@verdaccio/core 9.0.0-next-9.15 → 9.0.0-next-9.16

package/build/file-utils.d.ts

@@ -14,3 +14,39 @@ export declare function createTempFolder(prefix: string): Promise<string>;
  * @returns
  */
 export declare function createTempStorageFolder(prefix: string, folder?: string): Promise<string>;
+/**
+ * Resolve a safe path within a base directory, preventing directory traversal attacks.
+ *
+ * This function provides security against path traversal by:
+ * - URL decoding the input path
+ * - Resolving the full absolute path
+ * - Checking that the resolved path stays within the base directory
+ * - Rejecting paths containing '..' that would escape the base directory
+ * - Rejecting absolute paths that bypass the base directory
+ *
+ * @param basePath The base directory that constrains file access
+ * @param requestPath The requested path from user input (may be URL-encoded)
+ * @returns The resolved safe absolute path or null if the path is unsafe/invalid
+ * @security Prevents directory traversal attacks by validating resolved paths
+ */
+export declare function resolveSafePath(basePath: string, requestPath?: string): string | null;
+/**
+ * Sanitize a user-provided path while preserving directory separators.
+ *
+ * The web middleware uses this for `/-/assets/{*all}` which may include
+ * subfolders (e.g. `logos/verdaccio.svg`). We sanitize each path segment
+ * independently so `/` remains a real directory boundary.
+ *
+ * TODO: `sanitize-filename` silently rewrites segments instead of rejecting
+ * them (`file\0.txt` -> `file.txt`, `CON.svg` -> `.svg`, oversized segments
+ * truncated). Not exploitable today, but surprising; prefer 404 on destructive
+ * rewrite.
+ * TODO: `=== '..'` check is whitespace-strict — ` ..` / `..  ` slips past it.
+ * Use `path.normalize` before splitting, or `segment.trim() === '..'`.
+ * TODO: largely redundant with `resolveSafePath` on POSIX; the dep mainly earns
+ * its keep on Windows. Consider an inline `[<>:"|?*\0]` regex to drop the dep.
+ *
+ * @param filename The user-provided filename/path to sanitize.
+ * @returns The sanitized filename/path.
+ */
+export declare function sanitizeFilename(filename: string): string;

package/build/file-utils.js

@@ -4,11 +4,15 @@ let node_os = require("node:os");
 node_os = require_runtime.__toESM(node_os);
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path);
+let sanitize_filename = require("sanitize-filename");
+sanitize_filename = require_runtime.__toESM(sanitize_filename);
 //#region src/file-utils.ts
 var file_utils_exports = /* @__PURE__ */ require_runtime.__exportAll({
 	Files: () => Files,
 	createTempFolder: () => createTempFolder,
-	createTempStorageFolder: () => createTempStorageFolder
+	createTempStorageFolder: () => createTempStorageFolder,
+	resolveSafePath: () => resolveSafePath,
+	sanitizeFilename: () => sanitizeFilename
 });
 var Files = { DatabaseName: ".verdaccio-db.json" };
 /**
@@ -31,6 +35,61 @@ async function createTempStorageFolder(prefix, folder = "storage") {
 	await (0, node_fs_promises.mkdir)(storageFolder);
 	return storageFolder;
 }
+/**
+* Resolve a safe path within a base directory, preventing directory traversal attacks.
+*
+* This function provides security against path traversal by:
+* - URL decoding the input path
+* - Resolving the full absolute path
+* - Checking that the resolved path stays within the base directory
+* - Rejecting paths containing '..' that would escape the base directory
+* - Rejecting absolute paths that bypass the base directory
+*
+* @param basePath The base directory that constrains file access
+* @param requestPath The requested path from user input (may be URL-encoded)
+* @returns The resolved safe absolute path or null if the path is unsafe/invalid
+* @security Prevents directory traversal attacks by validating resolved paths
+*/
+function resolveSafePath(basePath, requestPath) {
+	try {
+		if (!requestPath || requestPath === "") return null;
+		const decoded = decodeURIComponent(requestPath);
+		if (node_path.default.isAbsolute(decoded)) return null;
+		const baseResolved = node_path.default.resolve(basePath);
+		const reqResolved = node_path.default.resolve(baseResolved, decoded);
+		const baseComparable = process.platform === "win32" ? baseResolved.toLowerCase() : baseResolved;
+		const reqComparable = process.platform === "win32" ? reqResolved.toLowerCase() : reqResolved;
+		if (reqComparable !== baseComparable && !reqComparable.startsWith(baseComparable + node_path.default.sep)) return null;
+		return reqResolved;
+	} catch {
+		return null;
+	}
+}
+/**
+* Sanitize a user-provided path while preserving directory separators.
