@verdaccio/store 9.0.0-next-9.31 → 9.0.0-next-9.32

package/build/lib/versions-utils.d.ts

@@ -28,12 +28,12 @@ export declare function tagVersion(data: Manifest, version: string, tag: StringV
  */
 export declare function tagVersionNext(manifest: Manifest, version: string, tag: StringValue): Manifest;
 /**
- *  Check if the version is newer than the older version.
- * @param newVersion
- * @param oldVersion
- * @returns
+ * Whether `newVersion` is strictly newer than `oldVersion` under loose semver.
+ * Equal versions in any spelling (`1.2.3`, `v1.2.3`, `01.2.3`, `1.2.3+build`) are
+ * not newer, so search merges keep the entry they saw first, which is the local one.
+ * Both arguments must already pass `pkgUtils.isValidVersion`.
  */
-export declare function isNewerVersion(newVersion: any, oldVersion: any): boolean;
+export declare function isNewerVersion(newVersion: string, oldVersion: string): boolean;
 /**
  * Remove duplicates from search results.
  * @param {Array} objects

package/build/lib/versions-utils.js

@@ -58,14 +58,13 @@ function tagVersionNext(manifest, version, tag) {
 	return data;
 }
 /**
-*  Check if the version is newer than the older version.
-* @param newVersion
-* @param oldVersion
-* @returns
+* Whether `newVersion` is strictly newer than `oldVersion` under loose semver.
+* Equal versions in any spelling (`1.2.3`, `v1.2.3`, `01.2.3`, `1.2.3+build`) are
+* not newer, so search merges keep the entry they saw first, which is the local one.
+* Both arguments must already pass `pkgUtils.isValidVersion`.
 */
 function isNewerVersion(newVersion, oldVersion) {
-	const comparisonResult = semver.default.compare(newVersion, oldVersion);
-	return comparisonResult === 1 || comparisonResult === 0;
+	return semver.default.compareLoose(newVersion, oldVersion) === 1;
 }
 /**
 * Remove duplicates from search results.
@@ -74,7 +73,13 @@ function isNewerVersion(newVersion, oldVersion) {
 */
 function removeLowerVersions(objects) {
 	const versionMap = /* @__PURE__ */ new Map();
-	objects.forEach((item) => {
+	const validObjects = objects.filter((item) => {
+		const version = item?.package?.version;
+		const valid = _verdaccio_core.pkgUtils.isValidVersion(version);
+		if (!valid) debug$1("ignoring invalid search version %o", version);
+		return valid;
+	});
+	validObjects.forEach((item) => {
 		const { name, version } = item.package;
 		const key = name;
 		if (versionMap.has(name) === false || isNewerVersion(version, versionMap.get(name))) {
@@ -82,7 +87,7 @@ function removeLowerVersions(objects) {
 			versionMap.set(key, version);
 		}
 	});
-	return objects.reduce((acc, item) => {
+	return validObjects.reduce((acc, item) => {
 		const { name, version } = item.package;
 		if (versionMap.has(name) && versionMap.get(name) === version && acc.find((i) => i.package.name === name) === void 0) {
 			debug$1("adding %o@%o", name, version);

package/build/lib/versions-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"versions-utils.js","names":[],"sources":["../../src/lib/versions-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\nimport type { SemVer } from 'semver';\nimport semver from 'semver';\n\nimport type { searchUtils } from '@verdaccio/core';\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { Manifest, StringValue, Version, Versions } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:storage:utils');\n\n/**\n * Gets version from a package object taking into account semver weirdness.