Shipped · DevOps and infrastructure

What verdaccio/verdaccio shipped

The public repository of Verdaccio · github.com/verdaccio/verdaccio

Written by FoxPlug from the repository's own releases; not affiliated with Verdaccio. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/verdaccio/verdaccio; Verdaccio did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow verdaccio's weekly shipped digest

Week of October 5, 2026

What shipped

Why it matters

This week brought two fixes that change behavior developers will notice: invalid credentials on the user endpoint now correctly return 401, and missing versions or dist-tags return not-found responses instead of internal errors. Dependency advisories in the Express tree shipped with the binary were patched, and the security audit workflow now runs only on pull requests. Release lines for next-9 and 8.x received version bumps, and documentation now lists n8n among the users of the project.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Verdaccio this week: 401 for invalid credentials on GET /-/user/, not-found instead of internal errors for missing versions and dist-tags, and patched proxy-addr and compression advisories. Plus version updates for next-9 and 8.x, and n8n added to Who is using Verdaccio.

Post for LinkedIn

This week in Verdaccio: GET requests to the user endpoint with invalid credentials now return 401 instead of 200, and requests for missing versions or dist-tags return not-found responses rather than internal errors. The Express dependency tree in the binary received patches for proxy-addr and compression advisories, and the audit workflow is now scoped to pull requests. The validatePassword input type accepts unknown to match its runtime validation. Version updates landed for the next-9 and 8.x lines, and the documentation now lists n8n in the Who is using Verdaccio section.

Week of September 28, 2026

What shipped

Why it matters

This week focused on security and validation improvements across authentication, package names, and search functionality. Docker build safety was enhanced to prevent premature image releases, and the CI pipeline was optimized to reduce feedback time for contributors. Multiple validation fixes address edge cases in search parameters, package naming, and ownership checks.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: password validation before auth plugins, stricter search parameter handling, aligned package name validation across the core, improved htpasswd registration, enforced ownership checks, optimized Docker builds and CI pipeline, and released 9.0.0-next-9.34.

Post for LinkedIn

Verdaccio improvements this week strengthen security and validation: password change requests now validate credentials upfront, search queries reject malformed parameters, package name validation aligns with npm standards across the codebase, htpasswd registration follows proper async patterns with error handling, and ownership checks now apply to all package operations. Docker builds are safer with release-age exclusions, and the CI pipeline now parallelizes critical checks to reduce feedback time. Version 9.0.0-next-9.34 released.

Week of September 21, 2026

What shipped

Why it matters

This week focused on fixing critical bugs in search functionality, cache handling, and data format compliance that affect users upgrading from earlier versions. Programmatic exports were restored to maintain backward compatibility for library consumers. Infrastructure improvements ensure better test coverage and cleaner maintenance of the codebase.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Verdaccio 9.0.0-next-9.33 ships search fixes, restored programmatic exports, improved cache handling, and E2E UI test coverage. Upgrading from 7.x now works as expected.

Post for LinkedIn

Verdaccio 9.0.0-next-9.33 is out with significant improvements for users and maintainers. We restored programmatic exports to fix breaking changes when upgrading from 7.x, fixed search filtering to properly handle package queries, and corrected timestamp formats in API responses. Cache handling for uplinks was improved to prevent unnecessary revalidation. We also added E2E UI test coverage and removed unused dependencies as part of ongoing maintenance efforts.

Week of September 14, 2026

What shipped

Why it matters

This week focused on fixing critical issues in publishing workflows and security vulnerabilities while expanding configuration flexibility. The glob pattern support and CORS options provide developers with finer control over package filtering and cross-origin behavior, while the Windows CI support and various bug fixes improve reliability across platforms.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: glob patterns for package filters, configurable CORS, npm publish fix on 6.x, Windows CI support, and security updates to address query-string DoS vulnerabilities.

Post for LinkedIn

Verdaccio shipped improvements across multiple fronts this week. Package filters now support glob patterns for more flexible rules, CORS options are configurable via standard types, and a critical npm publish bug on 6.x was fixed. Security updates address query-string DoS vulnerabilities, Windows CI was added, and configuration handling improved. These changes enhance both developer control and platform stability.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-13.

Is this your repo? Ask us to remove this page.