beachball
beachball copied to clipboard
Update devDependency verdaccio to v5
This PR contains the following updates:
Package | Change | Age | Adoption | Passing | Confidence |
---|---|---|---|---|---|
verdaccio (source) | 4.13.2 -> 5.14.0 |
Release Notes
verdaccio/verdaccio
v5.14.0
Features
- allow express 'trust proxy' to be set for ip resolution behind proxies and load-balancers (#3274) (0bc26e3) @edclement
Bug Fixes
- deps: update dependency @verdaccio/readme to v10.4.1 (#3267) (080bd45)
- deps: update dependency lru-cache to v7.13.1 (#3268) (d995cc5)
v5.13.3
5.13.3 (2022-07-13)
Bug Fixes
- deps: update dependency @verdaccio/readme to v10.4.0 (#3265) (531f468) update [email protected] https://github.com/verdaccio/monorepo/issues/596 kudos to @piiq
- deps: update dependency kleur to v4.1.5 (#3263) (cc1c2a5)
- deps: update dependency lru-cache to v7.13.0 (#3266) (0a611c0)
- deps: update dependency marked to v4.0.18 (#3264) (b3f964d)
v5.13.2
5.13.2 (2022-07-12)
Bug Fixes
- deps: update dependency @verdaccio/ui-theme to v6.0.0-6-next.25 (#3258) (af9cc6d)
- update nodejs to 14.20.0 to fix CVE-2022-32212 (#3262) (5f83dc2) by @limmesberger
v5.13.1
5.13.1 (2022-06-23)
Bug Fixes
There was a regression on initial release https://github.com/verdaccio/verdaccio/issues/2141 where the location of the storage was not taken in account, hopefully does not break anything. Fixed here and here.
- deps: update dependency @verdaccio/local-storage to v10.3.1 (#3245) (991cf10) by @juanpicado
- deps: update dependency verdaccio-htpasswd to v10.5.0 (#3242) (884e05b) by @greshilov
v5.13.0
Features
Enable more algorithms for hasing password only for htpasswd plugin, crypt
by default to avoid breaking changes for next major release bcrypt
is highly recommended.
auth:
htpasswd:
file: ./htpasswd
### Maximum amount of users allowed to register, defaults to "+inf".
### You can set this to -1 to disable registration.
### max_users: 1000
### Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
algorithm: bcrypt # by default is crypt, but is recommended use bcrypt for new installations
### Rounds number for "bcrypt", will be ignored for other algorithms.
rounds: 10
ref https://github.com/verdaccio/monorepo/pull/580
v5.12.0
Features
Example
middlewares:
audit:
enabled: true
'@​xlts.dev/verdaccio-prometheus-middleware':
metricsPath: /custom/path/metrics
Bug Fixes
- deps: update dependency @verdaccio/local-storage to v10.3.0 (#3223) (2b8ac7a)
- deps: update dependency async to v3.2.4 (#3224) (c486af2)
- deps: update dependency dayjs to v1.11.3 (#3225) (325e536)
- deps: update dependency lru-cache to v7.10.1 (#3182) (7bc60ff)
- deps: update dependency marked to v4.0.17 (#3226) (9d9c086)
- deps: update dependency minimatch to v5.1.0 (#3183) (e5dbd9b)
- deps: update dependency verdaccio-htpasswd to v10.3.1 (#3220) (25a2825)
v5.11.0
The way to use verdaccio programatically is not very friendly if you are using
const startVerdaccio = require('verdaccio');
as this example.
⚠️ Deprecations
- Using verdaccio with multiples listeners display a deprecation warning
- (
runServer
) forbid this and only allows the first one listener listed
- (
- On verdaccio 6 will be removed and will throw an error
❌ Bad
listen:
- localhost:4873 # default value
- http://localhost:4873 # same thing
✅ Good (on v6.0.0 won't be a list anymore)
listen: localhost:4873
🚀 Feature
runServer
method to run verdaccio programatically as a promise
I am looking for a better name, feel free to drop your ideas.
On v6 https://github.com/verdaccio/verdaccio/pull/2165 this was improved and I am moving the same API to v5 so is much easier to migrate in the future.