+*
+* The web middleware uses this for `/-/assets/{*all}` which may include
+* subfolders (e.g. `logos/verdaccio.svg`). We sanitize each path segment
+* independently so `/` remains a real directory boundary.
+*
+* TODO: `sanitize-filename` silently rewrites segments instead of rejecting
+* them (`file\0.txt` -> `file.txt`, `CON.svg` -> `.svg`, oversized segments
+* truncated). Not exploitable today, but surprising; prefer 404 on destructive
+* rewrite.
+* TODO: `=== '..'` check is whitespace-strict — ` ..` / `..  ` slips past it.
+* Use `path.normalize` before splitting, or `segment.trim() === '..'`.
+* TODO: largely redundant with `resolveSafePath` on POSIX; the dep mainly earns
+* its keep on Windows. Consider an inline `[<>:"|?*\0]` regex to drop the dep.
+*
+* @param filename The user-provided filename/path to sanitize.
+* @returns The sanitized filename/path.
+*/
+function sanitizeFilename(filename) {
+	return filename.replace(/\\/g, "/").split("/").map((segment) => {
+		if (segment === "." || segment === "..") return segment;
+		return (0, sanitize_filename.default)(segment);
+	}).join("/");
+}
 //#endregion
 Object.defineProperty(exports, "file_utils_exports", {
 	enumerable: true,

package/build/file-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-utils.js","names":[],"sources":["../src/file-utils.ts"],"sourcesContent":["import { mkdir, mkdtemp } from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\n\nexport const Files = {\n  DatabaseName: '.verdaccio-db.json',\n};\n\n/**\n * Create a temporary folder.\n * @param prefix The prefix of the folder name.\n * @returns string\n */\nexport async function createTempFolder(prefix: string): Promise<string> {\n  return await mkdtemp(path.join(os.tmpdir(), 'verdaccio-' + prefix + '-'));\n}\n\n/**\n * Create temporary folder for an asset.\n * @param prefix\n * @param folder name\n * @returns\n */\nexport async function createTempStorageFolder(prefix: string, folder = 'storage'): Promise<string> {\n  const tempFolder = await createTempFolder(prefix);\n  const storageFolder = path.join(tempFolder, folder);\n  await mkdir(storageFolder);\n  return storageFolder;\n}\n"],"mappings":";;;;;;;;;;;;AAIA,IAAa,QAAQ,EACnB,cAAc,sBACf;;;;;;AAOD,eAAsB,iBAAiB,QAAiC;AACtE,QAAO,OAAA,GAAA,iBAAA,SAAc,UAAA,QAAK,KAAK,QAAA,QAAG,QAAQ,EAAE,eAAe,SAAS,IAAI,CAAC;;;;;;;;AAS3E,eAAsB,wBAAwB,QAAgB,SAAS,WAA4B;CACjG,MAAM,aAAa,MAAM,iBAAiB,OAAO;CACjD,MAAM,gBAAgB,UAAA,QAAK,KAAK,YAAY,OAAO;AACnD,QAAA,GAAA,iBAAA,OAAY,cAAc;AAC1B,QAAO"}
+{"version":3,"file":"file-utils.js","names":[],"sources":["../src/file-utils.ts"],"sourcesContent":["import { mkdir, mkdtemp } from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\nimport sanitize from 'sanitize-filename';\n\nexport const Files = {\n  DatabaseName: '.verdaccio-db.json',\n};\n\n/**\n * Create a temporary folder.\n * @param prefix The prefix of the folder name.\n * @returns string\n */\nexport async function createTempFolder(prefix: string): Promise<string> {\n  return await mkdtemp(path.join(os.tmpdir(), 'verdaccio-' + prefix + '-'));\n}\n\n/**\n * Create temporary folder for an asset.\n * @param prefix\n * @param folder name\n * @returns\n */\nexport async function createTempStorageFolder(prefix: string, folder = 'storage'): Promise<string> {\n  const tempFolder = await createTempFolder(prefix);\n  const storageFolder = path.join(tempFolder, folder);\n  await mkdir(storageFolder);\n  return storageFolder;\n}\n\n/**\n * Resolve a safe path within a base directory, preventing directory traversal attacks.