@verdaccio/middleware 8.0.0-next-8.28 → 8.0.0-next-8.30

package/build/index.d.ts

@@ -1,5 +1,4 @@
 export { match } from './middlewares/match';
-export { setSecurityWebHeaders } from './middlewares/security-headers';
 export { validateName, validatePackage } from './middlewares/validation';
 export { media } from './middlewares/media';
 export { makeURLrelative } from './middlewares/make-url-relative';
@@ -10,7 +9,7 @@ export { final } from './middlewares/final';
 export { allow } from './middlewares/allow';
 export { rateLimit } from './middlewares/rate-limit';
 export { userAgent } from './middlewares/user-agent';
-export { webMiddleware, renderWebMiddleware } from './middlewares/web';
+export { webMiddleware, renderWebMiddleware, setSecurityWebHeaders } from './middlewares/web';
 export { errorReportingMiddleware, handleError } from './middlewares/error';
 export { log, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, } from './middlewares/log';
 export * from './types';

package/build/index.js

@@ -5,7 +5,6 @@ Object.defineProperty(exports, "__esModule", {
 });
 var _exportNames = {
   match: true,
-  setSecurityWebHeaders: true,
   validateName: true,
   validatePackage: true,
   media: true,
@@ -19,6 +18,7 @@ var _exportNames = {
   userAgent: true,
   webMiddleware: true,
   renderWebMiddleware: true,
+  setSecurityWebHeaders: true,
   errorReportingMiddleware: true,
   handleError: true,
   log: true,
@@ -125,7 +125,7 @@ Object.defineProperty(exports, "renderWebMiddleware", {
 Object.defineProperty(exports, "setSecurityWebHeaders", {
   enumerable: true,
   get: function () {
-    return _securityHeaders.setSecurityWebHeaders;
+    return _web.setSecurityWebHeaders;
   }
 });
 Object.defineProperty(exports, "userAgent", {
@@ -153,7 +153,6 @@ Object.defineProperty(exports, "webMiddleware", {
   }
 });
 var _match = require("./middlewares/match");
-var _securityHeaders = require("./middlewares/security-headers");
 var _validation = require("./middlewares/validation");
 var _media = require("./middlewares/media");
 var _makeUrlRelative = require("./middlewares/make-url-relative");

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_match","require","_securityHeaders","_validation","_media","_makeUrlRelative","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_userAgent","_web","_error","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_api_urls","_webUrls"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { setSecurityWebHeaders } from './middlewares/security-headers';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { makeURLrelative } from './middlewares/make-url-relative';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\nexport * from './middlewares/api_urls';\nexport * from './middlewares/web/web-urls';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,gBAAA,GAAAJ,OAAA;AACA,IAAAK,UAAA,GAAAL,OAAA;AACA,IAAAM,KAAA,GAAAN,OAAA;AACA,IAAAO,SAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,MAAA,GAAAT,OAAA;AACA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,UAAA,GAAAX,OAAA;AACA,IAAAY,IAAA,GAAAZ,OAAA;AACA,IAAAa,MAAA,GAAAb,OAAA;AACA,IAAAc,IAAA,GAAAd,OAAA;AAMA,IAAAe,MAAA,GAAAf,OAAA;AAAAgB,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AACA,IAAAS,SAAA,GAAA5B,OAAA;AAAAgB,MAAA,CAAAC,IAAA,CAAAW,SAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,SAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAC,SAAA,CAAAT,GAAA;IAAA;EAAA;AAAA;AACA,IAAAU,QAAA,GAAA7B,OAAA;AAAAgB,MAAA,CAAAC,IAAA,CAAAY,QAAA,EAAAX,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAU,QAAA,CAAAV,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAE,QAAA,CAAAV,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}
+{"version":3,"file":"index.js","names":["_match","require","_validation","_media","_makeUrlRelative","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_userAgent","_web","_error","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_api_urls","_webUrls"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { makeURLrelative } from './middlewares/make-url-relative';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware, setSecurityWebHeaders } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\nexport * from './middlewares/api_urls';\nexport * from './middlewares/web/web-urls';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,MAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,UAAA,GAAAT,OAAA;AACA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,IAAA,GAAAX,OAAA;AACA,IAAAY,MAAA,GAAAZ,OAAA;AACA,IAAAa,IAAA,GAAAb,OAAA;AAMA,IAAAc,MAAA,GAAAd,OAAA;AAAAe,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AACA,IAAAS,SAAA,GAAA3B,OAAA;AAAAe,MAAA,CAAAC,IAAA,CAAAW,SAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,SAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAC,SAAA,CAAAT,GAAA;IAAA;EAAA;AAAA;AACA,IAAAU,QAAA,GAAA5B,OAAA;AAAAe,MAAA,CAAAC,IAAA,CAAAY,QAAA,EAAAX,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAU,QAAA,CAAAV,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAE,QAAA,CAAAV,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}

