chore: update versions (next-8) (#5278)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.changeset/afraid-cars-sneeze.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/loaders': minor
+---
+
+feat(loader): support scoped plugins in plugin folder

.changeset/afraid-cheetahs-rule.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui): check token expiry on refresh/timer

.changeset/brave-ears-drive.md

@@ -0,0 +1,18 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/server': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/ui-components': patch
+'@verdaccio/tarball': patch
+'@verdaccio/types': patch
+'@verdaccio/middleware': patch
+'verdaccio': patch
+'@verdaccio/config': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+---
+
+chore(utils): replace @verdaccio/utils dependency with core

.changeset/breezy-toys-judge.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/server': patch
+---
+
+fix(server): web-enabled test

.changeset/bright-bobcats-ring.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui): sort versions

.changeset/brown-lions-talk.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/ui-theme': patch
+'@verdaccio/ui-components': patch
+---
+
+chore(deps): update webpack-dev-server to v5

.changeset/brown-planets-approve.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/config': patch
+'@verdaccio/types': patch
+'@verdaccio/website': patch
+---
+
+chore: `keep_readmes` docs

.changeset/calm-mangos-compare.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/store': patch
+---
+
+fix(store): internal error when checking manifest

.changeset/clean-rings-listen.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/ui-theme': minor
+'@verdaccio/ui-components': minor
+'@verdaccio/middleware': patch
+'@verdaccio/ui-i18n': patch
+---
+
+feat: web v1 login frontend (experimental)

.changeset/config.json

@@ -13,7 +13,11 @@
     ]
   ],
   "ignoredPackages": [
+    "@verdaccio/local-publish",
+    "docusaurus-plugin-downloads",
+    "docusaurus-plugin-contributors",
     "@verdaccio/test-cli-commons",
+    "@verdaccio/local-scripts",
     "@verdaccio/e2e-cli-npm6",
     "@verdaccio/e2e-cli-npm7",
     "@verdaccio/e2e-cli-npm8",

.changeset/curly-mirrors-smile.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+chore(middleware): improve loop detection

.changeset/dirty-countries-play.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): avoid ts error for Alerts

.changeset/early-trainers-grin.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/api': patch
+---
+
+chore(api): avoid double registration of JSON bodyParser

.changeset/eight-countries-think.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui): start storybook on windows

.changeset/eighty-apes-think.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/ui-theme': patch
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): update react-json-view

.changeset/eleven-rocks-dream.md

@@ -0,0 +1,5 @@
+---
+'verdaccio': patch
+---
+
+chore: bump user agent

.changeset/few-beds-itch.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/store': patch
+'@verdaccio/types': patch
+---
+
+chore(types): use "Person" instead of "Author"

.changeset/few-ears-deny.md

@@ -0,0 +1,13 @@
+---
+'@verdaccio/local-storage': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/middleware': patch
+'@verdaccio/core': patch
+'@verdaccio/config': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+'@verdaccio/api': patch
+'@verdaccio/web': patch
+---
+
+chore: cleanup utils

.changeset/forty-hounds-matter.md

@@ -0,0 +1,7 @@
+---
+'verdaccio': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+---
+
+fix: internal error for unpublished tarball

.changeset/four-buttons-remember.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/web': patch
+---
+
+chore(web): move utils to web package

.changeset/fresh-owls-hunt.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/config': patch
+---
+
+chore: expose config utils

.changeset/funny-fireants-tan.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/proxy': patch
+'@verdaccio/website': patch
+---
+
+fix(proxy): validate protocol of proxy settings

.changeset/gold-files-speak.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/config': patch
+'@verdaccio/search': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+---
+
+fix: uplink processing order

.changeset/great-candles-hang.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-theme': patch
+---
+
+chore(ui): minor app improvements

.changeset/hip-deers-join.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/core': patch
+---
+
+chore(core): http status codes

.changeset/hip-suns-jam.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/e2e-cli-npm10': patch
+---
+
+fix(e2e): name for npm10 test

.changeset/hungry-dolls-destroy.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/local-storage': patch
+---
+
+fix(local-storage): uncontrolled data used in path expression

.changeset/itchy-glasses-end.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/ui-theme': minor
+'@verdaccio/ui-components': minor
+'@verdaccio/ui-i18n': minor
+---
+
+feat: new i18n package for ui