\n *\n * This function provides security against path traversal by:\n * - URL decoding the input path\n * - Resolving the full absolute path\n * - Checking that the resolved path stays within the base directory\n * - Rejecting paths containing '..' that would escape the base directory\n * - Rejecting absolute paths that bypass the base directory\n *\n * @param basePath The base directory that constrains file access\n * @param requestPath The requested path from user input (may be URL-encoded)\n * @returns The resolved safe absolute path or null if the path is unsafe/invalid\n * @security Prevents directory traversal attacks by validating resolved paths\n */\nexport function resolveSafePath(basePath: string, requestPath?: string): string | null {\n  try {\n    if (!requestPath || requestPath === '') {\n      return null;\n    }\n\n    const decoded = decodeURIComponent(requestPath);\n    // Prevent absolute paths (should not start from '/')\n    if (path.isAbsolute(decoded)) {\n      return null;\n    }\n\n    // Resolve against the base directory without requiring the target to exist.\n    const baseResolved = path.resolve(basePath);\n    const reqResolved = path.resolve(baseResolved, decoded);\n\n    // Normalize for Windows case-insensitive filesystem comparisons.\n    const baseComparable = process.platform === 'win32' ? baseResolved.toLowerCase() : baseResolved;\n    const reqComparable = process.platform === 'win32' ? reqResolved.toLowerCase() : reqResolved;\n\n    // Ensure the resolved path is within basePath (subdirectory or exactly the base).\n    if (reqComparable !== baseComparable && !reqComparable.startsWith(baseComparable + path.sep)) {\n      return null;\n    }\n\n    return reqResolved;\n  } catch {\n    // error resolving path (e.g., path does not exist or permission denied)\n    return null;\n  }\n}\n\n/**\n * Sanitize a user-provided path while preserving directory separators.\n *\n * The web middleware uses this for `/-/assets/{*all}` which may include\n * subfolders (e.g. `logos/verdaccio.svg`). We sanitize each path segment\n * independently so `/` remains a real directory boundary.\n *\n * TODO: `sanitize-filename` silently rewrites segments instead of rejecting\n * them (`file\\0.txt` -> `file.txt`, `CON.svg` -> `.svg`, oversized segments\n * truncated). Not exploitable today, but surprising; prefer 404 on destructive\n * rewrite.\n * TODO: `=== '..'` check is whitespace-strict — ` ..` / `..  ` slips past it.\n * Use `path.normalize` before splitting, or `segment.trim() === '..'`.\n * TODO: largely redundant with `resolveSafePath` on POSIX; the dep mainly earns\n * its keep on Windows. Consider an inline `[<>:\"|?*\\0]` regex to drop the dep.\n *\n * @param filename The user-provided filename/path to sanitize.\n * @returns The sanitized filename/path.\n */\nexport function sanitizeFilename(filename: string): string {\n  // normalize windows path separator so the result is stable across platforms\n  const normalized = filename.replace(/\\\\/g, '/');\n  const segments = normalized.split('/').map((segment) => {\n    // Keep traversal markers intact so `resolveSafePath()` can correctly\n    // reject paths escaping the base directory.\n    if (segment === '.' || segment === '..') {\n      return segment;\n    }\n    return sanitize(segment);\n  });\n  return segments.join('/');\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAKA,IAAa,QAAQ,EACnB,cAAc,sBACf;;;;;;AAOD,eAAsB,iBAAiB,QAAiC;AACtE,QAAO,OAAA,GAAA,iBAAA,SAAc,UAAA,QAAK,KAAK,QAAA,QAAG,QAAQ,EAAE,eAAe,SAAS,IAAI,CAAC;;;;;;;;AAS3E,eAAsB,wBAAwB,QAAgB,SAAS,WAA4B;CACjG,MAAM,aAAa,MAAM,iBAAiB,OAAO;CACjD,MAAM,gBAAgB,UAAA,QAAK,KAAK,YAAY,OAAO;AACnD,QAAA,GAAA,iBAAA,OAAY,cAAc;AAC1B,QAAO;;;;;;;;;;;;;;;;;AAkBT,SAAgB,gBAAgB,UAAkB,aAAqC;AACrF,KAAI;AACF,MAAI,CAAC,eAAe,gBAAgB,GAClC,QAAO;EAGT,MAAM,UAAU,mBAAmB,YAAY;AAE/C,MAAI,UAAA,QAAK,WAAW,QAAQ,CAC1B,QAAO;EAIT,MAAM,eAAe,UAAA,QAAK,QAAQ,SAAS;EAC3C,MAAM,cAAc,UAAA,QAAK,QAAQ,cAAc,QAAQ;EAGvD,MAAM,iBAAiB,QAAQ,aAAa,UAAU,aAAa,aAAa,GAAG;EACnF,MAAM,gBAAgB,QAAQ,aAAa,UAAU,YAAY,aAAa,GAAG;AAGjF,MAAI,kBAAkB,kBAAkB,CAAC,cAAc,WAAW,iBAAiB,UAAA,QAAK,IAAI,CAC1F,QAAO;AAGT,SAAO;SACD;AAEN,SAAO;;;;;;;;;;;;;;;;;;;;;;AAuBX,SAAgB,iBAAiB,UAA0B;AAWzD,QATmB,SAAS,QAAQ,OAAO,IAAI,CACnB,MAAM,IAAI,CAAC,KAAK,YAAY;AAGtD,MAAI,YAAY,OAAO,YAAY,KACjC,QAAO;AAET,UAAA,GAAA,kBAAA,SAAgB,QAAQ;GACxB,CACc,KAAK,IAAI"}

