common": "1.0.0",
+    "@verdaccio/e2e-cli-pnpm-common": "1.0.2-next-8.0",
+    "@verdaccio/e2e-cli-pnpm10": "1.0.0",
+    "docusaurus-plugin-downloads": "2.0.0"
   },
-  "changesets": ["angry-doors-tan", "beige-lions-type", "chatty-apricots-report", "long-eyes-drum"]
+  "changesets": [
+    "angry-doors-tan",
+    "beige-lions-type",
+    "blue-paws-cheer",
+    "breezy-geckos-search",
+    "bright-bobcats-ring",
+    "brown-planets-approve",
+    "chatty-apricots-report",
+    "clean-beds-wash",
+    "clever-bees-happen",
+    "cool-seals-watch",
+    "curvy-rockets-camp",
+    "cyan-snakes-kiss",
+    "early-eyes-float",
+    "eleven-rocks-dream",
+    "fifty-falcons-design",
+    "gentle-stingrays-repeat",
+    "gold-squids-watch",
+    "green-eagles-boil",
+    "healthy-ducks-drive",
+    "healthy-zoos-lie",
+    "hip-eggs-serve",
+    "hot-crews-live",
+    "long-eyes-drum",
+    "long-singers-drive",
+    "lucky-crabs-enjoy",
+    "nine-countries-remember",
+    "ninety-geese-do",
+    "quick-seas-deny",
+    "real-seahorses-change",
+    "rotten-melons-notice",
+    "rotton-readers-shave",
+    "rude-birds-design",
+    "rude-socks-walk",
+    "serious-apes-rule",
+    "short-mails-smoke",
+    "silent-bags-listen",
+    "silent-tips-admire",
+    "silver-houses-remain",
+    "slow-cars-guess",
+    "smooth-games-share",
+    "strange-pants-chew",
+    "stupid-camels-build",
+    "sweet-crabs-deliver",
+    "thirty-comics-trade",
+    "tricky-impalas-shake",
+    "violet-boxes-float",
+    "weak-cherries-serve"
+  ]
 }

.changeset/quick-seas-deny.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/loaders': minor
+---
+
+chore: remove logger as dependency

.changeset/real-seahorses-change.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': minor
+---
+
+update hover background color of package list

.changeset/rotten-melons-notice.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+chore(middleware): fix syntax of test files

.changeset/rotton-readers-shave.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/config': patch
+---
+
+fix: config builder `addLogger`

.changeset/rude-birds-design.md

@@ -0,0 +1,5 @@
+---
+'verdaccio': patch
+---
+
+chore: encode parts of URL

.changeset/rude-socks-walk.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/store': patch
+---
+
+feat: keep_readmes option when publishing packages

.changeset/serious-apes-rule.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): replace react-json-view

.changeset/short-mails-smoke.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(deps): upgrade storybook to v8

.changeset/silent-bags-listen.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/logger-commons': patch
+'@verdaccio/local-storage': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/core': patch
+'verdaccio': patch
+---
+
+chore(tests): temp folder naming

.changeset/silent-tips-admire.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/middleware': patch
+'@verdaccio/web': patch
+---
+
+chore: export and constant on middleware

.changeset/silver-houses-remain.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix: ui-component vitest api

.changeset/slow-cars-guess.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': minor
+---
+
+support packages with multiple module types

.changeset/smooth-games-share.md

@@ -0,0 +1,11 @@
+---
+'@verdaccio/server': patch
+'verdaccio-audit': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/middleware': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+'@verdaccio/web': patch
+---
+
+fix: crashes with path-to-regexp v0.1.12 express

.changeset/strange-pants-chew.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/web': patch
+---
+
+feat: show version-specific readmes in web ui

.changeset/stupid-camels-build.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/api': patch
+---
+
+chore(api): fix void return for some tests

.changeset/sweet-crabs-deliver.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): typing for Theme

.changeset/thirty-comics-trade.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/local-storage': patch
+---
+
+chore: local storage debug messages

.changeset/tricky-impalas-shake.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/store': patch
+---
+
+chore: tweak error logging messages

.changeset/violet-boxes-float.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/store': patch
+'@verdaccio/tarball': patch
+---
+
+fix(api): add logging when requesting tarball

.changeset/weak-cherries-serve.md

@@ -0,0 +1,18 @@
+---
+'@verdaccio/logger-commons': patch
+'@verdaccio/file-locking': patch
+'@verdaccio/ui-theme': patch
+'@verdaccio/search-indexer': patch
+'@verdaccio/server': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/middleware': patch
+'verdaccio': patch
+'@verdaccio/node-api': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+'@verdaccio/cli': patch
+'@verdaccio/web': patch
+---
+
+chore: auth package requires logger as parameter

.github/actions/build-app/action.yml

@@ -0,0 +1,22 @@
+name: 'Build app'
+description: 'build verdaccio application'
+
+inputs:
+  registry-url:
+    description: 'Registry URL for pnpm'
+    required: false
+    default: 'http://localhost:4873'
+  node-version:
+    description: 'Node.js version to use'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+      uses: ./.github/actions/install-app-node
+      with:
+        node-version: ${{ inputs.node_version }}
+    - name: build
+      run: pnpm build
+      shell: bash

.github/actions/cache-packages/action.yml

@@ -0,0 +1,12 @@
+name: 'Cache packages'
+description: 'get or set cache packages'
+
+runs:
+  using: composite
+  steps:
+    - name: Cache Packages
+      id: cache-packages
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      with:
+        path: ./packages/
+        key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}

.github/actions/cache-store/action.yml

@@ -0,0 +1,15 @@
+name: 'Cache build'
+description: 'get or set cache build'
+
+runs:
+  using: composite
+  steps:
+    - name: Cache .pnpm-store
+      id: cache-npm
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      with:
+        path: ~/.pnpm-store
+        key: pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ github.event.pull_request.number }}-${{ runner.os }}
+        restore-keys: |
+          pnpm-
+

.github/actions/install-app-node/action.yml

@@ -0,0 +1,51 @@
+name: 'Install app with Node specific version'
+description: 'install application'
+
+inputs:
+  registry-url:
+    description: 'Registry URL for pnpm'
+    required: false
+    default: 'http://localhost:4873'
+  reporter:
+    description: 'Reporter for pnpm'
+    required: false
+    default: 'silent'
+  loglevel:
+    description: 'Log level for pnpm'
+    required: false
+    default: 'error'
+  node-version:
+    description: 'Node.js version to use'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Use Node
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+      with:
+        node-version: ${{ inputs.node-version }}
+    - name: Install pnpm
+      run: |
+        npm install --global corepack@latest
+        corepack enable
+        corepack prepare
+      shell: bash
+    - name: set store
+      run: |
+        if [ ! -d "$HOME/.pnpm-store" ]; then
+          mkdir -p $HOME/.pnpm-store
+          pnpm config set store-dir $HOME/.pnpm-store
+        else
+          echo "Store directory already exists. Skipping configuration."
+        fi
+      shell: bash
+    - name: Restore cache pnpm store
+      uses: ./.github/actions/cache-store
+    - name: Install
+      run: pnpm install --reporter=${{inputs.reporter}} --ignore-scripts --registry ${{ inputs.registry-url }} --loglevel=${{ inputs.loglevel }}
+      shell: bash
+    - name: Save cache pnpm store
+      if: steps.cache-npm.outputs.cache-hit == 'false'
+      uses: ./.github/actions/cache-store
+