It's a bit experimental, it does not replace the old way, so won't break anything, but allows smooth migration
There are three ways to use it:
- No input, it will find the
config.yaml
as is you would runverdaccio
in the console - With a absolute path
- With an object (there is a catch here, see below)
const {runServer} = require('verdaccio');
const app = await runServer(); // default configuration
const app = await runServer('./config/config.yaml');
const app = await runServer({ configuration });
app.listen(4000, (event) => {
// do something
});
With an object you need to add self_path
, manually (it's not nice but would be a breaking change changing it now) on v6 this is not longer need it.
const configPath = join(__dirname, './config.yaml');
const c = parseConfigFile(configPath);
// workaround
// on v5 the `self_path` still exists and will be removed in v6
c.self_path = 'foo';
runServer(c).then(() => {});
Read more here https://verdaccio.org/docs/verdaccio-programmatically
parseConfigFile
method
Exposed for easy use parse a yaml
file as an object
v5.10.3
5.10.3 (2022-05-30)
Bug Fixes
- deps: update dependency @verdaccio/readme to v10.3.4 (#3197) (2443900)
- deps: update dependency marked to v4.0.16 (#3187) (a17378d)
- deps: update dependency verdaccio-audit to v10.2.2 (#3201) (9e743f4)
v5.10.2
5.10.2 (2022-05-07)
Bug Fixes
- deps: update dependency dayjs to v1.11.2 (#3159) (cd39a42)
- deps: update dependency express to v4.18.1 (#3160) (5fffeac)
- deps: update dependency lru-cache to v7.9.0 (#3161) (f16a1ea)
- remove lru deprecation warning (#3158) (adfbefc)
- deps: update dependency marked to v4.0.15 (#3153) (61249a4)
v5.10.1
5.10.1 (2022-05-05)
Bug Fixes
v5.10.0
Features
- deps(ui): update dependency @verdaccio/ui-theme to v6.0.0-6-next.24 (5.x) (#3130) (da01a14)
🌞 Initial new set of variables to hide features (more to come)
Add set of new variables that allow hide different parts of the UI, buttons, footer or download tarballs. ℹ️ All are enabled by default.
### web:
### login: true <-- already exist but worth the reminder
### showInfo: true
### showSettings: true
### In combination with darkMode you can force specific theme
### showThemeSwitch: true
### showFooter: true
### showSearch: true
### showDownloadTarball: true
If you disable
showThemeSwitch
and forcedarkMode: true
the local storage settings would be ignored and force all themes to the one in the configuration file.
Future could be extended to other parts.
🚀 Raw button to display manifest package
A new experimental feature (enabled by default), button named RAW to be able navigate on the package manifest directly on the ui, kudos to react-json-view that allows an easy integration, not configurable yet until get more feedback.
### web:
showRaw: true <-- false to disable it
|
|
|
🧑🏭 Rework header buttons
- The header has been rework, the mobile was looking broken. Now only displays login and logo (for screens smaller than 400px)
- Removed info button in the header and moved to a dialog
- Info dialog now contains more information about the project, license and the aid content for Ukrania 🇺🇦 now is inside of the info modal.
- Separate settings and info to avoid collapse too much info (for mobile still need some work)
🔢 Others
- Updated translations for several languages
🪄 What's next?
- Next updates will be focused on improving the mobile/tablet layouts (does not look so great yet)
- More updates on v6 (alpha release)
🐞 Bug Fixes
- deps: update dependency @verdaccio/local-storage to v10.2.1 (#3118) (0f9d6ec)
- deps: update dependency @verdaccio/readme to v10.3.3 (#3119) (78b9c8b)
- deps: update dependency body-parser to v1.20.0 (#3123) (954886d)
- deps: update dependency dayjs to v1.11.1 (#3131) (27035f9)
- deps: update dependency lru-cache to v7 (#3124) (7ceaa17)
- deps: update dependency marked to v4.0.14 (#3120) (8a60050)
- deps: update dependency semver to v7.3.7 (#3121) (157d5c5)
- deps: update dependency verdaccio-audit to v10.2.1 (#3122) (decd7f1)
v5.9.0
Features
- web: add a config item to web,let the developer can select whether enable the html cache (#3110) (b30ba81)
Verdaccio cache the initial HTML render to improve performance, this might be not a required in some cases, the new property web.html_cache
disable this optimization. by @Tiny-Fendy
web:
html_cache: false
Bug Fixes
- deps: update dependency @verdaccio/ui-theme to v6.0.0-6-next.23 (#3106) (b963f7d) by @juanpicado @s-h-a-d-o-w
The UI is being shared between V5 and V6 (for easy maintenance) but some features are partially enabled for V5.
The search component has been improved for V6, but for V5 is does not show all the potential but is able to display the description of the package and the latest published version on search private packages. V6 will increase ammount of information could be displayed on this component. For v6 more detail info read https://github.com/verdaccio/verdaccio/pull/3057 or install npm i -g verdaccio@6-next
⚠️ v6 is not producction ready, but have some fun.