package/build/file-utils.mjs

@@ -2,11 +2,14 @@ import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
 import { mkdir, mkdtemp } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import sanitize from "sanitize-filename";
 //#region src/file-utils.ts
 var file_utils_exports = /* @__PURE__ */ __exportAll({
 	Files: () => Files,
 	createTempFolder: () => createTempFolder,
-	createTempStorageFolder: () => createTempStorageFolder
+	createTempStorageFolder: () => createTempStorageFolder,
+	resolveSafePath: () => resolveSafePath,
+	sanitizeFilename: () => sanitizeFilename
 });
 var Files = { DatabaseName: ".verdaccio-db.json" };
 /**
@@ -29,6 +32,61 @@ async function createTempStorageFolder(prefix, folder = "storage") {
 	await mkdir(storageFolder);
 	return storageFolder;
 }
+/**
+* Resolve a safe path within a base directory, preventing directory traversal attacks.
+*
+* This function provides security against path traversal by:
+* - URL decoding the input path
+* - Resolving the full absolute path
+* - Checking that the resolved path stays within the base directory
+* - Rejecting paths containing '..' that would escape the base directory
+* - Rejecting absolute paths that bypass the base directory
+*
+* @param basePath The base directory that constrains file access
+* @param requestPath The requested path from user input (may be URL-encoded)
+* @returns The resolved safe absolute path or null if the path is unsafe/invalid
+* @security Prevents directory traversal attacks by validating resolved paths
+*/
+function resolveSafePath(basePath, requestPath) {
+	try {
+		if (!requestPath || requestPath === "") return null;
+		const decoded = decodeURIComponent(requestPath);
+		if (path.isAbsolute(decoded)) return null;
+		const baseResolved = path.resolve(basePath);
+		const reqResolved = path.resolve(baseResolved, decoded);
+		const baseComparable = process.platform === "win32" ? baseResolved.toLowerCase() : baseResolved;
+		const reqComparable = process.platform === "win32" ? reqResolved.toLowerCase() : reqResolved;
+		if (reqComparable !== baseComparable && !reqComparable.startsWith(baseComparable + path.sep)) return null;
+		return reqResolved;
+	} catch {
+		return null;
+	}
+}
+/**
+* Sanitize a user-provided path while preserving directory separators.
+*
+* The web middleware uses this for `/-/assets/{*all}` which may include
+* subfolders (e.g. `logos/verdaccio.svg`). We sanitize each path segment
+* independently so `/` remains a real directory boundary.
+*
+* TODO: `sanitize-filename` silently rewrites segments instead of rejecting
+* them (`file\0.txt` -> `file.txt`, `CON.svg` -> `.svg`, oversized segments
+* truncated). Not exploitable today, but surprising; prefer 404 on destructive
+* rewrite.
+* TODO: `=== '..'` check is whitespace-strict — ` ..` / `..  ` slips past it.
+* Use `path.normalize` before splitting, or `segment.trim() === '..'`.
+* TODO: largely redundant with `resolveSafePath` on POSIX; the dep mainly earns
+* its keep on Windows. Consider an inline `[<>:"|?*\0]` regex to drop the dep.
+*
+* @param filename The user-provided filename/path to sanitize.
+* @returns The sanitized filename/path.
