build(deps-dev): bump verdaccio from 6.7.4 to 6.8.0

[dependabot]

Bumps verdaccio from 6.7.4 to 6.8.0.

Release notes

Sourced from verdaccio's releases.

v6.8.0

Minor Changes

• 962fba8: feat: add unpublish notification hooks

  Port of #5920 (ref #5328). The notify webhook now also fires when a package is unpublished entirely and when a single version (tarball) is removed, not only on publish. Notification templates can distinguish the event through the new {{ publishType }} (publish | unpublish) and {{ publishedPackage }} variables, and the {{ publisher }} object exposes only name, groups and real_groups, so the remote user auth token can never leak to the notification endpoint (via @verdaccio/hooks 8.0.4).

Patch Changes

• f0684dc: fix: return 403 to client when uplink responds with 403 for tarball requests

  Previously, any non-200/404 response from an uplink (e.g. a security proxy blocking a package download) would result in a generic 500 error being returned to the client. This change propagates 403 responses from the uplink through to the client, including any error detail from the response body, so callers can distinguish authorization failures from other upstream errors.

• 3a84578: chore: refactor eslint

• b7a5db1: fix: rate limit and bound the npm search v1 endpoint

  The /-/v1/search endpoint now applies the userRateLimit rate limiting middleware (matching the login, token and profile endpoints), clamps the size (max 250, like the public npm registry) and from (max 10000) pagination parameters, and stops evaluating package access as soon as the requested page is filled instead of running an auth check over the entire result set. The clamped values are also what gets forwarded to uplink registries (the raw request URL is no longer passed through), so the bounds hold end-to-end. This prevents cheap anonymous requests from triggering unbounded full-catalog scans. As part of this, pagination is fixed: results were sliced with slice(from, size) instead of slice(from, from + size), so pages beyond the first were wrong.

  Search results for local packages also emit npm-search-compatible maintainers ({ username, email }) — npm 11 on Node 24 crashes rendering entries without username (The "str" argument must be of type string. Received undefined) — and the publisher field is now populated from _npmUser when the publishing client provided it, falling back to the first maintainer, so the npm CLI shows the publishing user instead of by ???.

• 808d916: fix: pick the right uplink for tarballs and heal missing distfile records

  Uplink selection. With several uplinks configured for a package, tarball downloads used the last uplink whose package pattern matched, even when the tarball url belongs to a different one, which could make downloads fail against registries that require authentication. The uplink is now selected by matching the tarball url: the registry recorded on the distfile wins, then the uplink whose url serves the file; when none matches, an autogenerated uplink with default settings is used. Single-uplink setups keep the previous behavior for tarballs hosted on another host (a CDN).

  Missing distfile records. Storages written by other verdaccio versions can carry cached versions without their _distfiles records, which made those tarballs permanently return 404 no such file available. The tarball location is now resolved from the version's dist.tarball metadata when the record is missing, and the record is restored when the tarball is cached.

• a2de1d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.20 → 9.0.0-next-9.21

Changelog

Sourced from verdaccio's changelog.

6.8.0

Minor Changes

• 962fba8: feat: add unpublish notification hooks

  Port of #5920 (ref #5328). The notify webhook now also fires when a package is unpublished entirely and when a single version (tarball) is removed, not only on publish. Notification templates can distinguish the event through the new {{ publishType }} (publish | unpublish) and {{ publishedPackage }} variables, and the {{ publisher }} object exposes only name, groups and real_groups, so the remote user auth token can never leak to the notification endpoint (via @verdaccio/hooks 8.0.4).

Patch Changes

• f0684dc: fix: return 403 to client when uplink responds with 403 for tarball requests

  Previously, any non-200/404 response from an uplink (e.g. a security proxy blocking a package download) would result in a generic 500 error being returned to the client. This change propagates 403 responses from the uplink through to the client, including any error detail from the response body, so callers can distinguish authorization failures from other upstream errors.

• 3a84578: chore: refactor eslint

• b7a5db1: fix: rate limit and bound the npm search v1 endpoint

  The /-/v1/search endpoint now applies the userRateLimit rate limiting middleware (matching the login, token and profile endpoints), clamps the size (max 250, like the public npm registry) and from (max 10000) pagination parameters, and stops evaluating package access as soon as the requested page is filled instead of running an auth check over the entire result set. The clamped values are also what gets forwarded to uplink registries (the raw request URL is no longer passed through), so the bounds hold end-to-end. This prevents cheap anonymous requests from triggering unbounded full-catalog scans. As part of this, pagination is fixed: results were sliced with slice(from, size) instead of slice(from, from + size), so pages beyond the first were wrong.

  Search results for local packages also emit npm-search-compatible maintainers ({ username, email }) — npm 11 on Node 24 crashes rendering entries without username (The "str" argument must be of type string. Received undefined) — and the publisher field is now populated from _npmUser when the publishing client provided it, falling back to the first maintainer, so the npm CLI shows the publishing user instead of by ???.

• 808d916: fix: pick the right uplink for tarballs and heal missing distfile records

  Uplink selection. With several uplinks configured for a package, tarball downloads used the last uplink whose package pattern matched, even when the tarball url belongs to a different one, which could make downloads fail against registries that require authentication. The uplink is now selected by matching the tarball url: the registry recorded on the distfile wins, then the uplink whose url serves the file; when none matches, an autogenerated uplink with default settings is used. Single-uplink setups keep the previous behavior for tarballs hosted on another host (a CDN).

  Missing distfile records. Storages written by other verdaccio versions can carry cached versions without their _distfiles records, which made those tarballs permanently return 404 no such file available. The tarball location is now resolved from the version's dist.tarball metadata when the record is missing, and the record is restored when the tarball is cached.

• a2de1d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.20 → 9.0.0-next-9.21

Commits

• b4ca2c5 chore: release 6.x (#5981)
• 962fba8 feat: add publish/unpublish hook (#6020)
• e663cc4 fix(deps): update dependency semver to v7.8.5 (#6013)
• 808d916 fix: pick the right uplink for tarballs and heal missing distfile rec… (#6009)
• a2de1d5 chore: update verdaccio 6.x dependencies (#6003)
• b7a5db1 fix: rate limit and bound the npm search v1 endpoint (#6005)
• f0684dc Return 403 error when uplink does for tarball (#5984)
• 1b6cb9c fix(deps): update dependency semver to v7.8.4 (#5985)
• 3a84578 chore: refactor lint (#5980)
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	verdaccio@​6.7.4 ⏵ 6.8.0	+1			+2

View full report

[relativeci]

#13750 Bundle Size — 404.63KiB (~+0.01%).

57745cd(current) vs 608a5c6 master#13682(baseline)

Warning

Bundle contains 2 duplicate packages – View duplicate packages

Bundle metrics   2 changes 1 regression

	Current #13750	Baseline #13682
Initial JS	356.9KiB(~+0.01%)	356.87KiB
Initial CSS	47.74KiB	47.74KiB
Cache Invalidation	61.12%	61.13%
Chunks	3	3
Assets	4	4
Modules	701	701
Duplicate Modules	0	0
Duplicate Code	0%	0%
Packages	39	39
Duplicate Packages	1	1

Bundle size by type   1 change 1 regression

	Current #13750	Baseline #13682
JS	356.9KiB (~+0.01%)	356.87KiB
CSS	47.74KiB	47.74KiB

Bundle analysis report Branch dependabot/npm_and_yarn/master/v... Project dashboard

---

^{Generated by RelativeCI Documentation Report issue}