đĻđ A lightweight Node.js private proxy registry
deps: update core verdaccio dependencies (#4668) (9e3a79d)
set engine to 14.21.3 (6cf6064)
set engine to Node.js 14 (9a6d5b3)
(đī¸ hey (renovate/dependabot/other bots) users, read this)
âšī¸ Important changes added to the .verdaccio-db.json
and token signature for users that run on Node.js 22 or higher (in the future đ ) please read
https://verdaccio.org/docs/configuration/#.verdaccio-db
TLDR:
[VERWAR007] VerdaccioDeprecation: the secret length is too lon...
to remove it please read the link above.verdaccio-db.json
and the token inside does not complies with the length (read link above) the application startup will fail with fatal error (Error: Invalid storage secret key length, must be 32 characters long but is....
)
In both cases by updating the secret all previously tokens will get invalid, in your benefit a new legacy signature will be applied and is more secure than the old one (generating tokens with salt).
For existing installations that have no issues by invalidating tokens is recommended to add to the config.yaml
the following setup, this will automatically generate a new the secret once is started, could be removed aftewards, if all went succesfull the [VERWAR007]
deprecation will not be displayed anymore.
security:
api:
migrateToSecureLegacySignature: true
Any new installation should not worry about this, new token signature and secret (32 characters) is applied by default.
âšī¸ Verdaccio v6.0.0-beta.2 has been released, ready for user test to ensure the best backward compatibility, help us by trying it out.
Same as https://github.com/verdaccio/verdaccio/releases/tag/v5.30.0
âšī¸ Verdaccio v6.0.0-beta.2 has been released, ready for user test to ensure the best backward compatibility, help us by trying it out.
đ 3 new contributors
Be warned, if you are using (or cannot upgrade to major) Node.js 12 (only if you install from npmjs) please do not upgrade to this version, the minimum is now Node.js 14 (due dependency reasons are out my hand), the recommendation is always go for LTS releases anyway which at this moment is Node.js 20. For context if you are using the Docker image ignore this warning, the Dockerfile uses Node.js 20 as base image.
âšī¸ Verdaccio v6.0.0-beta.2 has been released, ready for user test to ensure the best backward compatibility, help us by trying it out.
On the versions view there is a new filter that allows semantic versioning filtering (feedback is welcome)
âšī¸ Available via npm install -g verdaccio@latest-6
Feedback is welcome đđŧ
Powered by @mbtools đ¯