Baike.dev
Log in
Back to tool/Back to issues
#5680·verdaccio

Verdaccio 7 Release Notes

Author: juanpicadoCreated Mar 22, 2026Updated Jul 26, 2026
Labelsdev: work in progress7.x branch (next)

[!IMPORTANT] This release note is maintained from merged PRs. It focuses on changes users, plugin authors, and downstream distributions need to know about for Verdaccio 7.

New Compared With 6.x

Verdaccio 7 is mainly a platform and distribution major. Compared with 6.x, the important differences are:

  • Express 5 is now the runtime baseline, so middleware plugins may need route wildcard and sendFile adjustments.
  • Node.js 24 is the minimum supported runtime for this line.
  • Verdaccio 7 uses an explicit release rollout: install with verdaccio@7, npm latest moves a few days later, and Docker publishes explicit version tags without Docker latest during the initial rollout.
  • The release branch moved to pnpm and the published package layout is built around reusable @verdaccio/* packages. The dual ESM/CJS package output was also backported to 6.x via #6050.
  • Downstream distributions can reuse the server and CLI composition instead of forking, including custom Storage integration.
  • Storage plugins can move to the promise-based async API, while existing callback/stream-based storage plugins remain supported through a compatibility wrapper.
  • Config loading is stricter: YAML-only config files and configPath instead of the deprecated self_path.
  • Deprecated registry/runtime APIs were removed, including old AES helpers and star/unstar support.
  • Logger packages were consolidated into @verdaccio/logger.

Some user-facing work listed below has already been backported to 6.x, including dual ESM/CJS package output, package filtering, publish/unpublish notification hooks, WebUI login 401 handling, the external e2e CLI workflow, and Web UI improvements delivered through the shared @verdaccio/ui-theme package.

What's Included

Runtime And Platform

  • BREAKING feat: upgrade to Express 5 (#5524) - by @juanpicado
  • BREAKING chore(deps): update Node.js to v24 (#5615, #5637) - by @renovate
  • feat: migrate to @verdaccio/proxy based on got (#5646) - by @juanpicado
  • feat: replace got-cjs and node-fetch with got v14 (#5746) - by @juanpicado
  • chore: map uplink tarball HTTP errors to Verdaccio errors instead of leaking raw got errors; 401 becomes unauthorized, 403 preserves upstream forbidden details, 404 becomes not found, and other upstream statuses become bad uplink status errors (#6022) - by @mbtools

Build And Tooling

  • BREAKING feat: replace Babel/esbuild with Vite dual-format builds (#5643) - by @juanpicado. Dual ESM/CJS package output was backported to 6.x via #6050.
  • feat: migrate package management and CI from Yarn to pnpm (#5748) - by @juanpicado
  • chore: replace the old e2e CLI workspace with @verdaccio/e2e-cli (#5678, #5679) - by @juanpicado. Backported to 6.x via #5675.
  • chore: replace deprecated Vite rollupOptions usage with rolldownOptions (#5676) - by @mbtools
  • chore: generate corrupted package fixtures at runtime so tooling no longer scans invalid package.json files (#5864) - by @juanpicado

Configuration

  • feat(config): extend ConfigBuilder with methods for web, listen, https, publish, flags, notify, middlewares, filters, maxBodySize, userRateLimit, urlPrefix, and i18n (#5805) - by @juanpicado
  • BREAKING feat: remove deprecated self_path config property in favor of configPath (#5850) - by @juanpicado
  • BREAKING feat: only accept YAML config files (.yaml / .yml) (#5851) - by @juanpicado
  • fix: handle missing Host header in URL basename resolution (#5641) - by @juanpicado

Web And UI

  • feat(ui): replace Rematch with React context and SWR, add dark mode support, refresh auth pages, and add contributors/support content to the info dialog (#5563) - by @juanpicado
  • feat(web): add web.assetFolder for files served under /-/assets/ (#5653) - by @mbtools
  • feat(web): sort packages by update time (#5659) - by @mbtools
  • fix(web): search component improvements for path-based queries, scoped package decoding, local-only search clicks, empty states, and responsive tabs (#5647) - by @juanpicado
  • feat(web): auto-detect the search response shape in the Web UI and remove the old searchRemote flag (#5801) - by @juanpicado
  • feat(web): @verdaccio/ui-theme is now shared by the 6.x and 7.x lines, so compatible Web UI fixes and improvements can continue landing in both release lines.
  • BREAKING fix(api): remove the deprecated npm search /-/all endpoint from Verdaccio 7; clients should use /-/v1/search.
  • fix(api): rate limit and bound the npm /-/v1/search endpoint, including clamped pagination, batched package access checks, and npm-compatible search result metadata. Backported to 6.x via #6005 - by @juanpicado.
  • fix(ui-components): JSON viewer fixes (#5651) - by @mbtools
  • chore(middleware): move UI options from inline script to /-/static/ui-options.js (#5684) - by @mbtools

API, Storage, And Distribution

  • refactor: use ESM-style lodash-es imports across packages (#5751) - by @juanpicado
  • feat: support pure ESM plugins through the async plugin loading path and CJS/ESM interop in storage/plugin loading - by @juanpicado
  • refactor: @verdaccio/node-api no longer depends on @verdaccio/server directly and expects the server factory from the caller (#5758) - by @juanpicado
  • BREAKING fix: the programmatic API is now async; consumers must await runServer(...) before calling .listen() (#5808) - by @juanpicado
  • chore: export server composition and CLI helpers for downstream distributions (#5932) - by @juanpicado
  • feat: support the async promise-based storage API while keeping legacy callback/stream-based storage plugins backward compatible through a thin wrapper (#5933) - by @juanpicado

Logging

  • BREAKING feat: combine @verdaccio/logger-commons and @verdaccio/logger-prettify into @verdaccio/logger (#5657) - by @juanpicado

Documentation

  • docs: add Docker examples for Verdaccio 7, including reverse proxy, plugin, and Kubernetes Helm examples (#5936) - by @juanpicado
  • docs: prepare the Verdaccio 7 release documentation PR (#6065) and the Helm chart release PR (verdaccio/charts#198).