- deps: update dependency body-parser to v1.19.2 (#3087) (8cee85f)
- deps: update dependency dayjs to v1.11.0 (#3094) (4cc1877)
v5.8.0
UI is customizable, read docs, https://verdaccio.org/docs/webui
If you want to hide the flag for Help Provide Humanitarian Aid to Ukraine, there it is the easy solution. On the config.yaml
file.
web:
logo: https://cdn.verdaccio.dev/logos/verdaccio-tiny.png <- or any url that you prefer
scriptsbodyBefore:
- '<script>document.addEventListener("DOMContentLoaded", function(){ document.querySelector("[aria-label=\"Support people affected by the war in Ukraine\"]").innerHTML= ""});</script>'
I'd prefer if you keep it.
Features
v5.7.1
5.7.1 (2022-03-08)
Bug Fixes
- deps: update dependency @verdaccio/ui-theme to v6.0.0-6-next.21 (#3050) (ace754d) by @kuoruan
- missing colors on terminal (#3049) (0f51a6c) by @juanpicado
- deps: update dependency dayjs to v1.10.8 (#3036) (1221ffd)
- deps: update dependency express to v4.17.3 (#3039) (21c66f6)
- deps: update dependency minimatch to v5 (#3035) (2ef97d4)
- deps: update dependency verdaccio-htpasswd to v10.3.0 (#3038) (24830e0)
v5.7.0
Bug Fixes
- deps: update dependency @verdaccio/ui-theme to v6.0.0-6-next.20 (#3028) (87e5e74) by @juanpicado
Display CJS icon for commonJS packages, TS for those packages that have types
Feature
- feat: config control for colors in logs (https://github.com/verdaccio/verdaccio/pull/3011) by @osher
Disable colors from logging, also could use EXPERIMENTAL_VERDACCIO_LOGGER_COLORS
environment variable
logs:
{ type: stdout, format: pretty, level: http, colors: false }
v5.6.2
5.6.2 (2022-02-26)
New Feature
It display bagets if the package provides types, ES6 modules or strictly common.js
// package.json
"types: "some string"
"module": "commonjs" or "module"
Bug Fixes
- deps: update dependency @verdaccio/ui-theme to v6.0.0-6-next.18 (#3019) (7cff3f7)
- deps: update dependency pino to v6.14.0 (#3018) (08b72b4)
v5.6.1
5.6.1 (2022-02-26)
Bug Fixes
- deps: update dependency @verdaccio/ui-theme to v6.0.0-6-next.17 (#3014) (f57508d)
v5.6.0
Features
- new environment variable (storage path) (#2993) (681dc82), closes PR#2199 by @osher and ref https://github.com/verdaccio/verdaccio/pull/2199
Add option to set storage from environment variable VERDACCIO_STORAGE_PATH
to replace the config.yaml
storage property.
#### config.yaml
storage: ./storage <--- replace this
Bug Fixes
- deps: update dependency @verdaccio/commons-api to v10.2.0 (#2986) (63fc4d1)
- deps: update dependency @verdaccio/local-storage to v10.2.0 (#2987) (1db0a2e)
- deps: update dependency @verdaccio/readme to v10.3.2 (#2984) (fee3ac6)
- deps: update dependency @verdaccio/streams to v10.2.0 (#2995) (60fea02)
- deps: update dependency marked to v4.0.12 (#2976) (2cd4a3b)
- deps: update dependency verdaccio-audit to v10.2.0 (#2998) (57c4ce5)
- deps: update dependency verdaccio-htpasswd to v10.2.0 (#2999) (25b2212)
v5.5.2
5.5.2 (2022-01-27)
Bug Fixes
- re-opening log files using SIGUSR2 (#2966) (b964c0d) by @marvinthepa
v5.5.1
5.5.1 (2022-01-24)
Bug Fixes
- remove engines restriction from ui-theme dependency (de7713e)
- deps: update dependency marked to v4 (#2956) (5009797)
- deps: update dependency mime to v3 (#2957) (ac4392a)
v5.5.0
Features
TL;DR
- Upgrade @verdaccio-ui-theme (d36b8b1)
- Use backward compatible UI from v6 on v5 (#2912) (b79266d)
- Update dependencies, include 🔒 security flagged ones.
Web User Interface Improvements
The current user interface for this version is exactly the same used on the next major release, the verdaccio/ui repository has been archived, one single UI is much easier to maintain and also to share features between the future major release and the stable one.