.github/actions/install-app/action.yml

@@ -0,0 +1,40 @@
+name: 'Install app'
+description: 'install application'
+
+inputs:
+  registry-url:
+    description: 'Registry URL for pnpm'
+    required: false
+    default: 'http://localhost:4873'
+  reporter:
+    description: 'Reporter for pnpm'
+    required: false
+    default: 'silent'
+
+runs:
+  using: composite
+  steps:
+    - name: Use Node
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+      with:
+        node-version-file: '.nvmrc'
+    - name: Install pnpm
+      run: |
+        npm install --global corepack@latest
+        corepack enable
+        corepack prepare
+      shell: bash
+    - name: set store
+      run: |
+        mkdir ~/.pnpm-store
+        pnpm config set store-dir ~/.pnpm-store
+      shell: bash
+    - name: Restore cache pnpm store
+      uses: ./.github/actions/cache-store
+    - name: Install
+      run: pnpm install --reporter=${{inputs.reporter}} --ignore-scripts --registry ${{ inputs.registry-url }}
+      shell: bash
+    - name: Save cache pnpm store
+      if: steps.cache-npm.outputs.cache-hit == 'false'
+      uses: ./.github/actions/cache-store
+

.github/disabled/ci-windows.yml

@@ -25,6 +25,7 @@ jobs:
         node-version-file: '.nvmrc'
     - name: Install pnpm
       run: |
+        npm install --global corepack@latest
         corepack enable
         corepack install
     - name: set store

.github/workflows/changesets.yml

@@ -20,12 +20,12 @@ jobs:
     if: github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio'
     steps:
       - name: checkout code repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: setup node.js
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
         env:
@@ -33,6 +33,7 @@ jobs:
 
       - name: Install pnpm
         run: |
+          npm install --global corepack@latest
           corepack enable
           corepack install
 

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ permissions:
   contents: read
 concurrency:
   group: ci-${{ github.ref }}
-  cancel-in-progress: true  
+  cancel-in-progress: true
 
 jobs:
   prepare:
@@ -24,57 +24,30 @@ jobs:
     name: setup verdaccio
     services:
       verdaccio:
-        image: verdaccio/verdaccio:5
+        image: verdaccio/verdaccio:6
         ports:
           - 4873:4873
         env:
           NODE_ENV: production
+          options: >-
+            --health-cmd="curl -f http://0.0.0.0:4873/-/ping || exit 1"
+            --health-interval=10s   
+            --health-timeout=20s    
+            --health-retries=6
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
-        with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack install
-      - name: set store
-        run: |
-          mkdir ~/.pnpm-store
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install  --registry http://localhost:4873
-      - name: Cache .pnpm-store
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
   lint:
     runs-on: ubuntu-latest
     name: Lint
     needs: prepare
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
         with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack install
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --ignore-scripts
+            reporter: 'default'
       - name: Lint
         run: pnpm lint
   format:
@@ -82,24 +55,11 @@ jobs:
     name: Format
     needs: prepare
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Use Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
         with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack install
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --ignore-scripts
+          reporter: 'default'
       - name: Lint
         run: pnpm format:check
   test:
@@ -108,30 +68,15 @@ jobs:
       fail-fast: true
       matrix:
         os: [ubuntu-latest]
-        node_version: [18, 20, 21, 22]
+        node_version: [18, 20, 21, 22, 23]
     name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Build application with Node ${{ matrix.node_version }}
+        uses: ./.github/actions/build-app
         with:
           node-version: ${{ matrix.node_version }}
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --ignore-scripts --registry http://localhost:4873
-      - name: build
-        run: pnpm build
       - name: Test
         run: pnpm test
   sync-translations:
@@ -140,15 +85,16 @@ jobs:
     name: synchronize translations
     if: (github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio') || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: |
+          npm install --global corepack@latest
           corepack enable
           corepack install
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/codeql-analysis.yml

@@ -1,6 +1,10 @@
-name: 'Code scanning - action'
+name: 'CodeQL Analysis'
 
 on:
+  push:
+    paths:
+      - .github/workflows/codeql-analysis.yml
+      - 'packages/**'
   pull_request:
     paths:
       - .github/workflows/codeql-analysis.yml
@@ -13,7 +17,7 @@ permissions:
 
 concurrency:
   group: code-${{ github.ref }}
-  cancel-in-progress: true    
+  cancel-in-progress: true
 
 jobs:
   CodeQL-Build:
@@ -25,20 +29,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
           fetch-depth: 2
 
-      # If this run was triggered by a pull request event, then checkout
-      # the head of the pull request instead of the merge commit.
-      - run: git checkout HEAD^2
-        if: ${{ github.event_name == 'pull_request' }}
-
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@be8b74c09c1778bcdbea38e1a45efea2cb73e18c # v2
+        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+        with:
+          config: |
+            paths-ignore:
+              - packages/config/test/partials/config/js/invalid.js
+              - packages/middleware/test/static/js
 
       # Override language selection by uncommenting this and choosing your languages
       # with:
@@ -46,7 +50,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@be8b74c09c1778bcdbea38e1a45efea2cb73e18c # v2
+        uses: github/codeql-action/autobuild@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -60,4 +64,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@be8b74c09c1778bcdbea38e1a45efea2cb73e18c # v2
+        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8

.github/workflows/docker-proxy-apache-e2e.yml

@@ -15,18 +15,18 @@ on:
 jobs:
   docker:
     timeout-minutes: 10
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
     - name: Checkout
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       
     - name: Start containers
       run: docker compose -f "./e2e/docker/apache-verdaccio/docker-compose.yaml" up -d --build
 
     - name: Install node
-      uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
       with:
         node-version-file: '.nvmrc'
     - name: npm setup

.github/workflows/docker-proxy-nginx-e2e.yml

@@ -13,18 +13,18 @@ on:
 jobs:
   docker:
     timeout-minutes: 10
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
     - name: Checkout
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       
     - name: Start containers
       run: docker compose -f "./e2e/docker/proxy-nginx/docker-compose.yaml" up -d --build
 
     - name: Install node
-      uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
       with:
         node-version-file: '.nvmrc'
     - name: npm setup

.github/workflows/docker-publish.yml

@@ -24,8 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # tag=v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
       - uses: docker/setup-buildx-action@v1
         with:
           driver-opts: network=host

.github/workflows/e2e-ci.yml

@@ -18,72 +18,24 @@ jobs:
         env:
           NODE_ENV: production
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Use Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
-        with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare 
-      - name: set store
-        run: |
-          mkdir ~/.pnpm-store
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --reporter=silence --ignore-scripts --registry http://localhost:4873
-      - name: Cache .pnpm-store
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-          restore-keys: |
-            pnpm-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
   build:
     needs: [prepare]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Use Node 16
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Build application with Node ${{ matrix.node_version }}
+        uses: ./.github/actions/build-app
         with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare 
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm recursive install --reporter=silence --registry http://localhost:4873
-      - name: build
-        run: pnpm build
+          node-version: ${{ matrix.node_version }}
       - name: Cache packages
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        id: cache-packages
-        with:
-          path: ./packages/
-          key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-          restore-keys: |
-            packages-
-      # - name: Cache test
-      #   uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
-      #   id: cache-test
-      #   with:
-      #     path: ./e2e/
-      #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      #     restore-keys: |
-      #       test-
+        uses: ./.github/actions/cache-packages
   e2e-cli-npm:
     needs: [prepare, build]
     strategy:
-      fail-fast: false      
+      fail-fast: false
       matrix:
         pkg:
           [
@@ -93,37 +45,19 @@ jobs:
             npm9,
             npm10
           ]
-        node: [20, 21]
+        node: [18, 23]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+        uses: ./.github/actions/install-app-node
         with:
-          node-version: ${{ matrix.node }}
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare 
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --offline --reporter=silence --ignore-scripts --registry http://localhost:4873
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ./packages/
-          key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      # - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
-      #   with:
-      #     path: ./e2e/
-      #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: build e2e
-        run: pnpm --filter @verdaccio/test-cli-commons build
+          node-version: ${{ inputs.node_version }}
+          reporter: 'default'
+          loglevel: 'debug'
+      - name: Restore cache pnpm store
+        uses: ./.github/actions/cache-packages
       - name: Test CLI
         run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
 