\n * @return {String} return the semantic version of a package\n */\nexport function getVersion(versions: Versions, version: string): Version | undefined {\n  if (!versions) {\n    return;\n  }\n\n  // this condition must allow cast\n  if (isNil(versions[version]) === false) {\n    return versions[version];\n  }\n\n  const versionSemver: SemVer | null = semver.parse(version, true);\n  if (versionSemver === null) {\n    return;\n  }\n\n  for (const versionItem in versions) {\n    if (Object.prototype.hasOwnProperty.call(versions, versionItem)) {\n      // @ts-ignore\n      if (versionSemver.compare(semver.parse(versionItem, true)) === 0) {\n        return versions[versionItem];\n      }\n    }\n  }\n}\n\n/**\n * Function filters out bad semver versions and sorts the array.\n * @return {Array} sorted Array\n */\nexport function sortVersionsAndFilterInvalid(listVersions: string[] /* logger */): string[] {\n  return listVersions\n    .filter(function (version): boolean {\n      if (!semver.parse(version, true)) {\n        return false;\n      }\n      return true;\n    })\n    .sort(semver.compareLoose)\n    .map(String);\n}\n\n/**\n * Create a tag for a package\n * @param {*} data\n * @param {*} version\n * @param {*} tag\n * @return {Boolean} whether a package has been tagged\n * @deprecated\n */\nexport function tagVersion(data: Manifest, version: string, tag: StringValue): boolean {\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n    return true;\n  }\n  return false;\n}\n\n/**\n *\n * @param manifest\n * @param version\n * @param tag\n * @returns\n */\nexport function tagVersionNext(manifest: Manifest, version: string, tag: StringValue): Manifest {\n  const data = { ...manifest };\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n  }\n  return data;\n}\n\n/**\n *  Check if the version is newer than the older version.\n * @param newVersion\n * @param oldVersion\n * @returns\n */\nexport function isNewerVersion(newVersion, oldVersion) {\n  const comparisonResult = semver.compare(newVersion, oldVersion);\n\n  return comparisonResult === 1 || comparisonResult === 0;\n}\n\n/**\n * Remove duplicates from search results.\n * @param {Array} objects\n * @return {Array} filtered array\n */\nexport function removeLowerVersions(objects: searchUtils.SearchPackageItem[]) {\n  const versionMap = new Map();\n\n  // Iterate through the array and keep the highest version for each name\n  objects.forEach((item) => {\n    const { name, version } = item.package;\n    const key = name;\n\n    if (versionMap.has(name) === false || isNewerVersion(version, versionMap.get(name))) {\n      debug('keeping %o@%o', name, version);\n      versionMap.set(key, version);\n    }\n  });\n\n  // Filter objects based on the version map\n  return objects.reduce((acc, item) => {\n    const { name, version } = item.package;\n    if (\n      versionMap.has(name) &&\n      versionMap.get(name) === version &&\n      acc.find((i) => i.package.name === name) === undefined\n    ) {\n      debug('adding %o@%o', name, version);\n      acc.push(item);\n    }\n    return acc;\n  }, [] as searchUtils.SearchPackageItem[]);\n}\n"],"mappings":";;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,yBAAyB;;;;;AAMlD,SAAgB,WAAW,UAAoB,SAAsC;CACnF,IAAI,CAAC,UACH;CAIF,KAAA,GAAI,UAAA,MAAA,CAAM,SAAS,QAAQ,MAAM,OAC/B,OAAO,SAAS;CAGlB,MAAM,gBAA+B,OAAA,QAAO,MAAM,SAAS,IAAI;CAC/D,IAAI,kBAAkB,MACpB;CAGF,KAAK,MAAM,eAAe,UACxB,IAAI,OAAO,UAAU,eAAe,KAAK,UAAU,WAAW,GAExD;MAAA,cAAc,QAAQ,OAAA,QAAO,MAAM,aAAa,IAAI,CAAC,MAAM,GAC7D,OAAO,SAAS;CAAA;AAIxB;;;;;AAMA,SAAgB,6BAA6B,cAA+C;CAC1F,OAAO,aACJ,OAAO,SAAU,SAAkB;EAClC,IAAI,CAAC,OAAA,QAAO,MAAM,SAAS,IAAI,GAC7B,OAAO;EAET,OAAO;CACT,CAAC,CAAC,CACD,KAAK,OAAA,QAAO,YAAY,CAAC,CACzB,IAAI,MAAM;AACf;;;;;;;;;AAUA,SAAgB,WAAW,MAAgB,SAAiB,KAA2B;CACrF,IAAI,OAAO,KAAK,gBAAA,UAAU,CAAC,SAAS,WAAW,OAAA,QAAO,MAAM,SAAS,IAAI,GAAG;EAE1E,KAAK,gBAAA,UAAU,CAAC,OAAO;EACvB,OAAO;CACT;