The translations were migrated from the source code to the crowdin platform for the User interface which ensure repeated words are not translated twice and also crowding provides a nice interface for contributions, the latest translations are pulled on every release automcatically.
web:
pkgManagers:
- npm
- yarn
- pnpm
login: true
Improve language switch ui and package manager info
- Remove the language switch as autocomplete, add info how to contribute to translations
- Convert info dialog to be able host more information, learn how to use registry with Yarn 2 and add links to documentation.
Bug Fixes
⚠️ The
marked
dependency has been updated to v4 which was marked a security upgrade through the@verdaccio/readme
dependency.
- deps: update all non-major linting dependencies (5.x) (#2885) (23d0bd7)
- deps: update dependency @verdaccio/local-storage to v10.1.1 (#2932) (8c7e39e)
- deps: update dependency @verdaccio/readme to v10.2.1 (#2933) (8a75f8c)
- deps: update dependency async to v3.2.3 (#2934) (e2eb6ce)
- deps: update dependency fast-safe-stringify to v2.1.1 (#2891) (bd738ec)
- deps: update dependency verdaccio-audit to v10.1.1 (#2935) (3a9d773)
- update babel and core dependencies (#2887) (ec98159)
- update docker to v14.18.2 (#2888) (22cfea0)
Announcements
The next month is the talk at Node.js Congress 2022, you can craft your own badge 😊 here, please share it with your colleagues and 👍🏼 if you want like this tweet.
![Screenshot 2022-01-22 165430](https://user-images.githubusercontent.com/558752/150648064-2193a788-4cfb-4ae3-bac6-f6c6be8ab3dd.png)
v5.4.0
Features
add cache-control header to endpoints (#2791) (fd3ad1e
)
Some npm
commands has a response the token
as the body, to void cache those responses we add Cache-Control
as response header.
add rate limit to user api endpoints (#2800) (#2799) (f64e403
)
Add default rate limit to user endpoints, npm token
, npm profile
, npm loding/adduser
to 100 request peer 15 min, customizable via
userRateLimit:
windowMs: 50000
max: 1000
Also X-RateLimit
is part of the response headers.
curl -v http://localhost:4873/-/user/test
...
>
< HTTP/1.1 200 OK
< X-Powered-By: foooo
< Access-Control-Allow-Origin: *
< X-RateLimit-Limit: 1000
< X-RateLimit-Remaining: 999
< Date: Fri, 24 Dec 2021 18:27:20 GMT
< X-RateLimit-Reset: 1640371089
< Content-Type: application/json; charset=utf-8
< ETag: "9bc0d4158c3e2ac5822d39f55e5ceb05"
< Content-Length: 51
< Vary: Accept-Encoding
< Connection: keep-alive
< Keep-Alive: timeout=60
add rate limit to web endpoints (#2799) (c91d6be
) (#2803) (5b1264c
)
The web endpoints that retrieve data from the cache are limited by default 5k request peer 15 min and customizable if your need exceeds the defautls.
web:
title: Verdaccio
rateLimit:
windowMs: 50000
max: 1000
JWT web signature default time reduced to 1 hour (#2787) (1c17d09
)
The JWT token for web has been reduced from 7 days to 1 hour for security reasons. To restore the previous time, use configuration.
User agent is the client by default (#2793) (e5d79ce
)
The user_agent
property has been part of the config file, but undocumented, previous versions send the header User-Agent
was something like Verdaccio/5.x.x
. After this version is disabled and forward the one that comes from the client, also disable 'X-Powered-By
by default. The new user_agent
allows re-enable this feature by using true
or craft your own user agent.
user_agent: true
user_agent: false
user_agent: 'custom user agent'
Bug Fixes
- deps: update dependency @verdaccio/commons-api to v10.1.0 (#2789) (c5c0ef8)
- deps: update dependency body-parser to v1.19.1 (#2788) (46e583f)
v5.3.2
5.3.2 (2021-12-16)
Bug Fixes
v5.3.1
5.3.1 (2021-12-11)
Bug Fixes
- conflict core-js dependency (#2754) (29d4551) @juanpicado
v5.3.0
⚠️ Released as minor to avoid conflicts with a
v5.2.3
which was a mistake 😊 I had to deprecate just in case you notice there is a version in the middle.