.changeset/large-turkeys-change.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/auth': patch
+---
+
+feat: add legacyMergeConfigs as option

.changeset/loud-dingos-cough.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/e2e-cli-npm-common': patch
+---
+
+fix(e2e): test.each was not working as expected

.changeset/modern-llamas-know.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/website': patch
+---
+
+- Updated the docs to show how we can make AWS CodeArtifact work with Verdaccio
+- Added the example uplinks configuration

.changeset/nasty-cooks-watch.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/e2e-cli-npm11': patch
+'@verdaccio/e2e-cli-npm-common': patch
+---
+
+feat(e2e): add npm11

.changeset/nasty-experts-bow.md

@@ -0,0 +1,8 @@
+---
+'@verdaccio/server': patch
+'@verdaccio/types': patch
+'@verdaccio/middleware': patch
+'@verdaccio/ui-components': patch
+---
+
+chore(config): harmonize configuration options

.changeset/nice-garlics-tie.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/ui-theme': patch
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): flags import and minor updates

.changeset/nine-onions-talk.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui): search chips when showUplinks is false

.changeset/ninety-geese-do.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/config': patch
+---
+
+fix: runtime dependency missing as explicit dependency

.changeset/ninety-hotels-dance.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/core': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+---
+
+fix: handling for uplink timeouts

.changeset/odd-fishes-cry.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+fix(middleware): scoped package for allow checks

.changeset/old-clocks-destroy.md

@@ -0,0 +1,5 @@
+---
+'verdaccio-memory': patch
+---
+
+fix: memory plugin limit error message

.changeset/pink-jeans-lick.md

@@ -0,0 +1,42 @@
+---
+'generator-verdaccio-plugin': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/logger-commons': patch
+'@verdaccio/local-storage': patch
+'@verdaccio/local-publish': patch
+'@verdaccio/local-scripts': patch
+'@verdaccio/file-locking': patch
+'verdaccio-htpasswd': patch
+'@verdaccio/ui-theme': patch
+'verdaccio-memory': patch
+'@verdaccio/search-indexer': patch
+'@verdaccio/server': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/logger': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/ui-components': patch
+'@verdaccio/tarball': patch
+'@verdaccio/eslint-config': patch
+'@verdaccio/types': patch
+'@verdaccio/middleware': patch
+'@verdaccio/cli-standalone': patch
+'@verdaccio/core': patch
+'@verdaccio/ui-i18n': patch
+'@verdaccio/signature': patch
+'verdaccio': patch
+'@verdaccio/url': patch
+'@verdaccio/node-api': patch
+'@verdaccio/loaders': patch
+'@verdaccio/config': patch
+'@verdaccio/search': patch
+'@verdaccio/hooks': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+'@verdaccio/cli': patch
+'@verdaccio/web': patch
+---
+
+chore: package.json maintenance

.changeset/pink-pants-try.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/server': patch
+'@verdaccio/loaders': patch
+---
+
+fix(express): error loading middleware plugins

.changeset/poor-hats-smile.md

@@ -0,0 +1,9 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/middleware': patch
+'@verdaccio/core': patch
+'@verdaccio/config': patch
+'@verdaccio/api': patch
+---
+
+feat: web v1 login backend (experimental)

.changeset/poor-queens-shop.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/signature': patch
+'@verdaccio/config': patch
+---
+
+chore(signature): remove duplicate code

.changeset/popular-trees-grin.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui-components): remove test warnings

