Verdaccio Files

Minor Changes

• b67a665: feat: require Node.js 22 as the minimum supported version

  Node.js 22 or higher is now required (previously the CLI still accepted Node.js 18, while engines already demanded 20). The CLI refuses to start on older runtimes and engines is set to >=22; Node.js 24 is the recommended version. CI, e2e, and smoke test matrices now cover Node.js 22, 24, and 26. Registry operators on Node.js 18 or 20 must upgrade the runtime before taking this release.

• b67a665: feat: dual CJS + ESM build with exports field, migrate build from babel to vite 8

  Native ESM support. The package now ships both CommonJS (build/**/*.js) and ESM (build/**/*.mjs) outputs and declares an exports field, so import { runServer } from 'verdaccio' resolves a real ES module instead of the CommonJS interop. require('verdaccio') keeps working exactly as before. The verdaccio CLI now runs on the ESM build, which means ESM-only dependencies can be loaded at runtime on every supported Node.js version.

  Build toolchain. Babel has been replaced by vite 8 (rolldown) for transpilation; type declarations are still emitted by TypeScript. This is not observable in the registry behavior, but local workflows changed: yarn start and the debug/ bootstrap scripts now use tsx instead of babel-node/@babel/register.

Patch Changes

• b67a665: fix(deps): update @verdaccio/hooks to 8.1.1

  Restores publish/unpublish webhook notifications when running on the ESM build: hooks 8.1.0 could not send them (the notify client failed silently on every call). The new version replaces the frozen got-cjs fork with got 15 loaded in a way that works from both the ESM and CommonJS builds, and reports delivery failures based on the real HTTP response status.

• b67a665: fix(deps): update @verdaccio/* packages to the 2026-07-25 release batch

  Updates all @verdaccio/* and verdaccio-* dependencies (config 8.1.4, core 8.1.4, auth 8.0.6, middleware 8.0.7, htpasswd/audit 13.0.5, among others). Notably @verdaccio/config 8.1.4 moves to js-yaml 4.3.0, resolving the high-severity advisory GHSA-52cp-r559-cp3m (YAML merge-key chains forcing quadratic CPU consumption).

• 2969ec8: fix: migrate uplink/storage URL parsing to the WHATWG URL API

  Removes the [DEP0169] DeprecationWarning: url.parse() printed at startup on Node.js 22+. The proxy and local-storage layers no longer use the legacy url.parse() / url.format() helpers; uplink URL validation, distfile filename extraction, and the remote-protocol tarball rewrite now go through the standardized URL API. Behavior is unchanged for the absolute HTTP(S) URLs used in practice — the default HTTPS port :443 still normalizes to a match, and invalid uplink URLs are treated as not-valid instead of being parsed leniently.

  Because the WHATWG URL constructor throws on malformed input (unlike the lenient legacy url.parse()), a misconfigured uplink url now fails fast at startup with a clear, credential-redacted error, and a malformed dist.tarball returned by an upstream registry is skipped (with a warning) instead of aborting the package update. Uplink URL validation also now compares the uplink's own port when deciding whether to ignore the default HTTPS port, so an HTTPS uplink on a non-default port no longer matches a default-port tarball.