What verdaccio/verdaccio shipped
Generated by FoxPlug from public activity — not affiliated with Verdaccio.
Week of September 14, 2026
What shipped
- Package filter now supports glob patterns for scope and package rules, allowing more flexible allow and block configurations. Pull request #5872
- Server CORS options are now configurable via standard CorsOptions, with sensible defaults preserved when omitted. Pull request #6255
- Fixed npm publish failures on 6.x by registering body parser before JWT middleware to handle request sizes correctly. Pull request #6249
- Logger now properly cleans up failed file destination initialization and reports errors to stderr without terminating the registry. Pull request #6260
- Express bumped to 4.22.3 across middleware packages to address query-string DoS vulnerabilities in qs 6.15.x. Pull request #6257
- Configuration path resolution on Windows fixed by using process.env.HOME when available instead of relying solely on os.homedir. Pull request #6247
- Windows CI pipeline added with basic build and test workflow for Node.js 24, triggered manually. Pull request #6248
- Plugin loader test coverage improved with additional cases for ES modules and default exports. Pull request #6238
- Development dependencies updated to clear 25 high-severity audit findings and bump e2e-ui to 2.7.0. Pull request #6256
Why it matters
This week focused on fixing critical issues in publishing workflows and security vulnerabilities while expanding configuration flexibility. The glob pattern support and CORS options provide developers with finer control over package filtering and cross-origin behavior, while the Windows CI support and various bug fixes improve reliability across platforms.
Changelog entry
- feat(package-filter): support glob patterns for scope and package rules Pull request #5872
- feat(server): allow configuring CORS options with standard CorsOptions type Pull request #6255
- fix: register body parser before JWT middleware on 6.x to fix npm publish failures Pull request #6249
- fix(logger): properly handle and clean up file destination initialization errors Pull request #6260
- fix: bump express to 4.22.3 to address qs DoS vulnerabilities Pull request #6257
- fix(config): use process.env.HOME for path resolution on Windows Pull request #6247
- chore: add Windows CI pipeline for Node.js 24 Pull request #6248
- chore(loader): improve plugin loader test coverage for ES modules Pull request #6238
This week: glob patterns for package filters, configurable CORS, npm publish fix on 6.x, Windows CI support, and security updates to address query-string DoS vulnerabilities.
Verdaccio shipped improvements across multiple fronts this week. Package filters now support glob patterns for more flexible rules, CORS options are configurable via standard types, and a critical npm publish bug on 6.x was fixed. Security updates address query-string DoS vulnerabilities, Windows CI was added, and configuration handling improved. These changes enhance both developer control and platform stability.