npm / verdaccio

verdaccio

What changed in verdaccio 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

2 breaking5 security8 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

verdaccio 615 changes

The final Docker image installation requires third-party dependencies to be at least three days old, with Verdaccio packages excluded from the restriction.
6.10.6release notes
Search requires one non-blank text string and returns HTTP 400 with ERR_TEXT_MISSING for missing or invalid text. Unreadable uplink responses end that uplink's results while local results are still returned.
6.10.5release notes

The final Docker image installation disables dependency lifecycle scripts, reducing the risk from third-party install scripts.
6.10.6release notes
Webhook notification templates use Handlebars 4.7.10, which includes a security fix for template injection advisories.
6.10.6release notes
The update fixes trusted-subnet matching for IPv4-mapped IPv6 addresses, addressing an IP spoofing issue when Express resolves trusted proxies.
6.10.6release notes
Requests without credentials or with an unrecognised token now receive 401 Unauthorized instead of 200 with an empty body.
6.10.6release notes
The HTTP stack now resolves qs 6.16.0, fixing query-string denial-of-service vulnerabilities without changing parsing behavior or requiring configuration changes.
6.10.4release notes

Supplied credential fields are validated before invoking the authentication plugin; existing passwords can still be replaced even when they do not meet the current policy.
6.10.6release notes
Requests with missing or non-string credentials, or a null body, are rejected with HTTP 400 instead of reaching the authentication plugin or producing an internal server error.
6.10.6release notes
The endpoint resolves only versions and dist-tags defined by the package; undefined version or tag names return HTTP 404 instead of sometimes causing an internal server error.
6.10.5release notes
When the htpasswd file is reloaded, users removed from it stop authenticating without requiring a restart.
6.10.5release notes
Names that start with an underscore, use @ without a scope, or contain characters that are not URL-friendly are rejected with HTTP 400 instead of being looked up.
6.10.5release notes
Names that cannot be stored as same-named directories on every platform are served from uplinks but not cached locally and cannot be published to local storage.
6.10.5release notes
size and from accept only plain string values; other values fall back to defaults. Only plain string parameters are forwarded to uplinks.
6.10.5release notes
Publishing no longer fails with a request size mismatch when authenticating with a token created by npm token create.
6.10.4release notes