package/build/middlewares/web/security.js

@@ -4,16 +4,41 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.setSecurityWebHeaders = setSecurityWebHeaders;
+var _debug = _interopRequireDefault(require("debug"));
 var _core = require("@verdaccio/core");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('verdaccio:middleware:web:security');
 function setSecurityWebHeaders(_req, res, next) {
   // disable loading in frames (clickjacking, etc.)
-  res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
-  // avoid stablish connections outside of domain
-  res.header(_core.HEADERS.CSP, "connect-src 'self'");
-  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
-  res.header(_core.HEADERS.CTO, 'nosniff');
-  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
-  res.header(_core.HEADERS.XSS, '1; mode=block');
+  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
+  const framesOptions = res.getHeader(_core.HEADERS.FRAMES_OPTIONS);
+  if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {
+    debug('Missing or invalid X-Frame-Options header; setting to "deny"');
+    res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
+  }
+
+  // avoid establishing connections outside of domain
+  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
+  if (!res.getHeader(_core.HEADERS.CSP)) {
+    debug('Missing Content-Security-Policy header; setting to "connect-src \'self\'"');
+    res.header(_core.HEADERS.CSP, "connect-src 'self'");
+  }
+
+  // respect the content type of the response
+  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
+  const cto = res.getHeader(_core.HEADERS.CTO);
+  if (!cto || cto !== 'nosniff') {
+    debug('Missing or invalid X-Content-Type-Options header; setting to "nosniff"');
+    res.header(_core.HEADERS.CTO, 'nosniff');
+  }
+
+  // block rendering of the page in case of XSS attack
+  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection
+  const xss = res.getHeader(_core.HEADERS.XSS);
+  if (!xss || !(xss === '0' || xss.startsWith('1'))) {
+    debug('Missing or invalid X-XSS-Protection header; setting to "1; mode=block"');
+    res.header(_core.HEADERS.XSS, '1; mode=block');
+  }
   next();
 }
 //# sourceMappingURL=security.js.map

package/build/middlewares/web/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","names":["_core","require","setSecurityWebHeaders","_req","res","next","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS"],"sources":["../../../src/middlewares/web/security.ts"],"sourcesContent":["import { HEADERS } from '@verdaccio/core';\n\nexport function setSecurityWebHeaders(_req, res, next): void {\n  // disable loading in frames (clickjacking, etc.)\n  res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n  // avoid stablish connections outside of domain\n  res.header(HEADERS.CSP, \"connect-src 'self'\");\n  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n  res.header(HEADERS.CTO, 'nosniff');\n  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n  res.header(HEADERS.XSS, '1; mode=block');\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAEO,SAASC,qBAAqBA,CAACC,IAAI,EAAEC,GAAG,EAAEC,IAAI,EAAQ;EAC3D;EACAD,GAAG,CAACE,MAAM,CAACC,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC1C;EACAJ,GAAG,CAACE,MAAM,CAACC,aAAO,CAACE,GAAG,EAAE,oBAAoB,CAAC;EAC7C;EACAL,GAAG,CAACE,MAAM,CAACC,aAAO,CAACG,GAAG,EAAE,SAAS,CAAC;EAClC;EACAN,GAAG,CAACE,MAAM,CAACC,aAAO,CAACI,GAAG,EAAE,eAAe,CAAC;EACxCN,IAAI,CAAC,CAAC;AACR","ignoreList":[]}
+{"version":3,"file":"security.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","setSecurityWebHeaders","_req","res","next","framesOptions","getHeader","HEADERS","FRAMES_OPTIONS","header","CSP","cto","CTO","xss","XSS","startsWith"],"sources":["../../../src/middlewares/web/security.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:security');\n\nexport function setSecurityWebHeaders(_req, res, next): void {\n  // disable loading in frames (clickjacking, etc.)\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options\n  const framesOptions = res.getHeader(HEADERS.FRAMES_OPTIONS);\n  if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {\n    debug('Missing or invalid X-Frame-Options header; setting to \"deny\"');\n    res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n  }\n\n  // avoid establishing connections outside of domain\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy\n  if (!res.getHeader(HEADERS.CSP)) {\n    debug('Missing Content-Security-Policy header; setting to \"connect-src \\'self\\'\"');\n    res.header(HEADERS.CSP, \"connect-src 'self'\");\n  }\n\n  // respect the content type of the response\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options\n  const cto = res.getHeader(HEADERS.CTO);\n  if (!cto || cto !== 'nosniff') {\n    debug('Missing or invalid X-Content-Type-Options header; setting to \"nosniff\"');\n    res.header(HEADERS.CTO, 'nosniff');\n  }\n\n  // block rendering of the page in case of XSS attack\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection\n  const xss = res.getHeader(HEADERS.XSS);\n  if (!xss || !(xss === '0' || xss.startsWith('1'))) {\n    debug('Missing or invalid X-XSS-Protection header; setting to \"1; mode=block\"');\n    res.header(HEADERS.XSS, '1; mode=block');\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAA0C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAE1C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,mCAAmC,CAAC;AAEtD,SAASC,qBAAqBA,CAACC,IAAI,EAAEC,GAAG,EAAEC,IAAI,EAAQ;EAC3D;EACA;EACA,MAAMC,aAAa,GAAGF,GAAG,CAACG,SAAS,CAACC,aAAO,CAACC,cAAc,CAAC;EAC3D,IAAI,CAACH,aAAa,IAAI,EAAEA,aAAa,KAAK,MAAM,IAAIA,aAAa,KAAK,YAAY,CAAC,EAAE;IACnFN,KAAK,CAAC,8DAA8D,CAAC;IACrEI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC5C;;EAEA;EACA;EACA,IAAI,CAACL,GAAG,CAACG,SAAS,CAACC,aAAO,CAACG,GAAG,CAAC,EAAE;IAC/BX,KAAK,CAAC,2EAA2E,CAAC;IAClFI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACG,GAAG,EAAE,oBAAoB,CAAC;EAC/C;;EAEA;EACA;EACA,MAAMC,GAAG,GAAGR,GAAG,CAACG,SAAS,CAACC,aAAO,CAACK,GAAG,CAAC;EACtC,IAAI,CAACD,GAAG,IAAIA,GAAG,KAAK,SAAS,EAAE;IAC7BZ,KAAK,CAAC,wEAAwE,CAAC;IAC/EI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACK,GAAG,EAAE,SAAS,CAAC;EACpC;;EAEA;EACA;EACA,MAAMC,GAAG,GAAGV,GAAG,CAACG,SAAS,CAACC,aAAO,CAACO,GAAG,CAAC;EACtC,IAAI,CAACD,GAAG,IAAI,EAAEA,GAAG,KAAK,GAAG,IAAIA,GAAG,CAACE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE;IACjDhB,KAAK,CAAC,wEAAwE,CAAC;IAC/EI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACO,GAAG,EAAE,eAAe,CAAC;EAC1C;EACAV,IAAI,CAAC,CAAC;AACR","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "8.0.0-next-8.28",
+  "version": "8.0.0-next-8.30",
   "description": "Verdaccio Express Middleware",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,13 +33,13 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/config": "8.0.0-next-8.28",
-    "@verdaccio/core": "8.0.0-next-8.28",
-    "@verdaccio/url": "13.0.0-next-8.28",
+    "@verdaccio/config": "8.0.0-next-8.30",
+    "@verdaccio/core": "8.0.0-next-8.30",
+    "@verdaccio/url": "13.0.0-next-8.30",
     "debug": "4.4.3",
-    "express": "4.21.2",
+    "express": "4.22.1",
     "express-rate-limit": "5.5.1",
-    "lodash": "4.17.21",
+    "lodash": "4.17.23",
     "lru-cache": "7.18.3"
   },
   "funding": {
@@ -47,9 +47,9 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@verdaccio/logger": "8.0.0-next-8.28",
+    "@verdaccio/logger": "8.0.0-next-8.30",
     "@verdaccio/types": "13.0.0-next-8.10",
-    "http-errors": "2.0.0",
+    "http-errors": "2.0.1",
     "supertest": "7.1.4",
     "jsdom": "26.1.0",
     "vitest": "3.2.4"