+*/
+function sanitizeFilename(filename) {
+	return filename.replace(/\\/g, "/").split("/").map((segment) => {
+		if (segment === "." || segment === "..") return segment;
+		return sanitize(segment);
+	}).join("/");
+}
 //#endregion
 export { file_utils_exports };
 

package/build/file-utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"file-utils.mjs","names":[],"sources":["../src/file-utils.ts"],"sourcesContent":["import { mkdir, mkdtemp } from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\n\nexport const Files = {\n  DatabaseName: '.verdaccio-db.json',\n};\n\n/**\n * Create a temporary folder.\n * @param prefix The prefix of the folder name.\n * @returns string\n */\nexport async function createTempFolder(prefix: string): Promise<string> {\n  return await mkdtemp(path.join(os.tmpdir(), 'verdaccio-' + prefix + '-'));\n}\n\n/**\n * Create temporary folder for an asset.\n * @param prefix\n * @param folder name\n * @returns\n */\nexport async function createTempStorageFolder(prefix: string, folder = 'storage'): Promise<string> {\n  const tempFolder = await createTempFolder(prefix);\n  const storageFolder = path.join(tempFolder, folder);\n  await mkdir(storageFolder);\n  return storageFolder;\n}\n"],"mappings":";;;;;;;;;;AAIA,IAAa,QAAQ,EACnB,cAAc,sBACf;;;;;;AAOD,eAAsB,iBAAiB,QAAiC;AACtE,QAAO,MAAM,QAAQ,KAAK,KAAK,GAAG,QAAQ,EAAE,eAAe,SAAS,IAAI,CAAC;;;;;;;;AAS3E,eAAsB,wBAAwB,QAAgB,SAAS,WAA4B;CACjG,MAAM,aAAa,MAAM,iBAAiB,OAAO;CACjD,MAAM,gBAAgB,KAAK,KAAK,YAAY,OAAO;AACnD,OAAM,MAAM,cAAc;AAC1B,QAAO"}
+{"version":3,"file":"file-utils.mjs","names":[],"sources":["../src/file-utils.ts"],"sourcesContent":["import { mkdir, mkdtemp } from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\nimport sanitize from 'sanitize-filename';\n\nexport const Files = {\n  DatabaseName: '.verdaccio-db.json',\n};\n\n/**\n * Create a temporary folder.\n * @param prefix The prefix of the folder name.\n * @returns string\n */\nexport async function createTempFolder(prefix: string): Promise<string> {\n  return await mkdtemp(path.join(os.tmpdir(), 'verdaccio-' + prefix + '-'));\n}\n\n/**\n * Create temporary folder for an asset.\n * @param prefix\n * @param folder name\n * @returns\n */\nexport async function createTempStorageFolder(prefix: string, folder = 'storage'): Promise<string> {\n  const tempFolder = await createTempFolder(prefix);\n  const storageFolder = path.join(tempFolder, folder);\n  await mkdir(storageFolder);\n  return storageFolder;\n}\n\n/**\n * Resolve a safe path within a base directory, preventing directory traversal attacks.\n *\n * This function provides security against path traversal by:\n * - URL decoding the input path\n * - Resolving the full absolute path\n * - Checking that the resolved path stays within the base directory\n * - Rejecting paths containing '..' that would escape the base directory\n * - Rejecting absolute paths that bypass the base directory\n *\n * @param basePath The base directory that constrains file access\n * @param requestPath The requested path from user input (may be URL-encoded)\n * @returns The resolved safe absolute path or null if the path is unsafe/invalid\n * @security Prevents directory traversal attacks by validating resolved paths\n */\nexport function resolveSafePath(basePath: string, requestPath?: string): string | null {\n  try {\n    if (!requestPath || requestPath === '') {\n      return null;\n    }\n\n    const decoded = decodeURIComponent(requestPath);\n    // Prevent absolute paths (should not start from '/')\n    if (path.isAbsolute(decoded)) {\n      return null;\n    }\n\n    // Resolve against the base directory without requiring the target to exist.