@@ -136,38 +70,21 @@ jobs:
           [
             pnpm8,
             pnpm9,
+            pnpm10,
           ]
-        node: [20, 21]
+        node: [18, 23]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+        uses: ./.github/actions/install-app-node
         with:
-          node-version: ${{ matrix.node }}
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --loglevel debug --ignore-scripts --registry http://localhost:4873
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ./packages/
-          key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      # - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
-      #   with:
-      #     path: ./e2e/
-      #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: build e2e
-        run: pnpm --filter @verdaccio/test-cli-commons build
+          node-version: ${{ inputs.node_version }}
+          reporter: 'default'
+          loglevel: 'debug'
+      - name: Restore cache pnpm store
+        uses: ./.github/actions/cache-packages
       - name: Test CLI
         run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
   e2e-cli-yarn:
@@ -176,43 +93,25 @@ jobs:
       fail-fast: false
       matrix:
         pkg:
-          [           
+          [
             yarn1,
             yarn2,
             yarn3,
             yarn4
           ]
-        node: [20, 21]
+        node: [18, 23]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry version ${{ inputs.node-version }}
+        uses: ./.github/actions/install-app-node
         with:
-          node-version: ${{ matrix.node }}
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare 
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: set store
-        run: |
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install --offline --reporter=silence --ignore-scripts --registry http://localhost:4873
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ./packages/
-          key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      # - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
-      #   with:
-      #     path: ./e2e/
-      #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
-      - name: build e2e
-        run: pnpm --filter @verdaccio/test-cli-commons build
+          node-version: ${{ inputs.node_version }}
+          reporter: 'default'
+          loglevel: 'debug'
+      - name: Restore cache pnpm store
+        uses: ./.github/actions/cache-packages
       - name: Test CLI
         run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
-      
+

.github/workflows/e2e-ui.yml

@@ -1,39 +1,32 @@
 name: E2E UI
 
 on: [pull_request]
+
 permissions:
   contents: read
 concurrency:
   group: e2e-ui-${{ github.ref }}
-  cancel-in-progress: true  
+  cancel-in-progress: true
 jobs:
   test:
     runs-on: ubuntu-latest
     name: UI Test E2E
     services:
       verdaccio:
-        image: verdaccio/verdaccio:5
+        image: verdaccio/verdaccio:6
         ports:
           - 4873:4873
         env:
           NODE_ENV: production
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Use Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Build application with Node 20
+        uses: ./.github/actions/build-app
         with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack prepare
-      - name: Install
-        run: pnpm install --reporter=silence --registry http://localhost:4873
-      - name: build
-        run: pnpm build
+          node-version: 20
       - name: Test UI
         run: pnpm test:e2e:ui
-      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
+      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: videos
           path: /home/runner/work/verdaccio/verdaccio/e2e/ui/cypress/videos

.github/workflows/plugin-generator-e2e.yaml

@@ -1,40 +1,28 @@
 name: E2E Generator Verdaccio Plugin
 
 on:
-  pull_request:
+#  pull_request:
   workflow_dispatch:
-  push:
-    branches:
-      - 'master'
+#  push:
+#    branches:
+#      - 'master'
 
 concurrency:
   group: generator-plugin-${{ github.ref }}
-  cancel-in-progress: true  
+  cancel-in-progress: true
 
 jobs:
   e2e-plugin-generator:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [18,20, 21]
+        node-version: [20, 22, 23]
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Build application with Node ${{ matrix.node_version }}
+        uses: ./.github/actions/build-app
         with:
-          node-version: ${{ matrix.node-version }}
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack install
-      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: install
-        run: pnpm install
-      - name: build
-        run: pnpm build
+          node-version: ${{ matrix.node_version }}
       - name: install verdaccio
         run: npm install -g verdaccio@5
       - name: Start server
@@ -49,4 +37,4 @@ jobs:
         run: npm install -g yo@4 --loglevel=info
       - name: install generator
         run: npm install -g generator-verdaccio-plugin --loglevel=info --registry http://localhost:4873
-# Future: add a test to verify the plugin is working with prompt 
+# Future: add a test to verify the plugin is working with prompt

.github/workflows/shared-docker-publish.yml

@@ -23,8 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # tag=v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
       - uses: docker/setup-buildx-action@v1
         with:
           driver-opts: network=host

.github/workflows/static-data.yml

@@ -3,9 +3,10 @@ name: static data
 
 on:
   workflow_dispatch:
+#  pull_request:
   schedule:
     # twice peer week
-    - cron: '0 0 * * 1,4'
+    - cron: "0 0 * * 1,4"
   # for now, scheduled, we can enable on push master but not make much sense now
   # push:
   #   branches:
@@ -20,19 +21,24 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
         with:
-          node-version: 18.x
-      - name: install pnpm
-        run: sudo npm i pnpm@latest-8 -g
-      - name: install dependencies
-        run: pnpm install
-      - name: Build Translations percentage
-        run: pnpm --filter @verdaccio/crowdin-translations build
+          reporter: 'default'
+      - name: Build package
+        run: pnpm --filter @verdaccio/local-scripts run build
+      - name: Get npmjs downloads
+        run: pnpm --filter @verdaccio/local-scripts run downloads:npmjs
+      - name: Get docker downloads
+        run: pnpm --filter @verdaccio/local-scripts run pull:docker
+      - name: Get npmjs monhtly downloads
+        run: pnpm --filter @verdaccio/local-scripts run downloads:mounthly
+      - name: Get npmjs year downloads
+        run: pnpm --filter @verdaccio/local-scripts run downloads:yearly
       - name: update contributors
         run: pnpm run contributors
         env:
@@ -42,7 +48,7 @@ jobs:
       - name: update translations
         run: pnpm run translations
         env:
-          TOKEN: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}          
+          TOKEN: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
       - name: format
         run: pnpm format
       - name: Commit & Push changes

.github/workflows/test-docker-build.yml

@@ -6,7 +6,7 @@ jobs:
     name: Test Docker Build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Build
       run: docker build .
       env:

.github/workflows/test-publish-package.yml

@@ -6,7 +6,7 @@ jobs:
     name: Test Verdaccio Publish
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Publish
       uses: verdaccio/github-actions/publish@f2e0370cfa5d74d24c325017b701bfddc9cc2e5d # tag=v0.4.0
       with:

.github/workflows/ui-components.yml

@@ -1,9 +1,10 @@
 name: UI Components
 
 on:
+#  pull_request:
   workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *' 
+#  schedule:
+#    - cron: '0 0 * * *'
 
 permissions:
   contents: read  #  to fetch code (actions/checkout)
@@ -23,29 +24,18 @@ jobs:
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Use Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Cache pnpm modules
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        env:
-          cache-name: cache-pnpm-modules
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
 
