verdaccio/verdaccio (verdaccio)
### [`v5.31.0`](https://togithub.com/verdaccio/verdaccio/releases/tag/v5.31.0)
[Compare Source](https://togithub.com/verdaccio/verdaccio/compare/v5.30.3...v5.31.0)
(đī¸ hey renovate users, read this)
âšī¸ Important changes added to the `.verdaccio-db.json` and token signature for users that run on Node.js 22 or higher (in the future đ ) please read
https://verdaccio.org/docs/configuration/#.verdaccio-db
TLDR:
- Enforced for users that runs verdaccio **via npmjs**, for all Docker image isuers, verdaccio uses Node.js LTS 21 and the secret migration is **voluntary** until next major release.
- For **Node.js 21** or lower a new *deprecation* will appear ` [VERWAR007] VerdaccioDeprecation: the secret length is too lon... ` to remove it please read the link above
- For **Node.js 22** if you have already a storage with `.verdaccio-db.json` and the token inside does not complies with the length (read link above) **the application startup will fail with fatal error (`Error: Invalid storage secret key length, must be 32 characters long but is....`)**
In both cases by updating the *secret* all previously tokens will get invalid, in your benefit a new legacy signature will be applied and is more secure than the old one (generating tokens with salt).
For existing installations that have no issues by invalidating tokens is recommended to add to the `config.yaml` the following setup, this will automatically generate a new the secret once is started, could be removed aftewards, if all went succesfull the `[VERWAR007]` deprecation will not be displayed anymore.
```yaml
security:
api:
migrateToSecureLegacySignature: true
```
Any new installation should not worry about this, new token signature and secret (32 characters) is applied by default.
##### Features
- add property forceMigrateToSecureLegacySignature ([#4625](https://togithub.com/verdaccio/verdaccio/issues/4625)) ([2941522](https://togithub.com/verdaccio/verdaccio/commit/2941522099fabb4d58280672191a2d95193f825c)) [https://github.com/verdaccio/verdaccio/issues/4601](https://togithub.com/verdaccio/verdaccio/issues/4601)
##### Bug Fixes
- **deps:** update dependency express to v4.19.2 ([#4596](https://togithub.com/verdaccio/verdaccio/issues/4596)) ([4123dbc](https://togithub.com/verdaccio/verdaccio/commit/4123dbc8bd9a77bccc81d1947042e141793c79d1))
Configuration
đ Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
đĻ Automerge: Disabled by config. Please merge this manually once you are satisfied.
âģ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
đ Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
This PR contains the following updates:
5.30.3->5.31.0Release Notes
verdaccio/verdaccio (verdaccio)
### [`v5.31.0`](https://togithub.com/verdaccio/verdaccio/releases/tag/v5.31.0) [Compare Source](https://togithub.com/verdaccio/verdaccio/compare/v5.30.3...v5.31.0) (đī¸ hey renovate users, read this) âšī¸ Important changes added to the `.verdaccio-db.json` and token signature for users that run on Node.js 22 or higher (in the future đ ) please read https://verdaccio.org/docs/configuration/#.verdaccio-db TLDR: - Enforced for users that runs verdaccio **via npmjs**, for all Docker image isuers, verdaccio uses Node.js LTS 21 and the secret migration is **voluntary** until next major release. - For **Node.js 21** or lower a new *deprecation* will appear ` [VERWAR007] VerdaccioDeprecation: the secret length is too lon... ` to remove it please read the link above - For **Node.js 22** if you have already a storage with `.verdaccio-db.json` and the token inside does not complies with the length (read link above) **the application startup will fail with fatal error (`Error: Invalid storage secret key length, must be 32 characters long but is....`)** In both cases by updating the *secret* all previously tokens will get invalid, in your benefit a new legacy signature will be applied and is more secure than the old one (generating tokens with salt). For existing installations that have no issues by invalidating tokens is recommended to add to the `config.yaml` the following setup, this will automatically generate a new the secret once is started, could be removed aftewards, if all went succesfull the `[VERWAR007]` deprecation will not be displayed anymore. ```yaml security: api: migrateToSecureLegacySignature: true ``` Any new installation should not worry about this, new token signature and secret (32 characters) is applied by default. ##### Features - add property forceMigrateToSecureLegacySignature ([#4625](https://togithub.com/verdaccio/verdaccio/issues/4625)) ([2941522](https://togithub.com/verdaccio/verdaccio/commit/2941522099fabb4d58280672191a2d95193f825c)) [https://github.com/verdaccio/verdaccio/issues/4601](https://togithub.com/verdaccio/verdaccio/issues/4601) ##### Bug Fixes - **deps:** update dependency express to v4.19.2 ([#4596](https://togithub.com/verdaccio/verdaccio/issues/4596)) ([4123dbc](https://togithub.com/verdaccio/verdaccio/commit/4123dbc8bd9a77bccc81d1947042e141793c79d1))Configuration
đ Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
đĻ Automerge: Disabled by config. Please merge this manually once you are satisfied.
âģ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
đ Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.