.changeset/pre.json

@@ -14,6 +14,7 @@
     "@verdaccio/e2e-cli-yarn3": "1.0.1",
     "@verdaccio/e2e-cli-yarn4": "1.0.1",
     "@verdaccio/e2e-ui": "2.0.0",
+    "@verdaccio/ui-i18n": "8.0.0",
     "@verdaccio/api": "7.0.0",
     "@verdaccio/auth": "7.0.0",
     "@verdaccio/cli": "7.0.0",
@@ -48,8 +49,7 @@
     "@verdaccio/eslint-config": "3.0.0",
     "generator-verdaccio-plugin": "5.0.0",
     "@verdaccio/test-helper": "3.0.0",
-    "@verdaccio/local-publish": "0.0.2",
-    "@verdaccio/crowdin-translations": "1.0.0",
+    "@verdaccio/local-scripts": "1.0.0",
     "customprefix-auth": "2.0.0",
     "@verdaccio/ui-components": "3.0.0",
     "@verdaccio/utils": "7.0.0",
@@ -58,45 +58,122 @@
     "@verdaccio/website": "6.0.0",
     "@verdaccio/e2e-cli-npm-common": "1.0.0",
     "@verdaccio/e2e-cli-pnpm-common": "1.0.2-next-8.0",
-    "@verdaccio/e2e-cli-pnpm10": "1.0.0"
+    "@verdaccio/e2e-cli-pnpm10": "1.0.0",
+    "docusaurus-plugin-downloads": "2.0.0",
+    "@verdaccio/local-publish": "0.0.2",
+    "@verdaccio/e2e-cli-npm10": "1.0.1",
+    "@verdaccio/e2e-cli-npm11": "1.0.2-next-8.0"
   },
   "changesets": [
+    "afraid-cars-sneeze",
+    "afraid-cheetahs-rule",
     "angry-doors-tan",
     "beige-lions-type",
     "blue-paws-cheer",
+    "brave-ears-drive",
     "breezy-geckos-search",
+    "breezy-toys-judge",
+    "bright-bobcats-ring",
+    "brown-lions-talk",
+    "brown-planets-approve",
+    "calm-mangos-compare",
     "chatty-apricots-report",
     "clean-beds-wash",
+    "clean-rings-listen",
     "clever-bees-happen",
     "cool-seals-watch",
+    "curly-mirrors-smile",
     "curvy-rockets-camp",
     "cyan-snakes-kiss",
+    "dirty-countries-play",
     "early-eyes-float",
+    "early-trainers-grin",
+    "eight-countries-think",
+    "eighty-apes-think",
+    "eleven-rocks-dream",
+    "few-beds-itch",
+    "few-ears-deny",
     "fifty-falcons-design",
+    "forty-hounds-matter",
+    "four-buttons-remember",
+    "fresh-owls-hunt",
+    "funny-fireants-tan",
     "gentle-stingrays-repeat",
+    "gold-files-speak",
     "gold-squids-watch",
+    "great-candles-hang",
     "green-eagles-boil",
     "healthy-ducks-drive",
     "healthy-zoos-lie",
+    "hip-deers-join",
     "hip-eggs-serve",
+    "hip-suns-jam",
     "hot-crews-live",
+    "hungry-dolls-destroy",
+    "itchy-glasses-end",
+    "large-turkeys-change",
     "long-eyes-drum",
     "long-singers-drive",
+    "loud-dingos-cough",
     "lucky-crabs-enjoy",
+    "modern-llamas-know",
+    "nasty-cooks-watch",
+    "nasty-experts-bow",
+    "nice-garlics-tie",
     "nine-countries-remember",
+    "nine-onions-talk",
+    "ninety-geese-do",
+    "ninety-hotels-dance",
+    "odd-fishes-cry",
+    "old-clocks-destroy",
+    "pink-jeans-lick",
+    "pink-pants-try",
+    "poor-hats-smile",
+    "poor-queens-shop",
+    "popular-trees-grin",
+    "proud-houses-switch",
+    "purple-planes-do",
+    "quick-avocados-type",
     "quick-seas-deny",
+    "real-balloons-travel",
+    "real-seahorses-change",
+    "red-dolls-repair",
     "rotten-melons-notice",
+    "rotton-readers-shave",
     "rude-birds-design",
     "rude-socks-walk",
     "serious-apes-rule",
+    "sharp-queens-rhyme",
+    "shiny-buttons-laugh",
+    "short-mails-smoke",
+    "short-turkeys-boil",
     "silent-bags-listen",
+    "silent-tips-admire",
+    "silver-houses-remain",
+    "silver-insects-train",
     "slow-cars-guess",
     "smooth-games-share",
+    "strange-pants-chew",
     "stupid-camels-build",
     "sweet-crabs-deliver",
+    "swift-knives-shop",
+    "swift-mangos-grab",
+    "swift-zebras-cheer",
+    "ten-jeans-approve",
+    "tender-buckets-smoke",
+    "thick-dolphins-rule",
     "thirty-comics-trade",
+    "tidy-socks-battle",
     "tricky-impalas-shake",
+    "tricky-knives-end",
+    "twelve-games-wonder",
+    "violet-baboons-beg",
+    "violet-bobcats-allow",
     "violet-boxes-float",
-    "weak-cherries-serve"
+    "weak-cherries-serve",
+    "wet-cats-behave",
+    "wicked-points-relate",
+    "wild-coins-lie",
+    "yellow-flies-sniff"
   ]
 }