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,UAAoB,SAAiB,KAA4B;CAC9F,MAAM,OAAO,EAAE,GAAG,SAAS;CAC3B,IAAI,OAAO,KAAK,gBAAA,UAAU,CAAC,SAAS,WAAW,OAAA,QAAO,MAAM,SAAS,IAAI,GAEvE,KAAK,gBAAA,UAAU,CAAC,OAAO;CAEzB,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,YAAY,YAAY;CACrD,MAAM,mBAAmB,OAAA,QAAO,QAAQ,YAAY,UAAU;CAE9D,OAAO,qBAAqB,KAAK,qBAAqB;AACxD;;;;;;AAOA,SAAgB,oBAAoB,SAA0C;CAC5E,MAAM,6BAAa,IAAI,IAAI;CAG3B,QAAQ,SAAS,SAAS;EACxB,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,MAAM,MAAM;EAEZ,IAAI,WAAW,IAAI,IAAI,MAAM,SAAS,eAAe,SAAS,WAAW,IAAI,IAAI,CAAC,GAAG;GACnF,QAAM,iBAAiB,MAAM,OAAO;GACpC,WAAW,IAAI,KAAK,OAAO;EAC7B;CACF,CAAC;CAGD,OAAO,QAAQ,QAAQ,KAAK,SAAS;EACnC,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,IACE,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,MAAM,WACzB,IAAI,MAAM,MAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,KAAA,GAC7C;GACA,QAAM,gBAAgB,MAAM,OAAO;GACnC,IAAI,KAAK,IAAI;EACf;EACA,OAAO;CACT,GAAG,CAAC,CAAoC;AAC1C"}
+{"version":3,"file":"versions-utils.js","names":[],"sources":["../../src/lib/versions-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\nimport type { SemVer } from 'semver';\nimport semver from 'semver';\n\nimport type { searchUtils } from '@verdaccio/core';\nimport { DIST_TAGS, pkgUtils } from '@verdaccio/core';\nimport type { Manifest, StringValue, Version, Versions } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:storage:utils');\n\n/**\n * Gets version from a package object taking into account semver weirdness.\n * @return {String} return the semantic version of a package\n */\nexport function getVersion(versions: Versions, version: string): Version | undefined {\n  if (!versions) {\n    return;\n  }\n\n  // this condition must allow cast\n  if (isNil(versions[version]) === false) {\n    return versions[version];\n  }\n\n  const versionSemver: SemVer | null = semver.parse(version, true);\n  if (versionSemver === null) {\n    return;\n  }\n\n  for (const versionItem in versions) {\n    if (Object.prototype.hasOwnProperty.call(versions, versionItem)) {\n      // @ts-ignore\n      if (versionSemver.compare(semver.parse(versionItem, true)) === 0) {\n        return versions[versionItem];\n      }\n    }\n  }\n}\n\n/**\n * Function filters out bad semver versions and sorts the array.\n * @return {Array} sorted Array\n */\nexport function sortVersionsAndFilterInvalid(listVersions: string[] /* logger */): string[] {\n  return listVersions\n    .filter(function (version): boolean {\n      if (!semver.parse(version, true)) {\n        return false;\n      }\n      return true;\n    })\n    .sort(semver.compareLoose)\n    .map(String);\n}\n\n/**\n * Create a tag for a package\n * @param {*} data\n * @param {*} version\n * @param {*} tag\n * @return {Boolean} whether a package has been tagged\n * @deprecated\n */\nexport function tagVersion(data: Manifest, version: string, tag: StringValue): boolean {\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n    return true;\n  }\n  return false;\n}\n\n/**\n *\n * @param manifest\n * @param version\n * @param tag\n * @returns\n */\nexport function tagVersionNext(manifest: Manifest, version: string, tag: StringValue): Manifest {\n  const data = { ...manifest };\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n  }\n  return data;\n}\n\n/**\n * Whether `newVersion` is strictly newer than `oldVersion` under loose semver.\n * Equal versions in any spelling (`1.2.3`, `v1.2.3`, `01.2.3`, `1.2.3+build`) are\n * not newer, so search merges keep the entry they saw first, which is the local one.\n * Both arguments must already pass `pkgUtils.isValidVersion`.