package/build/middlewares/security-headers.d.ts

@@ -1,2 +0,0 @@
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-export declare function setSecurityWebHeaders(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/security-headers.js

@@ -1,21 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.setSecurityWebHeaders = setSecurityWebHeaders;
-var _core = require("@verdaccio/core");
-// TODO: remove, was relocated to web package
-// @ts-deprecated
-function setSecurityWebHeaders(req, res, next) {
-  // disable loading in frames (clickjacking, etc.)
-  res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
-  // avoid stablish connections outside of domain
-  res.header(_core.HEADERS.CSP, "connect-src 'self'");
-  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
-  res.header(_core.HEADERS.CTO, 'nosniff');
-  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
-  res.header(_core.HEADERS.XSS, '1; mode=block');
-  next();
-}
-//# sourceMappingURL=security-headers.js.map

package/build/middlewares/security-headers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-headers.js","names":["_core","require","setSecurityWebHeaders","req","res","next","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS"],"sources":["../../src/middlewares/security-headers.ts"],"sourcesContent":["import { HEADERS } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  // disable loading in frames (clickjacking, etc.)\n  res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n  // avoid stablish connections outside of domain\n  res.header(HEADERS.CSP, \"connect-src 'self'\");\n  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n  res.header(HEADERS.CTO, 'nosniff');\n  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n  res.header(HEADERS.XSS, '1; mode=block');\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAIA;AACA;AACO,SAASC,qBAAqBA,CACnCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN;EACAD,GAAG,CAACE,MAAM,CAACC,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC1C;EACAJ,GAAG,CAACE,MAAM,CAACC,aAAO,CAACE,GAAG,EAAE,oBAAoB,CAAC;EAC7C;EACAL,GAAG,CAACE,MAAM,CAACC,aAAO,CAACG,GAAG,EAAE,SAAS,CAAC;EAClC;EACAN,GAAG,CAACE,MAAM,CAACC,aAAO,CAACI,GAAG,EAAE,eAAe,CAAC;EACxCN,IAAI,CAAC,CAAC;AACR","ignoreList":[]}