Backported To 6.x

These are included in the 7.x line, but they are not unique Verdaccio 7 features because they were also backported to 6.x.

Breaking Changes

Express 5

Verdaccio now runs on Express 5. If you use custom middleware plugins, be aware of these changes:

  • Route wildcards use {*all} syntax instead of *; req.params may return arrays instead of strings.
  • The send package handles dotfile detection differently on absolute paths; plugins using res.sendFile() with absolute paths should switch to res.sendFile(filename, { root }).
  • http-errors no longer accepts non-error status codes, such as 304, without a warning.

Build System

The build pipeline moved from Babel/esbuild to Vite 8. Packages now publish dual ESM and CJS outputs with TypeScript declarations.

  • Package exports fields changed; update deep imports to supported entry points.
  • ESM is the primary format; CJS remains available for compatibility.

Logger Consolidation

@verdaccio/logger-commons and @verdaccio/logger-prettify were merged into @verdaccio/logger.

diff
- import { ... } from '@verdaccio/logger-commons';
- import { ... } from '@verdaccio/logger-prettify';
+ import { ... } from '@verdaccio/logger';

Relocated Plugins

The following plugins were relocated from the monorepo to their own repositories:

Node.js Requirement

  • Minimum Node.js version is now Node.js 24.
  • crypto.pseudoRandomBytes, removed in Node.js 24, was replaced with crypto.randomBytes.

Release Rollout

  • BREAKING / RELEASE PROCESS Verdaccio 7 is published under the explicit 7 tag first. It will not become the npm latest dist-tag immediately; the latest tag will move a few days later after the release has had time to settle.
  • Docker images are published with explicit version tags such as 7 or an exact version. Docker latest is not published for this release line during the initial rollout.
  • Helm users should pin the Verdaccio 7 image tag explicitly. The chart release is tracked in verdaccio/charts#198.

Configuration Loading

  • Config files must be YAML (.yaml / .yml). JSON and JS config loading was removed.
  • New server options:
    • server.dotfiles controls requests to dotfile paths (deny | ignore | allow; default deny).
    • server.hideStaticLogs suppresses /-/static/ request logging; default true.

Removed Registry APIs

  • BREAKING feat: remove deprecated AES encryption helpers (#5744) - by @juanpicado
  • BREAKING feat: remove star/unstar support because npm 12 removed it on the client side (#5930) - by @juanpicado
  • BREAKING the deprecated npm search /-/all endpoint was removed in Verdaccio 7. Use /-/v1/search; Verdaccio 6.x still keeps /-/all as deprecated.

Programmatic API

  • BREAKING runServer(...) is now async and returns a Promise. Consumers using Verdaccio as a Node.js module must await runServer(...) before using the returned server/app.
  • BREAKING config.self_path was removed from the programmatic config surface; use config.configPath.
diff
- const app = runServer(config);
+ const app = await runServer(config);
  app.listen(4873);

Plugin Loading

  • Verdaccio 7 supports pure ESM plugins through async plugin loading and CJS/ESM interop. Plugin authors can publish ESM-only plugins, but should still verify package exports, default exports, and async initialization behavior against Verdaccio 7.
  • Storage plugins can use the async promise-based storage API. Existing callback/stream-based storage plugins are detected and wrapped for backward compatibility, so existing storage integrations should continue working while plugin authors migrate. Dedicated migration documentation is still pending.

Dependency Upgrades

  • fix(deps): update dependency express to v5 (#5622) - by @renovate
  • chore(deps): update Vite to v8.0.16 for security fixes (#5970) - by @renovate
  • chore(deps): update Vite to v8.1.0 (#6000) - by @renovate
  • fix(deps): update core Verdaccio dependencies (#5742 - by @renovate; #5954, #5955, #6001 - by @github-actions)
  • fix(deps): update dependency lodash-es to v4.18.1 for security fixes (#5860) - by @renovate

Try It Out

Install Verdaccio 7 from npm:

bash
npm install -g verdaccio@7

Or run it with Docker:

bash
docker run -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio:7

Please report any issues at https://github.com/verdaccio/verdaccio/issues.

Contributors

@juanpicado @mbtools @moglerdev @tmota900 @vsugrob @github-actions

Additional Contributions

[!NOTE] PRs without the 7.x branch (next) label.

  • feat: migrate to Vite 8 (#5633) - by @juanpicado [ui, maintenance]
  • feat: static files returning 404 after Express 5 upgrade (#5639) - by @juanpicado [config]
  • chore: update Vitest to 4.1.0 and coverage tooling (#5656, #5662) - by @juanpicado, @mbtools [maintenance]
  • chore: remove old plugins (#5665) - by @juanpicado [maintenance]
  • fix(middleware): stream is not readable (HTTP 500) (#5655) - by @mbtools [express, middleware]
  • chore: update deps for tools/helpers (#5664) - by @mbtools [maintenance]
  • chore: update Open Collective avatars (#5658) - by @mbtools [readme, maintenance]
  • chore: fix Vite config for search-indexer (#5663) - by @mbtools [maintenance]
  • chore(types): replace self-reference and remove unused type (#5661) - by @mbtools [maintenance]

Source: verdaccio/verdaccio

View original on GitHubView discussion on GitHub