\n */\nexport function isNewerVersion(newVersion: string, oldVersion: string): boolean {\n  return semver.compareLoose(newVersion, oldVersion) === 1;\n}\n\n/**\n * Remove duplicates from search results.\n * @param {Array} objects\n * @return {Array} filtered array\n */\nexport function removeLowerVersions(objects: searchUtils.SearchPackageItem[]) {\n  const versionMap = new Map();\n  const validObjects = objects.filter((item) => {\n    const version = item?.package?.version;\n    const valid = pkgUtils.isValidVersion(version);\n    if (!valid) debug('ignoring invalid search version %o', version);\n    return valid;\n  });\n\n  // Iterate through the array and keep the highest version for each name\n  validObjects.forEach((item) => {\n    const { name, version } = item.package;\n    const key = name;\n\n    if (versionMap.has(name) === false || isNewerVersion(version, versionMap.get(name))) {\n      debug('keeping %o@%o', name, version);\n      versionMap.set(key, version);\n    }\n  });\n\n  // Filter objects based on the version map\n  return validObjects.reduce((acc, item) => {\n    const { name, version } = item.package;\n    if (\n      versionMap.has(name) &&\n      versionMap.get(name) === version &&\n      acc.find((i) => i.package.name === name) === undefined\n    ) {\n      debug('adding %o@%o', name, version);\n      acc.push(item);\n    }\n    return acc;\n  }, [] as searchUtils.SearchPackageItem[]);\n}\n"],"mappings":";;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,yBAAyB;;;;;AAMlD,SAAgB,WAAW,UAAoB,SAAsC;CACnF,IAAI,CAAC,UACH;CAIF,KAAA,GAAI,UAAA,MAAA,CAAM,SAAS,QAAQ,MAAM,OAC/B,OAAO,SAAS;CAGlB,MAAM,gBAA+B,OAAA,QAAO,MAAM,SAAS,IAAI;CAC/D,IAAI,kBAAkB,MACpB;CAGF,KAAK,MAAM,eAAe,UACxB,IAAI,OAAO,UAAU,eAAe,KAAK,UAAU,WAAW,GAExD;MAAA,cAAc,QAAQ,OAAA,QAAO,MAAM,aAAa,IAAI,CAAC,MAAM,GAC7D,OAAO,SAAS;CAAA;AAIxB;;;;;AAMA,SAAgB,6BAA6B,cAA+C;CAC1F,OAAO,aACJ,OAAO,SAAU,SAAkB;EAClC,IAAI,CAAC,OAAA,QAAO,MAAM,SAAS,IAAI,GAC7B,OAAO;EAET,OAAO;CACT,CAAC,CAAC,CACD,KAAK,OAAA,QAAO,YAAY,CAAC,CACzB,IAAI,MAAM;AACf;;;;;;;;;AAUA,SAAgB,WAAW,MAAgB,SAAiB,KAA2B;CACrF,IAAI,OAAO,KAAK,gBAAA,UAAU,CAAC,SAAS,WAAW,OAAA,QAAO,MAAM,SAAS,IAAI,GAAG;EAE1E,KAAK,gBAAA,UAAU,CAAC,OAAO;EACvB,OAAO;CACT;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,UAAoB,SAAiB,KAA4B;CAC9F,MAAM,OAAO,EAAE,GAAG,SAAS;CAC3B,IAAI,OAAO,KAAK,gBAAA,UAAU,CAAC,SAAS,WAAW,OAAA,QAAO,MAAM,SAAS,IAAI,GAEvE,KAAK,gBAAA,UAAU,CAAC,OAAO;CAEzB,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,YAAoB,YAA6B;CAC9E,OAAO,OAAA,QAAO,aAAa,YAAY,UAAU,MAAM;AACzD;;;;;;AAOA,SAAgB,oBAAoB,SAA0C;CAC5E,MAAM,6BAAa,IAAI,IAAI;CAC3B,MAAM,eAAe,QAAQ,QAAQ,SAAS;EAC5C,MAAM,UAAU,MAAM,SAAS;EAC/B,MAAM,QAAQ,gBAAA,SAAS,eAAe,OAAO;EAC7C,IAAI,CAAC,OAAO,QAAM,sCAAsC,OAAO;EAC/D,OAAO;CACT,CAAC;CAGD,aAAa,SAAS,SAAS;EAC7B,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,MAAM,MAAM;EAEZ,IAAI,WAAW,IAAI,IAAI,MAAM,SAAS,eAAe,SAAS,WAAW,IAAI,IAAI,CAAC,GAAG;GACnF,QAAM,iBAAiB,MAAM,OAAO;GACpC,WAAW,IAAI,KAAK,OAAO;EAC7B;CACF,CAAC;CAGD,OAAO,aAAa,QAAQ,KAAK,SAAS;EACxC,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,IACE,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,MAAM,WACzB,IAAI,MAAM,MAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,KAAA,GAC7C;GACA,QAAM,gBAAgB,MAAM,OAAO;GACnC,IAAI,KAAK,IAAI;EACf;EACA,OAAO;CACT,GAAG,CAAC,CAAoC;AAC1C"}

package/build/lib/versions-utils.mjs

@@ -1,6 +1,6 @@
 import buildDebug from "debug";
 import { isNil } from "lodash-es";
-import { DIST_TAGS } from "@verdaccio/core";
+import { DIST_TAGS, pkgUtils } from "@verdaccio/core";
 import semver from "semver";
 //#region src/lib/versions-utils.ts
 var debug = buildDebug("verdaccio:storage:utils");
@@ -55,14 +55,13 @@ function tagVersionNext(manifest, version, tag) {
 	return data;
 }
 /**
-*  Check if the version is newer than the older version.