       - name: Install pnpm
         run: |
+          npm install --global corepack@latest
           corepack enable
-            corepack prepare --activate pnpm@8.9.0
+          corepack install
       - name: Install
-        run: pnpm install  
+        run: pnpm install
       - name: Build storybook
         run: pnpm ui:storybook:build
       - name: Copy public content

.github/workflows/website.yml

@@ -2,7 +2,8 @@ name: Verdaccio Website CI
 
 on:
   workflow_dispatch:
-
+  schedule:
+    - cron: '0 2 * * 0'  # every Sunday at 2am UTC  (10pm EST)
 permissions:
   contents: read  #  to fetch code (actions/checkout)
 
@@ -22,7 +23,7 @@ jobs:
     name: setup verdaccio
     services:
       verdaccio:
-        image: verdaccio/verdaccio:5
+        image: verdaccio/verdaccio:6
         ports:
           - 4873:4873
         env:
@@ -30,35 +31,15 @@ jobs:
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-
-      - name: Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Build application with Node 20
+        uses: ./.github/actions/build-app
         with:
-          node-version-file: '.nvmrc'
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack install
-      - name: set store
-        run: |
-          mkdir ~/.pnpm-store
-          pnpm config set store-dir ~/.pnpm-store
-      - name: Install
-        run: pnpm install  --registry http://localhost:4873
-      - name: Cache .pnpm-store
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
-        with:
-          path: ~/.pnpm-store
-          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-
-      - name: Build
-        run: pnpm build
+          node-version: 20
       - name: Build Translations percentage
-        run: pnpm --filter @verdaccio/crowdin-translations build
+        run: pnpm --filter @verdaccio/local-scripts build
       - name: Cache Docusaurus Build
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: website/node_modules/.cache/webpack
           key: cache/webpack-${{github.ref}}-${{ hashFiles('**/pnpm-lock.yaml') }}

.github/workflows/x-e2e-angular-cli-workflow.yml

@@ -7,10 +7,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm'
@@ -44,10 +44,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 9'
@@ -80,10 +80,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 10'

.github/workflows/x-e2e-audit-workflow.yml

@@ -7,10 +7,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 10'

.github/workflows/x-e2e-gatsbyjs-cli-workflow.yml

@@ -7,10 +7,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install npm 9'
@@ -42,10 +42,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install npm 10'

.github/workflows/x-e2e-jest-workflow.yml

@@ -7,10 +7,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: Install Dependencies
@@ -38,10 +38,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: Install Dependencies
@@ -72,10 +72,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm'
@@ -105,10 +105,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 9'
@@ -138,10 +138,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 10'
@@ -171,10 +171,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest pnpm'
@@ -204,10 +204,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest pnpm'

.github/workflows/x-release-snapshot.yml

@@ -6,9 +6,9 @@ jobs:
     name: Release Snapshot
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Use Node (latest)
-      uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
       with:
         node-version-file: '.nvmrc'
     - name: Install
@@ -25,4 +25,4 @@ jobs:
       run: sh scripts/publish-prerelease.sh
       env:
         REGISTRY_AUTH_TOKEN: ${{ secrets.VERDACCIO_REGISTRY_TOKEN_CANARY }}
-        REGISTRY_URL: registry.verdaccio.org
+        REGISTRY_URL: rg.verdaccio.org

.github/workflows/x-release.yml

@@ -6,9 +6,9 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Use Node (latest)
-      uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
       with:
         node-version-file: '.nvmrc'
     - name: Install

.github/workflows/x-smok-test-docker.yml

@@ -16,7 +16,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: Docker test

.github/workflows/x-smok-test-module.yml

@@ -10,9 +10,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0    
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Use Node (latest)
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version-file: '.nvmrc'
       - name: Docker test

.github/workflows/yarn-ci-lint.yml

@@ -6,9 +6,9 @@ jobs:
     name: Node Lint
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Use Node 
-      uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
       with:
         node-version-file: '.nvmrc'
     - name: Install

.github/workflows/yarn-ci.yml

@@ -9,9 +9,9 @@ jobs:
     name: Node ${{ inputs.node_version }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Use Node ${{ inputs.node_version }}
-      uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
       with:
         node-version: ${{ inputs.node_version }}
     - name: Install

.gitignore

@@ -37,6 +37,8 @@ packages/plugins/ui-theme/static
 /packages/plugins/ui-theme/src/i18n/download_translations/
 !/packages/plugins/ui-theme/src/i18n/crowdin/ui.json
 
+## ui tests
+!/packages/ui-components/vitest/api/*.tgz
 
 # CI Pnpm cache
 .pnpm-store/

.npmignore

@@ -29,10 +29,6 @@ coverage/
 test-storage*
 test/
 __mocks__/
-jestEnvironment.js
-test/jest.e2e.config.js
-test/jest.config.functional.js
-jest.config.js
 
 # misc
 contrib/

.npmrc

@@ -1,2 +1 @@
-always-auth = true
 fetch-retries="10"

.nvmrc

@@ -1 +1 @@
-20
+22

CONTRIBUTING.md

@@ -25,7 +25,7 @@ The Verdaccio project is split into several areas, the first three hosted in the
 - **User Interface**: The [user Interface](https://github.com/verdaccio/ui) is based in **react** and **material-ui** and looking for front-end contributors.
 - **Kubernetes and Helm**: Ts the official repository for the [**Helm chart**](https://github.com/verdaccio/charts).
 
-> There are other areas to contribute, like [documentation](https://github.com/verdaccio/verdaccio/tree/master/website/docs) or [translations](#translations}).
+> There are other areas to contribute, like [documentation](https://github.com/verdaccio/verdaccio/tree/master/website/docs) or translations.
 
 ## Prepare local setup {#local-setup}
 
@@ -379,7 +379,7 @@ If you need help with how testing works, please [refer to the following guide
 **If you are introducing new features, you MUST include new tests. PRs for
 features without tests will not be merged.**
 
-## Translations {#translations}
+## Translations
 
 All translations are provided by the **[crowdin](http://crowdin.com)** platform,
 [https://translate.verdaccio.org/](https://translate.verdaccio.org/)

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} node:21-alpine AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} node:22-alpine AS builder
 
 ENV NODE_ENV=development \
     VERDACCIO_BUILD_REGISTRY=https://registry.npmjs.org
@@ -20,7 +20,7 @@ RUN npm -g i pnpm@8.9.0 && \
 # NODE_ENV=production pnpm install --frozen-lockfile --ignore-scripts
 # RUN pnpm install --prod --ignore-scripts
 
-FROM node:21-alpine
+FROM node:22-alpine
 LABEL maintainer="https://github.com/verdaccio/verdaccio"
 
 ENV VERDACCIO_APPDIR=/opt/verdaccio \

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Verdaccio contributors
+Copyright (c) 2025 Verdaccio contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -6,12 +6,11 @@
 
 ![verdaccio gif](https://cdn.verdaccio.dev/readme/readme-website.png)
 
-# Version Next (Development branch)
+# Version Next (Development Branch)
 
-> Looking for Verdaccio 6 version? Check the branch `6.x`
-> The plugins for the `v6.x` that are hosted within this organization are located
-> at the [`verdaccio/monorepo`](https://github.com/verdaccio/monorepo) repository, while for the `next` version
-> are hosted on this project `./packages/plugins`.
+> Looking for Verdaccio version 5 or 6? Version 6 is the latest version and successor to version 5. Version 6 requires Node.js 18 or higher and is maintained in the `6.x` branch.
+
+> The plugins for versions 5 and 6 are located at the [`verdaccio/monorepo`](https://github.com/verdaccio/monorepo) repository. Plugins for the `next-8` version are hosted in this project under the `./packages/plugins` folder.
 
