What verdaccio/verdaccio shipped

Signing keys and attestations now come from uplinks, so npm audit signatures can resolve keys against Verdaccio. The sidebar shows provenance and signatures. Tarball errors no longer break keep-alive connections, and package rules work with minimatch 11.

This week Verdaccio added serving registry signing keys and attestations from uplinks, so npm audit signatures can resolve the key it asks for instead of failing. The web sidebar now shows a Provenance section with attestations and registry signatures for a version. On the fix side, tarball routes no longer pass errors to next after a response is sent, which had been destroying keep-alive sockets after failed downloads, and package-rule matching now uses the supported matcher with minimatch 11. An experimental flags.tarballMetadata option was added for per-version readmes, and master pushes now build and deploy a coverage report to GitHub Pages. The next-9 release line also moved forward.

Verdaccio 7 release prep is in, along with a reworked web UI home toolbar and onboarding, unpublish authorization for version removals, attachment validation on publish, and a version status endpoint for staged versus published versions.

This week the project prepared the first stable Verdaccio 7 release, moving out of pre mode so the next version run on 7.x produces 7.0.0 and publishes to npm as latest. The web UI home page gained a filter, scope and sort toolbar, reworked onboarding, and footer, poweredBy and help options configurable from config.yaml, plus bun support. On the server side, version removals now require unpublish authorization, publish attachments are validated before saving, and a new package-version status endpoint distinguishes published from staged versions. Smaller fixes restore npm provenance for 6.x releases, fall back to English for empty translated strings, and remove the web search endpoint when showSearch is false.

This week: htpasswd can cache successful password verifications (verify_cache_ms, off by default). Basic auth works again on login routes for npm, yarn and pnpm login. On 6.x, whoami returns 401 without a valid user, and web password change bodies are validated.

Changes this week in Verdaccio: verdaccio-htpasswd now has an opt-in cache for successful password verifications via verify_cache_ms, which defaults to 0 and is disabled. Basic auth is accepted again on the login routes used by npm login, yarn npm login and pnpm login. On the 6.x line, /-/whoami returns 401 when there are no credentials or an unrecognised token, and web password change requests are validated with the shared password validator. Proxy search requests now keep configured uplink subpaths and use the uplink's authentication and headers. Release work continued with a next-9 versions update and release pull requests for 6.x and 7.x.

Verdaccio this week: 401 for invalid credentials on GET /-/user/, not-found instead of internal errors for missing versions and dist-tags, and patched proxy-addr and compression advisories. Plus version updates for next-9 and 8.x, and n8n added to Who is using Verdaccio.

This week in Verdaccio: GET requests to the user endpoint with invalid credentials now return 401 instead of 200, and requests for missing versions or dist-tags return not-found responses rather than internal errors. The Express dependency tree in the binary received patches for proxy-addr and compression advisories, and the audit workflow is now scoped to pull requests. The validatePassword input type accepts unknown to match its runtime validation. Version updates landed for the next-9 and 8.x lines, and the documentation now lists n8n in the Who is using Verdaccio section.

This week: password validation before auth plugins, stricter search parameter handling, aligned package name validation across the core, improved htpasswd registration, enforced ownership checks, optimized Docker builds and CI pipeline, and released 9.0.0-next-9.34.

Verdaccio improvements this week strengthen security and validation: password change requests now validate credentials upfront, search queries reject malformed parameters, package name validation aligns with npm standards across the codebase, htpasswd registration follows proper async patterns with error handling, and ownership checks now apply to all package operations. Docker builds are safer with release-age exclusions, and the CI pipeline now parallelizes critical checks to reduce feedback time. Version 9.0.0-next-9.34 released.

Verdaccio 9.0.0-next-9.33 ships search fixes, restored programmatic exports, improved cache handling, and E2E UI test coverage. Upgrading from 7.x now works as expected.

Verdaccio 9.0.0-next-9.33 is out with significant improvements for users and maintainers. We restored programmatic exports to fix breaking changes when upgrading from 7.x, fixed search filtering to properly handle package queries, and corrected timestamp formats in API responses. Cache handling for uplinks was improved to prevent unnecessary revalidation. We also added E2E UI test coverage and removed unused dependencies as part of ongoing maintenance efforts.

This week: glob patterns for package filters, configurable CORS, npm publish fix on 6.x, Windows CI support, and security updates to address query-string DoS vulnerabilities.

Verdaccio shipped improvements across multiple fronts this week. Package filters now support glob patterns for more flexible rules, CORS options are configurable via standard types, and a critical npm publish bug on 6.x was fixed. Security updates address query-string DoS vulnerabilities, Windows CI was added, and configuration handling improved. These changes enhance both developer control and platform stability.