@verdaccio/[email protected]

Minor Changes

• e60fd0a: feat(types): add missing fields to the Version object

@verdaccio/[email protected]

Minor Changes

• f8d763c: feat: add abbreviated versions support

@verdaccio/[email protected]

Patch Changes

• 5c127e6: feat: add server.trustProxy configuration type

@verdaccio/[email protected]

Patch Changes

• 551195f: fix(deps): update all core dependencies

@verdaccio/[email protected]

Minor Changes

• b4f1925: fix: update dependency jsdom to v16 security update

@verdaccio/[email protected]

Patch Changes

• e30035b: fix: regresion wrong new storage path reference

[email protected]

Minor Changes

• 287f452: Eliminating all synchronous calls to bcrypt library.

  Change and update password routines are now fully asynchronous when using bcrypt (which is important, since bcrypt is slow).

[email protected]

Minor Changes

• 49ca26d: feat: allow other password hashing algorithms

  copied from v6 plugins by @greshilov verdaccio/verdaccio#2072

  To avoid a breaking change, the default algorithm is crypt.

  Context

  The current implementation of the htpasswd module supports multiple hash formats on verify, but only crypt on sign in.
  crypt is an insecure old format, so to improve the security of the new verdaccio release we introduce the support of multiple hash algorithms on sign in step.

  New hashing algorithms

  The new possible hash algorithms to use are bcrypt, md5, sha1. You can read more about them here.

  Two new properties are added to auth section in the configuration file:

  • algorithm to choose the way you want to hash passwords.
  • rounds is used to determine bcrypt complexity. So one can improve security according to increasing computational power.

  Example of the new auth config file section:

  auth:
  htpasswd:
    file: ./htpasswd
    max_users: 1000
    # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
    algorithm: bcrypt
    # Rounds number for "bcrypt", will be ignored for other algorithms.
    rounds: 10

[email protected]

Minor Changes

• b5cfaf6: feat: refactor types and typescript 4

Patch Changes

• @verdaccio/[email protected]

[email protected]

Patch Changes

• Updated dependencies [b5cfaf6]
  • @verdaccio/[email protected]