 > Note that contributing guidelines might be different based on the branch.
 
@@ -36,6 +35,10 @@ Google Cloud Storage** or create your own plugin.
 [![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)
 [![StandWithUkraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
 
+## Versions
+
+You can find more details about the different versions of Verdaccio, minimum requirements, as well as links to associated npm packages and docker images in the [version history](VERSIONS.md).
+
 ## Install
 
 > Node.js v18 as minimum version required
@@ -43,19 +46,19 @@ Google Cloud Storage** or create your own plugin.
 Install with npm:
 
 ```bash
-npm install -g verdaccio@next
+npm install -g verdaccio@next-8
 ```
 
 With `yarn`
 
 ```bash
-yarn global add verdaccio@next
+yarn global add verdaccio@next-8
 ```
 
 With `pnpm`
 
 ```bash
-pnpm i -g verdaccio@next
+pnpm i -g verdaccio@next-8
 ```
 
 or
@@ -85,7 +88,7 @@ npm install -g generator-verdaccio-plugin
 
 Learn more [here](https://verdaccio.org/docs/dev-plugins) how to develop plugins. Share your plugins with the community.
 
-## Integration Tests
+## End to End Testing
 
 In our compatibility testing project, we're dedicated to ensuring that your favorite commands work seamlessly across different versions of npm, pnpm, and Yarn. From publishing packages to managing dependencies.
 Our goal is to give you the confidence to use your preferred package manager without any issues. So dive in, check out our matrix, and see how your commands fare across the board!
@@ -94,18 +97,28 @@ Our goal is to give you the confidence to use your preferred package manager wit
 
 ### Commands
 
-| cmd       | npm6 | npm7 | npm8 | npm9 | npm10 | pnpm8 | pnpm9 (beta) | yarn1 | yarn2 | yarn3 | yarn4 |
-| --------- | ---- | ---- | ---- | ---- | ----- | ----- | ------------ | ----- | ----- | ----- | ----- |
-| publish   | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ✅    | ✅    | ✅    | ✅    |
-| info      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ✅    | ✅    | ✅    | ✅    |
-| audit     | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ✅    | ✅    | ✅    | ❌    |
-| install   | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ✅    | ✅    | ✅    | ✅    |
-| deprecate | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ⛔    | ⛔    | ⛔    | ⛔    |
-| ping      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ⛔    | ⛔    | ⛔    | ⛔    |
-| search    | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ⛔    | ⛔    | ⛔    | ⛔    |
-| star      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ⛔    | ⛔    | ⛔    | ⛔    |
-| stars     | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ⛔    | ⛔    | ⛔    | ⛔    |
-| dist-tag  | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅           | ✅    | ❌    | ❌    | ❌    |
+| cmd       | npm6 | npm7 | npm8 | npm9 | npm10 | pnpm8 | pnpm9 | pnpm10 | yarn1 | yarn2 | yarn3 | yarn4 |
+| --------- | ---- | ---- | ---- | ---- | ----- | ----- | ----- | ------ | ----- | ----- | ----- | ----- |
+| publish   | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ✅    | ✅    | ✅    | ✅    |
+| unpublish | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ❌     | ❌    | ❌    | ❌    | ❌    |
+| info      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ✅    | ✅    | ✅    | ✅    |
+| audit     | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ✅    | ✅    | ✅    | ❌    |
+| install   | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ✅    | ✅    | ✅    | ✅    |
+| deprecate | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ⛔    | ⛔    | ⛔    | ⛔    |
+| ping      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ⛔    | ⛔    | ⛔    | ⛔    |
+| search    | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ⛔    | ⛔    | ⛔    | ⛔    |
+| star      | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ⛔    | ⛔    | ⛔    | ⛔    |
+| stars     | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ⛔    | ⛔    | ⛔    | ⛔    |
+| dist-tag  | ✅   | ✅   | ✅   | ✅   | ✅    | ✅    | ✅    | ✅     | ✅    | ❌    | ❌    | ❌    |
+
+> notes:
+>
+> - yarn search cmd exist in _modern_ but, it do not uses the search registry endpoint.
+> - yarn _modern_ has two info commands, the one used here is `yarn npm info`
+
+❌ = no tested
+✅ = tested
+⛔ = no supported
 
 ## Donations
 
@@ -286,12 +299,12 @@ Thanks to the following companies to help us to achieve our goals providing free
 | [Juan Picado](https://github.com/juanpicado)                                   | [Ayush Sharma](https://github.com/ayusharma)                             | [Sergio Hg](https://github.com/sergiohgz)                                 |
 | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | ------------------------------------------------------------------------- |
 | ![jotadeveloper](https://avatars3.githubusercontent.com/u/558752?s=120&v=4)    | ![ayusharma](https://avatars2.githubusercontent.com/u/6918450?s=120&v=4) | ![sergiohgz](https://avatars2.githubusercontent.com/u/14012309?s=120&v=4) |
-| [@jotadeveloper](https://twitter.com/jotadeveloper)                            | [@ayusharma\_](https://twitter.com/ayusharma_)                           | [@sergiohgz](https://twitter.com/sergiohgz)                               |
+|                                                                                | [@ayusharma\_](https://twitter.com/ayusharma_)                           | [@sergiohgz](https://twitter.com/sergiohgz)                               |
 | [Priscila Oliveria](https://github.com/priscilawebdev)                         | [Daniel Ruf](https://github.com/DanielRuf)                               |
 | ![priscilawebdev](https://avatars2.githubusercontent.com/u/29228205?s=120&v=4) | ![DanielRuf](https://avatars3.githubusercontent.com/u/827205?s=120&v=4)  |
 | [@priscilawebdev](https://twitter.com/priscilawebdev)                          | [@DanielRufde](https://twitter.com/DanielRufde)                          |
 
-You can find and chat with them over Discord, click [here](http://chat.verdaccio.org) or follow them at _Twitter_.
+You can find and chat with them over Discord, click [here](http://chat.verdaccio.org).
 
 ## Who is using Verdaccio?
 

SECURITY.md

@@ -2,15 +2,7 @@
 
 ## Supported versions
 
-The following table describes the versions of this project that are currently supported with security updates:
-
-| Version   | Supported          |
-| --------- | ------------------ |
-| 2.x       | :x:                |
-| 3.x       | :x:                |
-| 4.x       | :x:                |
-| 5.x       | :white_check_mark: |
-| 6.x alpha | :x:                |
+You can find details about the supported versions of Verdaccio in the [version history](https://github.com/verdaccio/verdaccio/blob/master/VERSIONS.md).
 