.changeset/proud-houses-switch.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/web': patch
+---
+
+fix(web): anonymous user handling

.changeset/purple-planes-do.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui): format date distance test

.changeset/quick-avocados-type.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix(ui-components): typings for vitest/jest-dom

.changeset/real-balloons-travel.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/web': patch
+---
+
+fix: config web login default

.changeset/real-seahorses-change.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': minor
+---
+
+update hover background color of package list

.changeset/red-dolls-repair.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/loaders': patch
+---
+
+chore: debug messages in loader

.changeset/rotton-readers-shave.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/types': patch
+'@verdaccio/config': patch
+---
+
+fix: config builder `addLogger`

.changeset/sharp-queens-rhyme.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): avoid ts errors for CircularProgress

.changeset/shiny-buttons-laugh.md

@@ -0,0 +1,41 @@
+---
+'generator-verdaccio-plugin': patch
+'@verdaccio/logger-prettify': patch
+'@verdaccio/logger-commons': patch
+'@verdaccio/local-storage': patch
+'verdaccio-auth-memory': patch
+'@verdaccio/local-publish': patch
+'@verdaccio/local-scripts': patch
+'@verdaccio/file-locking': patch
+'verdaccio-htpasswd': patch
+'@verdaccio/ui-theme': patch
+'verdaccio-memory': patch
+'@verdaccio/search-indexer': patch
+'@verdaccio/server': patch
+'@verdaccio/server-fastify': patch
+'@verdaccio/logger': patch
+'verdaccio-audit': patch
+'@verdaccio/test-helper': patch
+'@verdaccio/ui-components': patch
+'@verdaccio/tarball': patch
+'@verdaccio/eslint-config': patch
+'@verdaccio/types': patch
+'@verdaccio/middleware': patch
+'@verdaccio/cli-standalone': patch
+'@verdaccio/core': patch
+'verdaccio': patch
+'@verdaccio/url': patch
+'@verdaccio/node-api': patch
+'@verdaccio/loaders': patch
+'@verdaccio/config': patch
+'@verdaccio/hooks': patch
+'@verdaccio/proxy': patch
+'@verdaccio/store': patch
+'@verdaccio/utils': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+'@verdaccio/cli': patch
+'@verdaccio/website': patch
+---
+
+chore: update readme badges and license files

.changeset/short-mails-smoke.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(deps): upgrade storybook to v8

.changeset/short-turkeys-boil.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): reduce build size

.changeset/silent-tips-admire.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/middleware': patch
+'@verdaccio/web': patch
+---
+
+chore: export and constant on middleware

.changeset/silver-houses-remain.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+fix: ui-component vitest api

.changeset/silver-insects-train.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore(ui): fix ts error due to excluded test folder

.changeset/strange-pants-chew.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/web': patch
+---
+
+feat: show version-specific readmes in web ui

.changeset/swift-knives-shop.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/core': patch
+'@verdaccio/utils': patch
+---
+
+chore(core): move more utils to core

.changeset/swift-mangos-grab.md

@@ -0,0 +1,12 @@
+---
+'@verdaccio/server': patch
+'@verdaccio/core': patch
+'@verdaccio/loaders': patch
+'@verdaccio/config': patch
+'@verdaccio/store': patch
+'@verdaccio/auth': patch
+'@verdaccio/api': patch
+'@verdaccio/web': patch
+---
+
+fix(config): server settings

.changeset/swift-zebras-cheer.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/api': patch
+---
+
+fix(api): cidr whitelist for tokens

.changeset/ten-jeans-approve.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/local-storage': patch
+---
+
+chore: remove obsolete test data from local-storage

.changeset/tender-buckets-smoke.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-components': patch
+---
+
+chore: fix ui-component npmignore and readme

