What's new in Verdaccio 7

Verdaccio 7 puts publishing under your control: a version can be staged for review before anyone can install it, accounts and publishes can require a second factor, and ownership checks now cover deprecate, unpublish and dist-tag changes as well. The web UI gains a home toolbar, a guided first publish and bun support; plugins can be pure ESM and storage plugins can use a promise-based API; the runtime moves to Node.js 24 and Express 5. Your day-to-day install and publish commands stay the same. What changes is how much you can control, and how you extend the registry.

New to Verdaccio? It is a free, open source npm-compatible registry you host yourself to share internal packages, cache public dependencies and test publishes locally. It works with npm, pnpm and Yarn. The getting-started guide covers the basics.

More control over publishing

Review a version before it becomes installable

Experimental staged publishing lets a pipeline upload a version for a maintainer to review. The package becomes installable only after approval. This adds a review step between producing an artifact and making it available to consumers.

The feature is off by default, behind the stage flag, and requires npm 11.17 or newer. See the staged publishing guide for configuration, permissions and the review commands. A version status endpoint reports whether a given version is published or staged, so a pipeline can wait for the approval before announcing a release.

Add a second factor to account and publishing flows

Experimental two-factor authentication uses time-based one-time passwords from an authenticator app. Depending on the selected mode, it protects account operations and publishing as well as login.

It is also off by default, behind the tfa flag. Follow the two-factor authentication guide to check client and storage requirements before enabling it.

Both features are still experimental: test them with your release workflow and share feedback before relying on them in production. Neither changes the default publishing flow unless you opt in.

Ownership and unpublish checks on every change

With publish.check_owners enabled, the ownership check now also covers npm deprecate, version unpublish and dist-tag changes, not only publish. Removing a version requires the unpublish permission on its own route; a publish request can no longer act as a removal based on the metadata it carries.

Publishing is also stricter about tarballs: invalid attachment names are rejected before any metadata is saved, and an upload is only recorded once the tarball is fully written. A failed publish no longer leaves a version without a tarball that blocks a corrected publish of the same version.

A new foundation for plugins

Load pure ESM plugins

Verdaccio 7 supports pure ESM plugins, so plugin authors no longer need a CommonJS wrapper just to load their plugin. This makes it easier to use dependencies that have moved to ESM.

Existing plugins still need to be checked against the new runtime, especially middleware plugins affected by Express 5. The plugin documentation and migration guide cover those details.

Write storage plugins with async functions

The storage API is now promise-based, allowing storage plugins to use async/await instead of callbacks. Existing callback-based plugins can run through a compatibility adapter while their maintainers migrate.

If you maintain a storage plugin, the callback-to-async migration guide walks through the changes. If you use a third-party storage plugin, check its compatibility before upgrading your registry.

Faster installs with password authentication

Clients that send a username and password on every request made the htpasswd plugin run a bcrypt verification per tarball. Setting verify_cache_ms reuses a successful verification for that long, so one install no longer costs one hash check per package. It is off by default; see authentication for the option.

Improvements you may already know from 6.x

Several improvements included in Verdaccio 7 have also reached 6.x through backports or shared packages. If you keep your 6.x registry updated, some of these will already look familiar.

A refreshed web interface

The Web UI includes dark mode, sorting packages by update time, improved scoped-package search, and refreshed login, signup and password screens. Package detail tabs also work better across desktop and mobile layouts.

The home page gains a toolbar to filter packages by name, description or keywords, pick a scope and sort by name or most recent publication. An empty registry shows a step-by-step welcome card with a tab for each package manager listed in web.pkgManagers, now including bun. The settings dialog shows how much of each language is translated, untranslated strings fall back to English, and changing a password moves to the signed-in account menu. See the web configuration for the new options.

The shared @verdaccio/ui-theme package lets compatible UI fixes reach both release lines.

Package filtering and registry notifications

The package filter supports allow and block rules, glob patterns, and excluding deprecated versions. It gives teams control over the packages and versions their registry serves, alongside the existing read and publish permissions.

Notifications cover both publish and unpublish events, so your automation can react when a version is added or removed. See notifications for configuration examples.

More reliable search and downloads

This release line also includes fixes around scoped-package search, search with legacy storage plugins, and tarball downloads across multiple uplinks. Search requests have rate limits, bounded pagination and batched access checks, and searches forwarded to an uplink keep its configured subpath and authentication headers. Proxy and download fixes improve error handling and cleanup when an upstream request fails.

The release tracker records the individual changes and backports if you need to check a particular fix.

What to review before upgrading

Verdaccio 7 changes the runtime and removes several deprecated interfaces. The main things to check are:

• Node.js 24 or newer. Update the runtime used by your deployment.
• YAML configuration. JSON and JavaScript configuration files are no longer accepted.
• Authentication. Package API requests require Bearer tokens. Old .npmrc entries using _auth must move to _authToken. The login routes still accept Basic, so npm login, yarn npm login and pnpm login keep working for existing users.
• Server secret. The server secret must be 32 characters; check it before switching versions.
• Plugins and embedded servers. Express 5 changes middleware route syntax, and the programmatic API has changed. Prefer the named runServer export when embedding Verdaccio.
• Removed endpoints. The legacy /-/all search endpoint and star/unstar support are gone.

The migration guide from Verdaccio 6 to 7 explains the symptoms and fixes, including storage compatibility and rollback considerations. Test with a copy of your configuration and storage before changing a working registry.

Try Verdaccio 7

Verdaccio 7 is the latest release on npm. With Node.js 24 or newer:

pnpm dlx verdaccio

Or use npm:

npx --yes verdaccio

These commands use Verdaccio's normal configuration lookup. If you already have a local registry, pass --config /path/to/test/config.yaml and point that test configuration at separate storage. Once it is running, open http://localhost:4873.

For container deployments, follow the Docker or Helm guide. The verdaccio/verdaccio:7 image is also published as latest; pin verdaccio/verdaccio:6 to stay on the previous line.

If this is your first Verdaccio instance, continue with the installation guide and your package manager's setup instructions: npm, pnpm or Yarn.

Tell us how the release works with your plugins and publishing workflow in GitHub Discussions or on Discord. Report reproducible problems in GitHub Issues.

Thanks

Thanks to everyone who contributed to the Verdaccio 7 release line and the related 6.x backports.

A special mention goes to Marc Bernard (@mbtools) for the sustained work on Verdaccio over the last years, with more than 300 merged pull requests: reviews, fixes across the registry and the plugins, and the ownership and authorization hardening that ships in this release.

You can follow the full release checklist in Verdaccio 7 Release Notes.

Sponsors

Thanks to the sponsors that provide the tools and services the project runs on: Docker for the image hosting, Crowdin for the translations platform, BrowserStack for cross-browser testing JetBrains for the IDE licences and Mend for moving Verdaccio to the Renovate Community (OSS) plan, which gives the extra resources to keep the dependencies of every branch up to date, and Socket for the free Business plan that scans every pull request for supply-chain risks. And to OpenAI and Anthropic for supporting the project with subscriptions to their tools, which helped the maintainers move faster on reviews, documentation and this release.

Open Collective

Thanks to the donors on Open Collective who fund the project directly, among them Kyle Smith, Third Iron, Sterfive and LerNetz AG.

Verdaccio is maintained by volunteers and funded by its users. If your team relies on it, consider sponsoring the project on Open Collective: the contributions pay for infrastructure and let maintainers spend time on releases like this one.