 ## Responsible disclosure security policy
 

VERSIONS.md

@@ -0,0 +1,42 @@
+# Versions
+
+The following table describes the versions of this project:
+
+| Version          | Supported          | Minimum Node.js | Branch | Npm Tag          | Docker Images           | Helm Charts | E2E Tests                                                          |
+| ---------------- | ------------------ | --------------- | ------ | ---------------- | ----------------------- | ----------- | ------------------------------------------------------------------ |
+| 4.x              | :x: (deprecated)   | 10              | 4.x    | latest-4         | 4, 4.x, 4.x.x, 4.x-next | 3.x         | ❌                                                                 |
+| 5.x previous     | :x: (deprecated)   | 14              | 5.x    | latest-5         | 5, 5.x, 5.x.x, 5.x-next | 4.0 - 4.18  | ❌                                                                 |
+| 6.x current      | :white_check_mark: | 18              | 6.x    | latest-6, latest | 6, 6.x, 6.x.x, 6.x-next | 4.19 - ...  | [e2e-tests/main](https://github.com/verdaccio/e2e-tests/tree/main) |
+| 7.x next         | :x:                | 18              | 7.x    | next-7           | 7.x-next                | n/a         | [e2e-tests/6.x](https://github.com/verdaccio/e2e-tests/tree/6.x)   |
+| 8.x experimental | :x:                | 18              | master | next-8           | nightly-master          | n/a         | master branch                                                      |
+
+## Migration Guide
+
+The migration from Verdaccio v5/v6 to v7 contains breaking changes. Refer to the priliminary [migration guide](https://github.com/verdaccio/verdaccio/blob/master/docs/migration-v5-to-v6.md) for more information.
+
+For migrations from older versions to v5/6 refer to the [v5 migration guide](https://verdaccio.org/blog/2021/04/14/verdaccio-5-migration-guide/).
+
+### Deprecated Versions
+
+Deprecated versions aren’t supported anymore and shouldn’t be used in production. They don’t get updates—including security fixes—and we don’t run E2E tests on them.
+Once the deprecation period is over, the source code will be archived and won’t be maintained anymore.
+
+We try to keep things as backward-compatible as possible, but sometimes deprecating old versions is necessary to keep the project moving forward.
+
+## Npm Registry
+
+The official Verdaccio npm packages are located at https://www.npmjs.com/package/verdaccio.
+
+## Docker Hub
+
+The official Verdaccio Docker Images are found at https://hub.docker.com/r/verdaccio/verdaccio.
+
+## Helms Charts
+
+The official Verdaccio Helm Charts are found at https://artifacthub.io/packages/helm/verdaccio/verdaccio.
+
+## E2E Tests
+
+The e2e test are set of basic test running on each release to ensure the basic functionality of Verdaccio. The tests are located at
+different branches, depending on the version. For versions `6.x` and `7.x` the tests are located at the [e2e-test](https://github.com/verdaccio/e2e-tests) and everything else on this repository.
+For more details what's being tested, please refer to the [readme file](https://github.com/verdaccio/verdaccio?tab=readme-ov-file#integration-tests) on this repository.

crowdin.yaml

@@ -15,5 +15,5 @@ files:
     ignore: [/website/docs/api/**/*]
   - source: /website/versioned_docs/**/*
     translation: /website/i18n/%locale%/docusaurus-plugin-content-docs/**/%original_file_name%
-    ignore: [/website/versioned_docs/version-5.x/api/**/*, /website/versioned_docs/version-6.x/api/**/*]
+    ignore: [/website/versioned_docs/version-6.x/api/**/*]
    

docs/env.variables.md

@@ -1,55 +0,0 @@
-# Environment variables
-
-A full list of available environment variables that allow override
-internal features.
-
-#### VERDACCIO_LEGACY_ALGORITHM
-
-Allows to define the specific algorithm for the token signature which by default is `aes-256-ctr`. The algorithm must be supported by `crypto.createCipheriv` and `crypto.createDecipheriv`.
-Read more here: https://nodejs.org/api/crypto.html#crypto_crypto_createcipheriv_algorithm_key_iv_options
-
-#### VERDACCIO_LEGACY_ENCRYPTION_KEY
-
-By default, the token stores in the database, but using this variable allows to get it from memory, the length must be 32 characters otherwise will throw an error.
-Read more here: https://nodejs.org/api/crypto.html#crypto_crypto_createcipheriv_algorithm_key_iv_options
-
-#### VERDACCIO_PUBLIC_URL
-
-Define a specific public url for your server, it overrules the `Host` and `X-Forwarded-Proto` header if a reverse proxy is being used, it takes in account the `url_prefix` if is defined.
-
-This is handy in such situations where a dynamic url is required.
-
-eg:
-
-```
-VERDACCIO_PUBLIC_URL='https://somedomain.org';
-url_prefix: '/my_prefix'
-
-// url -> https://somedomain.org/my_prefix/
-
-VERDACCIO_PUBLIC_URL='https://somedomain.org';
-url_prefix: '/'
-
-// url -> https://somedomain.org/
-
-VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix';
-url_prefix: '/second_prefix'
-
-// url -> https://somedomain.org/second_prefix/'
-```
-
-#### VERDACCIO_FORWARDED_PROTO
-
-The default header to identify the protocol is `X-Forwarded-Proto`, but there are some environments which [uses something different](https://github.com/verdaccio/verdaccio/issues/990), to change it use the variable `VERDACCIO_FORWARDED_PROTO`
-
-```
-$ VERDACCIO_FORWARDED_PROTO=CloudFront-Forwarded-Proto verdaccio --listen 5000
-```
-
-#### VERDACCIO_STORAGE_PATH
-
-By default, the storage is taken from config file, but using this variable allows to set it from environment variable.
-
-#### VERDACCIO_STORAGE_NAME
-
-The database name for `@verdaccio/local-storage` is by default `.verdaccio-db.json`, but this can be update by using this variable.

docs/migrations-guide.md

@@ -1,4 +1,4 @@
-# Migration Guide from Verdaccio 5 to Verdaccio 6
+# Migration Guide from Verdaccio v5 and v6 to Verdaccio v7
 
 Notes regarding breaking changes for next major release.
 
@@ -79,8 +79,15 @@ for more details.
 
 Introduce environment variables for legacy tokens.
 
-- `VERDACCIO_LEGACY_ALGORITHM`: Allows to define the specific algorithm for the token signature which by default is `aes-256-ctr`
-- `VERDACCIO_LEGACY_ENCRYPTION_KEY`: By default, the token stores in the database, but using this variable allows to get it from memory
+- `VERDACCIO_LEGACY_ALGORITHM`:
+
+  Allows to define the specific algorithm for the token signature which by default is `aes-256-ctr`. The algorithm must be supported by `crypto.createCipheriv` and `crypto.createDecipheriv`.
+
+- `VERDACCIO_LEGACY_ENCRYPTION_KEY`:
+
+  By default, the token are stored in the database, but using this variable allows to get tokens from memory. The length of the key must be 32 characters otherwise will throw an error.
+
+Read more on [nodejs.org](https://nodejs.org/api/crypto.html#crypto_crypto_createcipheriv_algorithm_key_iv_options).
 
