build(deps-dev): bump verdaccio from 6.7.2 to 6.7.4

[dependabot]

Bumps verdaccio from 6.7.2 to 6.7.4.

Release notes

Sourced from verdaccio's releases.

v6.7.4

Patch Changes

• 0205c78: fix: run jwt middleware before middleware plugins

  Register the JWT middleware before middleware plugins are loaded so that req.remote_user (anonymous by default) is available inside a plugin's register_middlewares. The API router keeps its own JWT middleware behind a guard so it is not executed twice.

  Backport of verdaccio/verdaccio#5697

  Closes #5167

v6.7.3

Patch Changes

• f8fdfc2: fix: enforce generated npm token metadata

  Generated npm tokens (POST /-/npm/v1/tokens) stored their readonly and cidr_whitelist restrictions but never enforced them, and deleting a token did not revoke it for the package APIs. A token marked read-only or pinned to a CIDR range could still publish packages and change dist-tags, and a deleted token remained usable.

  Generated tokens now embed a server-issued key (in the JWT claim, or in the encrypted legacy AES payload) and a new enforceGeneratedTokenMetadata middleware looks that key up on each request, rejecting the token when it is missing/revoked, used outside its CIDR whitelist, or used for a write while read-only. Enforcement applies to both AES and JWT API-token modes.

  Note: tokens issued before upgrading carry no key and are not retroactively constrained — regenerate them to apply the restrictions.

• be80623: fix: allow npm token create without readonly/cidr_whitelist

  npm token create in npm >= 11 (and the npm 12 prereleases) rewrote the request body: it no longer sends readonly and only sends cidr_whitelist when --cidr is passed. The POST /-/npm/v1/tokens endpoint required both, so modern npm clients failed with 422 the parameters are not valid.

  The endpoint now defaults readonly to false and cidr_whitelist to [] when they are absent, while still rejecting values of the wrong type.

• 75c85d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.19 → 9.0.0-next-9.20

• d5e5332: chore: update dependencies

  Updates runtime dependencies @verdaccio/ui-theme (9.0.0-next-9.19) and

... (truncated)

Changelog

Sourced from verdaccio's changelog.

6.7.4

Patch Changes

• 0205c78: fix: run jwt middleware before middleware plugins

  Register the JWT middleware before middleware plugins are loaded so that req.remote_user (anonymous by default) is available inside a plugin's register_middlewares. The API router keeps its own JWT middleware behind a guard so it is not executed twice.

  Backport of verdaccio/verdaccio#5697

  Closes #5167

6.7.3

Patch Changes

• f8fdfc2: fix: enforce generated npm token metadata

  Generated npm tokens (POST /-/npm/v1/tokens) stored their readonly and cidr_whitelist restrictions but never enforced them, and deleting a token did not revoke it for the package APIs. A token marked read-only or pinned to a CIDR range could still publish packages and change dist-tags, and a deleted token remained usable.

  Generated tokens now embed a server-issued key (in the JWT claim, or in the encrypted legacy AES payload) and a new enforceGeneratedTokenMetadata middleware looks that key up on each request, rejecting the token when it is missing/revoked, used outside its CIDR whitelist, or used for a write while read-only. Enforcement applies to both AES and JWT API-token modes.

  Note: tokens issued before upgrading carry no key and are not retroactively constrained — regenerate them to apply the restrictions.

• be80623: fix: allow npm token create without readonly/cidr_whitelist

  npm token create in npm >= 11 (and the npm 12 prereleases) rewrote the request body: it no longer sends readonly and only sends cidr_whitelist when --cidr is passed. The POST /-/npm/v1/tokens endpoint required both, so modern npm clients failed with 422 the parameters are not valid.

  The endpoint now defaults readonly to false and cidr_whitelist to [] when they are absent, while still rejecting values of the wrong type.

• 75c85d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.19 → 9.0.0-next-9.20

• d5e5332: chore: update dependencies

... (truncated)

Commits

• 9570db1 chore: release 6.x (#5963)
• 0205c78 fix: run jwt middleware before middleware plugins (#5962)
• 9d924e7 chore: release 6.x (#5950)
• 75c85d5 chore: update verdaccio 6.x dependencies (#5961)
• d5e5332 fix: update core dependencies (#5952)
• be80623 fix: allow npm token create without readonly/cidr_whitelist (#5951)
• f8fdfc2 fix: enforce generated npm token metadata (#5945)
• b491e84 chore: update ci settings
• 3a6c393 chore: update ci settings
• b319f7e fix(deps): update dependency express to v4.22.2 (#5902)
• See full diff in compare view