Bug Fixes
- markdown anchor links in package readme.md broken #2712 (820c9d5) by @coolsp
- update pnpm and bum up core deps (#2716) (60cd25c)
- deps: update dependency @verdaccio/commons-api to v10.0.2 (#2706) (73d565f)
- deps: update dependency @verdaccio/readme to v10.0.1 (#2708) (41cadcc)
- deps: update dependency @verdaccio/streams to v10.0.1 (#2709) (74d7d02)
- deps: update dependency http-errors to v1.8.1 (#2705) (eee19a5)
- deps: update dependency verdaccio-audit to v10.0.3 (#2710) (8c074e8)
- deps: update dependency verdaccio-htpasswd to v10.0.1 (#2711) (8e28848)
v5.2.3
v5.2.2
5.2.2 (2021-11-08)
Bug Fixes
v5.2.1
5.2.1 (2021-11-08)
Bug Fixes
- deps: update dependency async to v3.2.2 (#2633) (da5d7e9)
- deps: update dependency mime to v2.6.0 (#2634) (089796c)
- deps: update dependency validator to v13.7.0 (#2635) (ef2fbff)
v5.2.0
Features
Bug Fixes
- deps: update dependency clipanion to v3.1.0 (#2561) (6a78ae0)
- deps: update dependency dayjs to v1.10.7 (#2565) (69091d1)
- deps: update dependency pino to v6.13.3 (#2562) (384b3e2)
v5.1.6
5.1.6 (2021-09-21)
Bug Fixes
v5.1.5
5.1.5 (2021-09-17)
Bug Fixes
v5.1.4
5.1.4 (2021-09-07)
Bug Fixes
- npm7 audit fix and bulk endpoint (#2426) (2c59091) @juanpicado
v5.1.3
5.1.3 (2021-08-20)
Bug Fixes
- plugin allow_publish (pkg) got a undefined version (#2315) (ecfc4c3)
- update docker and core dependencies (#2375) (2e995f5)
- update docker base image to v14.17.5 (d63dcc0)
v5.1.2
@@ -0,0 +1,2048 @@
Changelog
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
5.1.2 (2021-07-14)
Bug Fixes
- remove token experiment flag (#2332) (2924054)
- update dependencies (#2291) (b421ed8)
- update dependencies (#2303) (4fe8ddf)
- update dependencies (#2333) (7180338)
- update docker base image node 14.17.1 (#2314) (b8f711a)
- update docker base image node 14.17.3 (2bc5908)
v5.1.1
5.1.1 (2021-06-12)
Bug Fixes
- add logger fatal if fails on startup (#2288) (558dd3f), closes #2287
- improve get headers from request #2190 (#2271) (38ca095)
v5.1.0
Features
- implement search v1 endpoint (#2256) (251bd95)
- tarball url redirect (#1688) (78d04cf)
- update Node.js docker image 14.17.0 (#2247) (4ed7286)
Bug Fixes
v5.0.4
@@ -0,0 +1,2013 @@
Changelog
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
5.0.4 (2021-04-28)
v5.0.3
@@ -0,0 +1,2006 @@
Changelog
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
5.0.3 (2021-04-27)
Bug Fixes
- update @verdaccio/ui-theme (#2207) (ced47d5)
5.0.2 (2021-04-27)
Bug Fixes
5.0.1 (2021-04-10)
Bug Fixes
5.0.0 (2021-04-09)
Features
5.0.0-alpha.7 (2021-04-08)
Bug Fixes
- ui readme missing css (#2174) (f49ca06)
- Upgrade Node from 14.16 to 14.16.1 for security fixes (#2172) (6ab3163), closes /github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V14.md#14
5.0.0-alpha.6 (2021-04-06)
5.0.0-alpha.5 (2021-04-03)
5.0.0-alpha.4 (2021-04-03)
Features
5.0.0-alpha.3 (2021-04-02)
Features
5.0.0-alpha.2 (2021-03-31)
Bug Fixes
5.0.0-alpha.1 (2021-03-30)
Features
5.0.0-alpha.0 (2021-03-29)
⚠ BREAKING CHANGES
Features
- drop node 8 and node 10 (#2142) (43f7043)
- improve url_prefix behavior (#2122) (15bb350)
- npm token support revisited and enabled by default (#2145) (8cc6393)
- upgrade to commander v7 (#2143) (3a1f608)
4.12.0 (2021-03-17)
Features
4.11.3 (2021-03-06)
Bug Fixes
4.11.2 (2021-03-04)
Bug Fixes
4.11.1 (2021-02-25)
Bug Fixes
- upgrade Node from 14.15 to 14.16 for security fixes ([#2104](https://t
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, click this checkbox.
This PR has been generated by Mend Renovate. View repository job log here.