 #### @verdaccio/commons-api migration
 

docs/plugins.md

@@ -1,3 +0,0 @@
-## Developing plugins
-
-TBA

docs/warnings.md

@@ -2,29 +2,44 @@
 
 ## VERWAR001
 
-Verdaccio doesn't need superuser privileges. Don't run it under root.
+`Verdaccio doesn't need superuser privileges. Don't run it under root.`
 
 ## VERWAR002
 
-logger is not defined
+`The configuration property "logs" has been deprecated, please rename to "log" for future compatibility`
 
 ## VERWAR003
 
-'rotating-file type is not longer supported, consider use [logrotate] instead'
+`rotating-file type is not longer supported, consider use [logrotate] instead`
 
 ## VERWAR004
 
-invalid address - xxxxxx, we expect a port (e.g. "4873"),
+`invalid address - %s, we expect a port (e.g. "4873"), host:port (e.g. "localhost:4873") or full url '(e.g. "http://localhost:4873/")`
+
+Learn more at https://verdaccio.org/docs/en/configuration#listen-port
+
+## VERWAR005
+
+`n/a`
+
+## VERWAR006
+
+`the auth plugin method "add_user" in the auth plugin is deprecated and will be removed in next major release, rename to "adduser"`
+
+## VERWAR007
+
+`the secret length is too long, it must be 32 characters long, please consider generate a new one`
+
+Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db
 
 ## VERDEP001
 
-'config.logs is deprecated, rename configuration to "config.log" in singular'
+> Changed to VERWAR002 (see above)
 
 ## VERDEP002
 
-> After version `verdaccio@6.0.0-6-next.38` this is not longer a warning and
-> will crash your application
+> After version `verdaccio@6.0.0-6-next.38` this is not longer a warning and will crash your application
 
 ## VERDEP003
 
-'multiple addresses will be deprecated in the next major, only use one'
+`multiple addresses will be deprecated in the next major, only use one`

e2e/cli/cli-commons/package.json

@@ -2,25 +2,21 @@
   "private": true,
   "name": "@verdaccio/test-cli-commons",
   "version": "2.0.0-next-8.0",
-  "main": "./build/index.js",
-  "types": "./build/index.d.ts",
+  "main": "src/index.ts",
   "devDependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.2",
-    "@verdaccio/core": "workspace:8.0.0-next-8.2",
-    "@verdaccio/types": "workspace:13.0.0-next-8.1",
-    "debug": "4.3.7",
+    "@verdaccio/config": "workspace:8.0.0-next-8.10",
+    "@verdaccio/core": "workspace:8.0.0-next-8.10",
+    "@verdaccio/types": "workspace:13.0.0-next-8.3",
+    "debug": "4.4.0",
     "fs-extra": "11.2.0",
     "get-port": "5.1.1",
     "got": "11.8.6",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "verdaccio": "workspace:8.0.0-next-8.2"
+    "verdaccio": "workspace:8.0.0-next-8.10"
   },
   "scripts": {
-    "test": "jest",
-    "type-check": "tsc --noEmit -p tsconfig.build.json",
-    "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
-    "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
-    "build": "pnpm run build:js && pnpm run build:types"
+    "test": "echo no test",
+    "build": "echo no build"
   }
 }

e2e/cli/cli-commons/src/npm-utils.ts

@@ -1,22 +1,31 @@
+import buildDebug from 'debug';
+
 import { addRegistry } from './utils';
 
+const debug = buildDebug('verdaccio:e2e:npm-utils');
 export async function bumbUp(cmd, tempFolder, registry) {
   await cmd({ cwd: tempFolder }, 'version', 'minor', ...addRegistry(registry.getRegistryUrl()));
 }
 
-export async function publish(cmd, tempFolder, pkgName, registry, arg: string[] = []) {
-  const resp = await cmd(
+export async function bumpUpPackage(cmd, tempFolder, pkgName, registry, arg: string[] = []) {
+  debug('bump up package %o', pkgName);
+  await cmd(
     { cwd: tempFolder },
-    'publish',
+    'version',
     ...arg,
-    '--json',
+    '--no--git-tag-version',
+    '--loglevel=info',
     ...addRegistry(registry.getRegistryUrl())
   );
-  const parsedBody = JSON.parse(resp.stdout as string);
-  expect(parsedBody.name).toEqual(pkgName);
+}
+
+export async function publish(cmd, tempFolder, pkgName, registry, arg: string[] = []) {
+  debug('publishing %o', pkgName);
+  await cmd({ cwd: tempFolder }, 'publish', ...arg, ...addRegistry(registry.getRegistryUrl()));
 }
 
 export async function getInfoVersions(cmd, pkgName, registry) {
+  debug('getting info %o', pkgName);
   const infoResp = await cmd(
     {},
     'info',
@@ -25,5 +34,6 @@ export async function getInfoVersions(cmd, pkgName, registry) {
     ...addRegistry(registry.getRegistryUrl())
   );
   const infoBody = JSON.parse(infoResp.stdout as string);
+  debug('info %o', infoBody);
   return infoBody;
 }

e2e/cli/cli-commons/src/process.ts

@@ -4,6 +4,7 @@ import buildDebug from 'debug';
 import { createInterface } from 'readline';
 
 const debug = buildDebug('verdaccio:e2e:process');
+const debugRead = buildDebug('verdaccio:e2e:line');
 
 export type ExecOutput = {
   stdout: string;
@@ -11,7 +12,7 @@ export type ExecOutput = {
 };
 
 export async function exec(options: SpawnOptions, cmd, args): Promise<ExecOutput> {
-  debug('start _exec %o %o %o', options, cmd, args);
+  debug('start _exec %o %o %o', options, cmd, args ? args.join(' ') : '');
   let stdout = '';
   let stderr;
   const env = options.env;
@@ -32,9 +33,17 @@ export async function exec(options: SpawnOptions, cmd, args): Promise<ExecOutput
 
   const childProcess = spawn(cmd, args, spawnOptions);
   if (childProcess.stdout) {
-    const rl = createInterface({ input: childProcess.stdout });
+    childProcess.stdout.on('data', (data) => {
+      debugRead('data %o', data.toString());
+    });
+    const rl = createInterface({
+      input: childProcess.stdout,
+      output: process.stdout,
+      terminal: false,
+    });
 
     rl.on('line', function (line) {
+      debugRead('line %o', line);
       stdout += line;
     });
   }
@@ -42,6 +51,7 @@ export async function exec(options: SpawnOptions, cmd, args): Promise<ExecOutput
   const err = new Error(`Running "${cmd} ${args.join(' ')}" returned error code `);
   return new Promise((resolve, reject) => {
     childProcess.on('exit', (error) => {
+      debugRead('exit %o', error);
       if (!error) {
         resolve({ stdout, stderr });
       } else {

e2e/cli/cli-commons/src/registry.ts

@@ -17,7 +17,7 @@ export type Setup = {
 const log =
   process.env.NODE_ENV === 'production'
     ? { type: 'stdout', format: 'json', level: 'warn' }
-    : { type: 'stdout', format: 'pretty', level: 'info' };
+    : { type: 'stdout', format: 'pretty', level: 'debug' };
 
 const defaultConfig = {
   ...getDefaultConfig(),

e2e/cli/cli-commons/src/utils.ts

@@ -1,9 +1,12 @@
+import buildDebug from 'debug';
 import fs from 'fs-extra';
 import { cp, readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 
 import { fileUtils } from '@verdaccio/core';
 
+const debug = buildDebug('verdaccio:e2e:utils');
+
 export function createProject(projectName: string) {
   const tempRootFolder = global.__namespace.getItem('dir-suite-root');
   const verdaccioInstall = join(tempRootFolder, projectName);
@@ -13,12 +16,14 @@ export function createProject(projectName: string) {
 }
 export function copyConfigFile(rootFolder, configTemplate): string {
   const configPath = join(rootFolder, 'config.yaml');
+  debug('copying config file %o', configPath);
   copyTo(join(__dirname, configTemplate), configPath);
 
   return configPath;
 }
 
 export async function createTempFolder(prefix: string) {
+  debug('creating temp folder %o', prefix);
   return fileUtils.createTempFolder(prefix);
 }
 
