chore(deps-dev): bump verdaccio from 6.10.0 to 6.10.3

[dependabot]

Bumps verdaccio from 6.10.0 to 6.10.3.

Release notes

Sourced from verdaccio's releases.

v6.10.3

Patch Changes

• 98b58ef: fix: do not fetch client-controlled dist.tarball urls off-uplink @​cOmrade3267

  Only fetch a tarball url that a configured uplink actually serves. Off-uplink urls are fetched without uplink credentials and only for uplink-synced packages (recorded in _distfiles); a locally published package returns 404 instead of being fetched. Prevents sending an uplink Authorization header to an unrelated host.

v6.10.2

Patch Changes

• 6d972d1: fix: resolve fast-uri and brace-expansion security advisories

  fast-uri 3.1.6. Bumps the ajv/fast-uri resolution from 3.1.5 to 3.1.6, which fixes four high-severity advisories in the URI parser used by ajv for schema format validation: host confusion via skipped IDN canonicalization (GHSA-5jgf-p345-68v8), SSRF via malformed IPv6 normalization (GHSA-f65p-4m7j-42xc), SSRF via repeated hostname percent-decoding (GHSA-fph4-wmhf-6fwf), and host confusion via percent-encoded scheme normalization (GHSA-jqff-g426-hqxp).

  brace-expansion DoS cleanup. Updates the remaining vulnerable brace-expansion trees (1.1.11 → 1.1.18, 2.0.1 → 2.1.4) for GHSA-mh99-v99m-4gvg and drops the temporary audit ignores that covered them while the patched releases were still quarantined by the minimal-age gate.

• 6d972d1: chore: update e2e library

• ca00ee0: fix: stop re-compressing tarballs for gzip-accepting clients

  mime-db marks application/octet-stream as compressible, so the compression middleware re-gzipped every (already gzipped) .tgz download for clients that accept gzip — npm and undici do by default — wasting CPU on every download and stripping the Content-Length header. Tarball responses are now excluded from compression; JSON metadata responses stay compressed.

  Measured on a 30 MB tarball: ~18x less server CPU and ~20x faster downloads, with slightly fewer bytes on the wire (gzip over gzip nets negative).

• d4b8199: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.28 → 9.0.0-next-9.30

• d94ebff: fix: validate the scope segment on the web package endpoints

... (truncated)

Changelog

Sourced from verdaccio's changelog.

6.10.3

Patch Changes

• 98b58ef: fix: do not fetch client-controlled dist.tarball urls off-uplink

  Only fetch a tarball url that a configured uplink actually serves. Off-uplink urls are fetched without uplink credentials and only for uplink-synced packages (recorded in _distfiles); a locally published package returns 404 instead of being fetched. Prevents sending an uplink Authorization header to an unrelated host.

6.10.2

Patch Changes

• 6d972d1: fix: resolve fast-uri and brace-expansion security advisories

  fast-uri 3.1.6. Bumps the ajv/fast-uri resolution from 3.1.5 to 3.1.6, which fixes four high-severity advisories in the URI parser used by ajv for schema format validation: host confusion via skipped IDN canonicalization (GHSA-5jgf-p345-68v8), SSRF via malformed IPv6 normalization (GHSA-f65p-4m7j-42xc), SSRF via repeated hostname percent-decoding (GHSA-fph4-wmhf-6fwf), and host confusion via percent-encoded scheme normalization (GHSA-jqff-g426-hqxp).

  brace-expansion DoS cleanup. Updates the remaining vulnerable brace-expansion trees (1.1.11 → 1.1.18, 2.0.1 → 2.1.4) for GHSA-mh99-v99m-4gvg and drops the temporary audit ignores that covered them while the patched releases were still quarantined by the minimal-age gate.

• 6d972d1: chore: update e2e library

• ca00ee0: fix: stop re-compressing tarballs for gzip-accepting clients

  mime-db marks application/octet-stream as compressible, so the compression middleware re-gzipped every (already gzipped) .tgz download for clients that accept gzip — npm and undici do by default — wasting CPU on every download and stripping the Content-Length header. Tarball responses are now excluded from compression; JSON metadata responses stay compressed.

  Measured on a 30 MB tarball: ~18x less server CPU and ~20x faster downloads, with slightly fewer bytes on the wire (gzip over gzip nets negative).

• d4b8199: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.28 → 9.0.0-next-9.30

... (truncated)

Commits

• c664334 chore: release 6.x (#6223)
• 98b58ef fix: do not fetch client-controlled dist.tarball URLs off-uplink (#6218)
• dc1adc6 chore: release 6.x (#6198)
• d4b8199 chore: update verdaccio 6.x dependencies (#6197)
• d94ebff fix: validate the scope segment on the web package endpoints (#6201)
• 6d972d1 chore: bump @​verdaccio/e2e-cli to 3.2.0 to activate the tarball contr… (#6200)
• ca00ee0 perf(6.x): stop re-compressing tarballs and run the e2e battery from @​verdacc...
• e3bf392 chore: release 6.x (#6166)
• 1cd7034 chore: update verdaccio 6.x dependencies (#6173)
• f82cd04 chore: update verdaccio 6.x dependencies (#6172)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #177.