.changeset/thick-dolphins-rule.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/middleware': patch
+---
+
+fix(middleware): properly derive the html cache key

.changeset/tidy-socks-battle.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/core': patch
+---
+
+fix(core): remove `lodash` from a dependency

.changeset/tricky-knives-end.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/store': patch
+---
+
+fix(store): update deprecate state

.changeset/twelve-games-wonder.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-i18n': patch
+---
+
+fix(i18n): avoid fallback for en-us

.changeset/violet-baboons-beg.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/middleware': patch
+'@verdaccio/web': patch
+---
+
+chore: middleware package update

.changeset/violet-bobcats-allow.md

@@ -0,0 +1,6 @@
+---
+'@verdaccio/core': patch
+'@verdaccio/store': patch
+---
+
+chore: add package parameter to storage plugin interface

.changeset/wet-cats-behave.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/ui-i18n': patch
+---
+
+fix: ignore duplicted files

.changeset/wicked-points-relate.md

@@ -0,0 +1,7 @@
+---
+'@verdaccio/auth': patch
+'@verdaccio/signature': patch
+'@verdaccio/types': patch
+---
+
+fix: support JWT sign and verify options

.changeset/wild-coins-lie.md

@@ -0,0 +1,5 @@
+---
+'@verdaccio/tarball': patch
+---
+
+chore(tarball): remove lodash, fix typing

.changeset/yellow-flies-sniff.md

@@ -0,0 +1,10 @@
+---
+'@verdaccio/search-indexer': patch
+'@verdaccio/server': patch
+'@verdaccio/loaders': patch
+'@verdaccio/store': patch
+'@verdaccio/auth': patch
+'@verdaccio/web': patch
+---
+
+fix: add legacyMergeConfigs legacy plugins

.eslintignore

@@ -1,3 +1,4 @@
+assets/**/*
 **/fixtures/**
 **/mock/store/**
 **/partials/**

.gitattributes

@@ -13,7 +13,7 @@
 ##   Handle line endings automatically for files detected as
 ##   text and leave all files detected as binary untouched.
 ##   This will handle all files NOT defined below.
-*                 text=lf
+*                 text eol=lf
 
 # Source code
 *.bash            text eol=lf
@@ -197,3 +197,6 @@ Procfile          text eol=lf
 
 # Ignore files (like .npmignore or .gitignore)
 *.*ignore         text eol=lf
+
+# Test Snapshots
+*.snap            text eol=lf

.github/ISSUE_TEMPLATE/bug_report.md

@@ -17,24 +17,27 @@ assignees: ''
  - If you are willing to fix it, there is a checkbox at the bottom.
 -->
 
-**Your Environment**
-  <!-- bug below the version 5.x will be closed, see SECURITY.md for more details -->
- * **verdaccio version**: 5.x.x
- * **node version** [12.x.x, 14.x.x]:
- * **package manager**: [npm@7, pnpm@6, yarn@2]
- * **os**: [mac, windows@10, linux]
- * **platform**: [npm, docker, helm, other]
+**Your environment**
+
+<!-- bugs below the version 6.x will be closed, see SECURITY.md and VERSIONS.md for more details -->
+<!-- Please paste the results of running `verdaccio --version` --> 
+* **verdaccio version**: 6.x.x
+
+<!-- Please paste the results of running `verdaccio --info` --> 
+* **node version** [20.x.x, 22.x.x]:
+* **package manager**: [npm@10.x.x, pnpm@10.x.x, yarn@2.x.x]
+* **os**: [mac, windows@11, linux]
+* **platform**: [node, docker, helm, other]
+* **reverse proxy**: [yes, no]
 
 **Describe the bug**
 
 <!-- A clear and concise description of what the bug is. -->
 
-**To Reproduce**
+**Steps to reproduce**
 
 <!-- IMPORTANT:
- - How to reproduce the issue
- - Steps to reproduce the issue
-
+Add step-by-step instructions on how to reproduce the bug.
 Be aware, the lack of reproducible steps the issue might cause your ticket to be closed.
 -->
 
@@ -42,17 +45,14 @@ Be aware, the lack of reproducible steps the issue might cause your ticket to be
 
 <!-- A clear and concise description of what you expected to happen. -->
 
-**Screenshots, server logs, package manager log**
+**Screenshots, Verdaccio server log, package manager log**
 