\n    const baseResolved = path.resolve(basePath);\n    const reqResolved = path.resolve(baseResolved, decoded);\n\n    // Normalize for Windows case-insensitive filesystem comparisons.\n    const baseComparable = process.platform === 'win32' ? baseResolved.toLowerCase() : baseResolved;\n    const reqComparable = process.platform === 'win32' ? reqResolved.toLowerCase() : reqResolved;\n\n    // Ensure the resolved path is within basePath (subdirectory or exactly the base).\n    if (reqComparable !== baseComparable && !reqComparable.startsWith(baseComparable + path.sep)) {\n      return null;\n    }\n\n    return reqResolved;\n  } catch {\n    // error resolving path (e.g., path does not exist or permission denied)\n    return null;\n  }\n}\n\n/**\n * Sanitize a user-provided path while preserving directory separators.\n *\n * The web middleware uses this for `/-/assets/{*all}` which may include\n * subfolders (e.g. `logos/verdaccio.svg`). We sanitize each path segment\n * independently so `/` remains a real directory boundary.\n *\n * TODO: `sanitize-filename` silently rewrites segments instead of rejecting\n * them (`file\\0.txt` -> `file.txt`, `CON.svg` -> `.svg`, oversized segments\n * truncated). Not exploitable today, but surprising; prefer 404 on destructive\n * rewrite.\n * TODO: `=== '..'` check is whitespace-strict — ` ..` / `..  ` slips past it.\n * Use `path.normalize` before splitting, or `segment.trim() === '..'`.\n * TODO: largely redundant with `resolveSafePath` on POSIX; the dep mainly earns\n * its keep on Windows. Consider an inline `[<>:\"|?*\\0]` regex to drop the dep.\n *\n * @param filename The user-provided filename/path to sanitize.\n * @returns The sanitized filename/path.\n */\nexport function sanitizeFilename(filename: string): string {\n  // normalize windows path separator so the result is stable across platforms\n  const normalized = filename.replace(/\\\\/g, '/');\n  const segments = normalized.split('/').map((segment) => {\n    // Keep traversal markers intact so `resolveSafePath()` can correctly\n    // reject paths escaping the base directory.\n    if (segment === '.' || segment === '..') {\n      return segment;\n    }\n    return sanitize(segment);\n  });\n  return segments.join('/');\n}\n"],"mappings":";;;;;;;;;;;;;AAKA,IAAa,QAAQ,EACnB,cAAc,sBACf;;;;;;AAOD,eAAsB,iBAAiB,QAAiC;AACtE,QAAO,MAAM,QAAQ,KAAK,KAAK,GAAG,QAAQ,EAAE,eAAe,SAAS,IAAI,CAAC;;;;;;;;AAS3E,eAAsB,wBAAwB,QAAgB,SAAS,WAA4B;CACjG,MAAM,aAAa,MAAM,iBAAiB,OAAO;CACjD,MAAM,gBAAgB,KAAK,KAAK,YAAY,OAAO;AACnD,OAAM,MAAM,cAAc;AAC1B,QAAO;;;;;;;;;;;;;;;;;AAkBT,SAAgB,gBAAgB,UAAkB,aAAqC;AACrF,KAAI;AACF,MAAI,CAAC,eAAe,gBAAgB,GAClC,QAAO;EAGT,MAAM,UAAU,mBAAmB,YAAY;AAE/C,MAAI,KAAK,WAAW,QAAQ,CAC1B,QAAO;EAIT,MAAM,eAAe,KAAK,QAAQ,SAAS;EAC3C,MAAM,cAAc,KAAK,QAAQ,cAAc,QAAQ;EAGvD,MAAM,iBAAiB,QAAQ,aAAa,UAAU,aAAa,aAAa,GAAG;EACnF,MAAM,gBAAgB,QAAQ,aAAa,UAAU,YAAY,aAAa,GAAG;AAGjF,MAAI,kBAAkB,kBAAkB,CAAC,cAAc,WAAW,iBAAiB,KAAK,IAAI,CAC1F,QAAO;AAGT,SAAO;SACD;AAEN,SAAO;;;;;;;;;;;;;;;;;;;;;;AAuBX,SAAgB,iBAAiB,UAA0B;AAWzD,QATmB,SAAS,QAAQ,OAAO,IAAI,CACnB,MAAM,IAAI,CAAC,KAAK,YAAY;AAGtD,MAAI,YAAY,OAAO,YAAY,KACjC,QAAO;AAET,SAAO,SAAS,QAAQ;GACxB,CACc,KAAK,IAAI"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/core",
-  "version": "9.0.0-next-9.15",
+  "version": "9.0.0-next-9.16",
   "description": "Verdaccio Core Components",
   "keywords": [
     "private",
@@ -38,10 +38,11 @@
     "http-status-codes": "2.3.0",
     "minimatch": "9.0.7",
     "process-warning": "5.0.0",
+    "sanitize-filename": "1.6.3",
     "semver": "7.7.4"
   },
   "devDependencies": {
-    "@verdaccio/types": "14.0.0-next-9.6",
+    "@verdaccio/types": "14.0.0-next-9.7",
     "express": "5.2.1",
     "typedoc": "0.28.14",
     "vitest": "4.1.0"