@@ -31,10 +36,12 @@ export function cleanUpTemp(tmpFolder) {
 }
 
 export function addRegistry(registryUrl) {
+  debug('adding registry %o', registryUrl);
   return ['--registry', registryUrl];
 }
 
 export function addNpmPrefix(installFolder) {
+  debug('adding prefix %o', installFolder);
   return ['--prefix', installFolder];
 }
 
@@ -50,6 +57,7 @@ export async function prepareYarnModernProject(
   registryDomain: string,
   yarnPath: string
 ) {
+  debug('preparing yarn project %o', projectName);
   const tempFolder = await createTempFolder(projectName);
   // FUTURE: native copy folder instead fs-extra
   fs.copySync(templatePath, tempFolder);
@@ -67,6 +75,7 @@ export const getPackageJSON = (
   dependencies = {},
   devDependencies = {}
 ) => {
+  debug('creating package.json %o', packageName);
   const json = {
     name: packageName,
     version,
@@ -103,6 +112,7 @@ export async function prepareGenericEmptyProject(
   dependencies: any = {},
   devDependencies: any = {}
 ) {
+  debug('preparing generic project %o', packageName);
   const getNPMrc = (port, token, registry) => `//localhost:${port}/:_authToken=${token}
   registry=${registry}`;
   const tempFolder = await createTempFolder('temp-folder');

e2e/cli/e2e-npm-commons/.eslintrc

@@ -0,0 +1,7 @@
+{
+  "rules": {
+    "no-console": 0,
+    "@typescript-eslint/no-var-requires": 0,
+    "@typescript-eslint/explicit-member-accessibility": 0
+  }
+}

e2e/cli/e2e-npm-commons/audit.ts

@@ -0,0 +1,45 @@
+import { afterAll, beforeAll, describe, expect, test } from 'vitest';
+
+import { addRegistry, initialSetup, prepareGenericEmptyProject } from '@verdaccio/test-cli-commons';
+
+export function runAudit(npm) {
+  describe('audit a package', () => {
+    let registry;
+
+    beforeAll(async () => {
+      const setup = await initialSetup();
+      registry = setup.registry;
+      await registry.init();
+    });
+
+    test.each([['verdaccio-memory', '@verdaccio/cli']])(
+      'should audit a package %s',
+      async (pkgName) => {
+        const { tempFolder } = await prepareGenericEmptyProject(
+          pkgName,
+          '1.0.0-patch',
+          registry.port,
+          registry.getToken(),
+          registry.getRegistryUrl(),
+          { jquery: '3.6.1' }
+        );
+        // install is required to create package lock file
+        await npm({ cwd: tempFolder }, 'install', ...addRegistry(registry.getRegistryUrl()));
+        const resp = await npm(
+          { cwd: tempFolder },
+          'audit',
+          '--json',
+          ...addRegistry(registry.getRegistryUrl())
+        );
+        const parsedBody = JSON.parse(resp.stdout as string);
+        expect(parsedBody.metadata).toBeDefined();
+        expect(parsedBody.auditReportVersion).toBeDefined();
+        expect(parsedBody.vulnerabilities).toBeDefined();
+      }
+    );
+
+    afterAll(async () => {
+      registry.stop();
+    });
+  });
+}

e2e/cli/e2e-npm-commons/deprecate.ts

@@ -0,0 +1,119 @@
+import { afterAll, beforeAll, describe, expect, test } from 'vitest';
+
+import {
+  addRegistry,
+  initialSetup,
+  npmUtils,
+  prepareGenericEmptyProject,
+} from '@verdaccio/test-cli-commons';
+
+export function runDeprecate(npm) {
+  describe('deprecate a package', () => {
+    let registry;
+
+    async function deprecate(tempFolder, packageVersion, registry, message) {
+      await npm(
+        { cwd: tempFolder },
+        'deprecate',
+        packageVersion,
+        message,
+        '--json',
+        ...addRegistry(registry.getRegistryUrl())
+      );
+    }
+
+    beforeAll(async () => {
+      const setup = await initialSetup();
+      registry = setup.registry;
+      await registry.init();
+    });
+
+    test.each([['@verdaccio/deprecated-1']])(
+      'should deprecate a single package %s',
+      async (pkgName) => {
+        const message = 'some message';
+        const { tempFolder } = await prepareGenericEmptyProject(
+          pkgName,
+          '1.0.0',
+          registry.port,
+          registry.getToken(),
+          registry.getRegistryUrl()
+        );
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        // deprecate one version
+        await deprecate(tempFolder, `${pkgName}@1.0.0`, registry, message);
+        // verify is deprecated
+        const infoBody = await npmUtils.getInfoVersions(npm, `${pkgName}`, registry);
+        expect(infoBody.name).toEqual(pkgName);
+        expect(infoBody.deprecated).toEqual(message);
+      }
+    );
+
+    test.each([['@verdaccio/deprecated-2']])(
+      'should un-deprecate a package %s',
+      async (pkgName) => {
+        const message = 'some message';
+        const { tempFolder } = await prepareGenericEmptyProject(
+          pkgName,
+          '1.0.0',
+          registry.port,
+          registry.getToken(),
+          registry.getRegistryUrl()
+        );
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        // deprecate one version
+        await deprecate(tempFolder, `${pkgName}@1.0.0`, registry, message);
+        // verify is deprecated
+        const infoBody = await npmUtils.getInfoVersions(npm, `${pkgName}`, registry);
+        expect(infoBody.deprecated).toEqual(message);
+        // empty string is same as undeprecate
+        await deprecate(tempFolder, `${pkgName}@1.0.0`, registry, '');
+        const infoBody2 = await npmUtils.getInfoVersions(npm, `${pkgName}`, registry);
+        expect(infoBody2.deprecated).toBeUndefined();
+      }
+    );
+
+    test.each([['@verdaccio/deprecated-3']])(
+      'should deprecate a multiple packages %s',
+      async (pkgName) => {
+        const message = 'some message';
+        const { tempFolder } = await prepareGenericEmptyProject(
+          pkgName,
+          '1.0.0',
+          registry.port,
+          registry.getToken(),
+          registry.getRegistryUrl()
+        );
+        // publish 1.0.0
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        // publish 1.1.0
+        await npmUtils.bumbUp(npm, tempFolder, registry);
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        // publish 1.2.0
+        await npmUtils.bumbUp(npm, tempFolder, registry);
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        // publish 1.3.0
+        await npmUtils.bumbUp(npm, tempFolder, registry);
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        // // deprecate all version
+        await deprecate(tempFolder, pkgName, registry, message);
+        // verify is deprecated
+        for (let v of ['1.0.0', '1.1.0', '1.2.0', '1.3.0']) {
+          const infoResp = await npmUtils.getInfoVersions(npm, `${pkgName}@${v}`, registry);
+          expect(infoResp.deprecated).toEqual(message);
+        }
+        // publish normal version
+        // publish 1.4.0
+        await npmUtils.bumbUp(npm, tempFolder, registry);
+        await npmUtils.publish(npm, tempFolder, pkgName, registry);
+        const infoResp = await npmUtils.getInfoVersions(npm, `${pkgName}@1.4.0`, registry);
+        // must be not deprecated
+        expect(infoResp.deprecated).toBeUndefined();
+      }
+    );
+
+    afterAll(async () => {
+      registry.stop();
+    });
+  });
+}