-<!-- If applicable, add screenshots to help explain your problem.  -->
+<!-- If applicable, add screenshots to help explain your problem. -->
 
-**Configuration File (cat ~/.config/verdaccio/config.yaml)**
+**Configuration file**
 
-<!-- Please be careful do not leak any sensitive information, remove tokens -->
-
-**Environment information**
-
-<!-- Please paste the results of running `verdaccio --info` -->
+<!-- cat ~/.config/verdaccio/config.yaml -->
+<!-- Please be careful do not leak any sensitive information, remove usernames and tokens -->
 
 **Debugging output**
 
@@ -66,6 +66,5 @@ Be aware, the lack of reproducible steps the issue might cause your ticket to be
 - [ ] I'm willing to fix this bug 🥇 
 
 <!--
-
 IMPORTANT: please do not attach external files, all content should be visible from any device.
 -->

.github/actions/cache-packages/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - name: Cache Packages
       id: cache-packages
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.0.2
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ./packages/
         key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}

.github/actions/cache-store/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - name: Cache .pnpm-store
       id: cache-npm
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.0.2
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ~/.pnpm-store
         key: pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ github.event.pull_request.number }}-${{ runner.os }}

.github/actions/install-app-node/action.yml

@@ -22,11 +22,12 @@ runs:
   using: composite
   steps:
     - name: Use Node
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
     - name: Install pnpm
       run: |
+        npm install --global corepack@latest
         corepack enable
         corepack prepare
       shell: bash

.github/actions/install-app/action.yml

@@ -15,11 +15,12 @@ runs:
   using: composite
   steps:
     - name: Use Node
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version-file: '.nvmrc'
     - name: Install pnpm
       run: |
+        npm install --global corepack@latest
         corepack enable
         corepack prepare
       shell: bash

.github/disabled/ci-windows.yml

@@ -25,6 +25,7 @@ jobs:
         node-version-file: '.nvmrc'
     - name: Install pnpm
       run: |
+        npm install --global corepack@latest
         corepack enable
         corepack install
     - name: set store

.github/workflows/changesets-pr.yml

@@ -0,0 +1,36 @@
+name: Changesets Publish Test
+
+on:
+  pull_request:
+
+concurrency:
+  group: changeset-pr-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  version:
+    if: github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
+      - name: crowdin download
+        env:
+          CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
+          CONTEXT: production
+        run: pnpm crowdin:download
+      - name: build
+        run: pnpm build
+      - name: Docker test
+        run: |
+          docker run -d -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio:6
+      - name: login
+        run: npx npm-cli-login -u test -p 1234 -e test@domain.test -r http://localhost:4873
+      - name: Prepare
+        # to allow local snapshot
+        run: rm .changeset/pre.json
+      - name: Create snapshot
+        run: pnpm local:snapshots
+      - name: Changeset version
+        run: pnpm local:publish

.github/workflows/changesets.yml

@@ -1,9 +1,7 @@
 name: Changesets
 
 on:
-  schedule:
-    - cron: '0 0 * * *'
-
+  workflow_dispatch:
   push:
     branches:
       - master
@@ -19,40 +17,16 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio'
     steps:
-      - name: checkout code repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: setup node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-        with:
-          node-version-file: '.nvmrc'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
-
-      - name: Install pnpm
-        run: |
-          corepack enable
-          corepack install
-
-      - name: setup pnpm config
-        run: pnpm config set store-dir $PNPM_CACHE_FOLDER
-      - name: setup pnpm config registry
-        run: pnpm config set registry https://registry.npmjs.org
-
-      - name: install dependencies
-        run: pnpm install
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.REGISTRY_AUTH_TOKEN }}
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies with a custom registry
+        uses: ./.github/actions/install-app
       - name: crowdin download
-        env:          
+        env:
           CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
           CONTEXT: production
-        run: pnpm crowdin:download       
+        run: pnpm crowdin:download
       - name: build
         run: pnpm build
-
       - name: create versions
         uses: changesets/action@master
         with:

