# What changed in verdaccio

> 15 changes in verdaccio 6 from its official release notes, upgrade guides and advisories: 2 breaking, 5 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/verdaccio/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## verdaccio 6

### Breaking changes

- The final Docker image installation requires third-party dependencies to be at least three days old, with Verdaccio packages excluded from the restriction. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- Search requires one non-blank text string and returns HTTP 400 with ERR_TEXT_MISSING for missing or invalid text. Unreadable uplink responses end that uplink's results while local results are still returned. (6.10.5) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.5)

### Security

- The final Docker image installation disables dependency lifecycle scripts, reducing the risk from third-party install scripts. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- Webhook notification templates use Handlebars 4.7.10, which includes a security fix for template injection advisories. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- The update fixes trusted-subnet matching for IPv4-mapped IPv6 addresses, addressing an IP spoofing issue when Express resolves trusted proxies. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- Requests without credentials or with an unrecognised token now receive 401 Unauthorized instead of 200 with an empty body. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- The HTTP stack now resolves qs 6.16.0, fixing query-string denial-of-service vulnerabilities without changing parsing behavior or requiring configuration changes. (6.10.4) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.4)

### Fixes and other changes

- Supplied credential fields are validated before invoking the authentication plugin; existing passwords can still be replaced even when they do not meet the current policy. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- Requests with missing or non-string credentials, or a null body, are rejected with HTTP 400 instead of reaching the authentication plugin or producing an internal server error. (6.10.6) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.6)
- The endpoint resolves only versions and dist-tags defined by the package; undefined version or tag names return HTTP 404 instead of sometimes causing an internal server error. (6.10.5) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.5)
- When the htpasswd file is reloaded, users removed from it stop authenticating without requiring a restart. (6.10.5) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.5)
- Names that start with an underscore, use @ without a scope, or contain characters that are not URL-friendly are rejected with HTTP 400 instead of being looked up. (6.10.5) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.5)
- Names that cannot be stored as same-named directories on every platform are served from uplinks but not cached locally and cannot be published to local storage. (6.10.5) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.5)
- size and from accept only plain string values; other values fall back to defaults. Only plain string parameters are forwarded to uplinks. (6.10.5) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.5)
- Publishing no longer fails with a request size mismatch when authenticating with a token created by npm token create. (6.10.4) — [release notes](https://github.com/verdaccio/verdaccio/releases/tag/v6.10.4)