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
       fail-fast: true
       matrix:
         os: [ubuntu-latest]
-        node_version: [18, 20, 21, 22, 23]
+        node_version: [18, 20, 21, 22, 23, 24]
     name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
     runs-on: ${{ matrix.os }}
     steps:
@@ -86,14 +86,15 @@ jobs:
     if: (github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'verdaccio/verdaccio') || github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: |
+          npm install --global corepack@latest
           corepack enable
           corepack install
-      - uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.0.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.pnpm-store
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/codeql-analysis.yml

@@ -37,7 +37,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           config: |
             paths-ignore:
@@ -50,7 +50,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -64,4 +64,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18

.github/workflows/docker-proxy-apache-e2e.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   docker:
     timeout-minutes: 10
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
@@ -26,7 +26,7 @@ jobs:
       run: docker compose -f "./e2e/docker/apache-verdaccio/docker-compose.yaml" up -d --build
 
     - name: Install node
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version-file: '.nvmrc'
     - name: npm setup

.github/workflows/docker-proxy-nginx-e2e.yml

@@ -13,7 +13,7 @@ on:
 jobs:
   docker:
     timeout-minutes: 10
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
@@ -24,7 +24,7 @@ jobs:
       run: docker compose -f "./e2e/docker/proxy-nginx/docker-compose.yaml" up -d --build
 
     - name: Install node
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version-file: '.nvmrc'
     - name: npm setup

.github/workflows/docker-publish.yml

@@ -2,50 +2,49 @@ name: Docker publish to docker.io
 
 on:
   push:
-    paths:
-      - .github/workflows/docker-publish.yml
-      - .github/workflows/docker-publish.yml
-      - 'packages/**'
-      - 'docker-bin/**'
-      - 'package.json'
-      - 'pnpm-*.yaml'
-      - 'Dockerfile'
-      - '.dockerignore'
     branches:
       - 'master'
     tags:
       - 'v*'
 
 permissions:
-  contents: read  #  to fetch code (actions/checkout)
+  contents: read
 
 jobs:
   docker:
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
-      - uses: docker/setup-buildx-action@v1
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
-      - uses: docker/login-action@v1
-        name: Login Docker Hub
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Prepare docker image tags
+
+      - name: Prepare Docker image tags
         id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         with:
           images: ${{ github.repository }}
-          tag-custom: nightly-master
-          tag-custom-only: ${{ github.ref == 'refs/heads/master' }}
-          tag-latest: false
-          tag-semver: |
-            {{version}}
-            {{major}}
-            {{major}}.{{minor}}
+          tags: |
+            type=raw,value=nightly-master
+            type=raw,value=latest,enable=false
+          labels: |
+            org.opencontainers.image.source=${{ github.repositoryUrl }}
+            org.opencontainers.image.created=${{ steps.docker_meta.outputs.created }}
+            org.opencontainers.image.version=${{ steps.docker_meta.outputs.version }}
+
       - name: Build & Push
         uses: docker/build-push-action@v6
         with:

.github/workflows/e2e-ci.yml

@@ -43,9 +43,10 @@ jobs:
             npm7,
             npm8,
             npm9,
-            npm10
+            npm10,
+            npm11,
           ]
-        node: [18, 23]
+        node: [22, 24]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
@@ -59,7 +60,7 @@ jobs:
       - name: Restore cache pnpm store
         uses: ./.github/actions/cache-packages
       - name: Test CLI
-        run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
+        run: cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
 
   e2e-cli-pnpm:
     needs: [prepare, build]
@@ -72,7 +73,7 @@ jobs:
             pnpm9,
             pnpm10,
           ]
-        node: [18, 23]
+        node: [2, 24]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
@@ -86,7 +87,7 @@ jobs:
       - name: Restore cache pnpm store
         uses: ./.github/actions/cache-packages
       - name: Test CLI
-        run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
+        run:  cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
   e2e-cli-yarn:
     needs: [prepare, build]
     strategy:
@@ -99,7 +100,7 @@ jobs:
             yarn3,
             yarn4
           ]
-        node: [18, 23]
+        node: [22, 24]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
@@ -113,5 +114,5 @@ jobs:
       - name: Restore cache pnpm store
         uses: ./.github/actions/cache-packages
       - name: Test CLI
-        run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
+        run: cd e2e/cli/e2e-${{matrix.pkg}} && NODE_ENV=production pnpm test
 

.github/workflows/e2e-ui.yml

@@ -26,7 +26,7 @@ jobs:
           node-version: 20
       - name: Test UI
         run: pnpm test:e2e:ui
-      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: videos
           path: /home/runner/work/verdaccio/verdaccio/e2e/ui/cypress/videos

.github/workflows/plugin-generator-e2e.yaml

@@ -1,7 +1,7 @@
 name: E2E Generator Verdaccio Plugin
 
 on:
-  pull_request:
+#  pull_request:
   workflow_dispatch:
 #  push:
 #    branches:

.github/workflows/shared-docker-publish.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'verdaccio/verdaccio'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+      - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - uses: docker/setup-buildx-action@v1
         with:
           driver-opts: network=host

.github/workflows/static-data.yml

@@ -6,7 +6,7 @@ on:
 #  pull_request:
   schedule:
     # twice peer week
-    - cron: '0 0 * * 1,4'
+    - cron: "0 0 * * 1,4"
   # for now, scheduled, we can enable on push master but not make much sense now
   # push:
   #   branches:
@@ -29,8 +29,16 @@ jobs:
         uses: ./.github/actions/install-app
         with:
           reporter: 'default'
-      - name: Build Translations percentage
-        run: pnpm --filter @verdaccio/crowdin-translations build
+      - name: Build package
+        run: pnpm --filter @verdaccio/local-scripts run build
+      - name: Get npmjs downloads
+        run: pnpm --filter @verdaccio/local-scripts run downloads:npmjs
+      - name: Get docker downloads
+        run: pnpm --filter @verdaccio/local-scripts run pull:docker
+      - name: Get npmjs monhtly downloads
+        run: pnpm --filter @verdaccio/local-scripts run downloads:monthly
+      - name: Get npmjs year downloads
+        run: pnpm --filter @verdaccio/local-scripts run downloads:yearly
       - name: update contributors
         run: pnpm run contributors
         env:

.github/workflows/ui-components.yml

@@ -1,40 +1,36 @@
 name: UI Components
 
 on:
-#  pull_request:
+# Disabled temporary
+#  push:
+#    branches:
+#      - master
   workflow_dispatch:
-#  schedule:
-#    - cron: '0 0 * * *'
+
+concurrency:
+  group: ui-deploy-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
-  contents: read  #  to fetch code (actions/checkout)
-
-env:
-  DEBUG: verdaccio*
+  contents: read
 
 jobs:
   deploy:
-    permissions:
-      contents: read  #  to fetch code (actions/checkout)
-      deployments: write
-      pull-requests: write  #  to comment on pull-requests
-
     runs-on: ubuntu-latest
     if: github.repository == 'verdaccio/verdaccio'
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
       - name: Install dependencies with a custom registry
         uses: ./.github/actions/install-app
-
-      - name: Install pnpm
-        run: |
-          corepack enable
-            corepack prepare
-      - name: Install
-        run: pnpm install
+      - name: crowdin download
+        env:
+          CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
+          CONTEXT: production
+        run: pnpm crowdin:download
+      - name: Build modules
+        run: pnpm build
       - name: Build storybook
         run: pnpm ui:storybook:build
       - name: Copy public content

.github/workflows/website.yml

@@ -2,6 +2,8 @@ name: Verdaccio Website CI
 
 on:
   workflow_dispatch:
+  schedule:
+    - cron: '0 2 * * 0'  # every Sunday at 2am UTC  (10pm EST)
 permissions:
   contents: read  #  to fetch code (actions/checkout)
 
@@ -35,9 +37,9 @@ jobs:
         with:
           node-version: 20
       - name: Build Translations percentage
-        run: pnpm --filter @verdaccio/crowdin-translations build
+        run: pnpm --filter @verdaccio/local-scripts build
       - name: Cache Docusaurus Build
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.0.2
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: website/node_modules/.cache/webpack
           key: cache/webpack-${{github.ref}}-${{ hashFiles('**/pnpm-lock.yaml') }}

.github/workflows/x-e2e-angular-cli-workflow.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm'
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 9'
@@ -83,7 +83,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 10'

.github/workflows/x-e2e-audit-workflow.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install latest npm 10'

.github/workflows/x-e2e-gatsbyjs-cli-workflow.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install npm 9'
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: 'Use Node.js'
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
       - name: 'install npm 10'