-* @param newVersion
-* @param oldVersion
-* @returns
+* Whether `newVersion` is strictly newer than `oldVersion` under loose semver.
+* Equal versions in any spelling (`1.2.3`, `v1.2.3`, `01.2.3`, `1.2.3+build`) are
+* not newer, so search merges keep the entry they saw first, which is the local one.
+* Both arguments must already pass `pkgUtils.isValidVersion`.
 */
 function isNewerVersion(newVersion, oldVersion) {
-	const comparisonResult = semver.compare(newVersion, oldVersion);
-	return comparisonResult === 1 || comparisonResult === 0;
+	return semver.compareLoose(newVersion, oldVersion) === 1;
 }
 /**
 * Remove duplicates from search results.
@@ -71,7 +70,13 @@ function isNewerVersion(newVersion, oldVersion) {
 */
 function removeLowerVersions(objects) {
 	const versionMap = /* @__PURE__ */ new Map();
-	objects.forEach((item) => {
+	const validObjects = objects.filter((item) => {
+		const version = item?.package?.version;
+		const valid = pkgUtils.isValidVersion(version);
+		if (!valid) debug("ignoring invalid search version %o", version);
+		return valid;
+	});
+	validObjects.forEach((item) => {
 		const { name, version } = item.package;
 		const key = name;
 		if (versionMap.has(name) === false || isNewerVersion(version, versionMap.get(name))) {
@@ -79,7 +84,7 @@ function removeLowerVersions(objects) {
 			versionMap.set(key, version);
 		}
 	});
-	return objects.reduce((acc, item) => {
+	return validObjects.reduce((acc, item) => {
 		const { name, version } = item.package;
 		if (versionMap.has(name) && versionMap.get(name) === version && acc.find((i) => i.package.name === name) === void 0) {
 			debug("adding %o@%o", name, version);

package/build/lib/versions-utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"versions-utils.mjs","names":[],"sources":["../../src/lib/versions-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\nimport type { SemVer } from 'semver';\nimport semver from 'semver';\n\nimport type { searchUtils } from '@verdaccio/core';\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { Manifest, StringValue, Version, Versions } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:storage:utils');\n\n/**\n * Gets version from a package object taking into account semver weirdness.\n * @return {String} return the semantic version of a package\n */\nexport function getVersion(versions: Versions, version: string): Version | undefined {\n  if (!versions) {\n    return;\n  }\n\n  // this condition must allow cast\n  if (isNil(versions[version]) === false) {\n    return versions[version];\n  }\n\n  const versionSemver: SemVer | null = semver.parse(version, true);\n  if (versionSemver === null) {\n    return;\n  }\n\n  for (const versionItem in versions) {\n    if (Object.prototype.hasOwnProperty.call(versions, versionItem)) {\n      // @ts-ignore\n      if (versionSemver.compare(semver.parse(versionItem, true)) === 0) {\n        return versions[versionItem];\n      }\n    }\n  }\n}\n\n/**\n * Function filters out bad semver versions and sorts the array.\n * @return {Array} sorted Array\n */\nexport function sortVersionsAndFilterInvalid(listVersions: string[] /* logger */): string[] {\n  return listVersions\n    .filter(function (version): boolean {\n      if (!semver.parse(version, true)) {\n        return false;\n      }\n      return true;\n    })\n    .sort(semver.compareLoose)\n    .map(String);\n}\n\n/**\n * Create a tag for a package\n * @param {*} data\n * @param {*} version\n * @param {*} tag\n * @return {Boolean} whether a package has been tagged\n * @deprecated\n */\nexport function tagVersion(data: Manifest, version: string, tag: StringValue): boolean {\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n    return true;\n  }\n  return false;\n}\n\n/**\n *\n * @param manifest\n * @param version\n * @param tag\n * @returns\n */\nexport function tagVersionNext(manifest: Manifest, version: string, tag: StringValue): Manifest {\n  const data = { ...manifest };\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n  }\n  return data;\n}\n\n/**\n *  Check if the version is newer than the older version.\n * @param newVersion\n * @param oldVersion\n * @returns\n */\nexport function isNewerVersion(newVersion, oldVersion) {\n  const comparisonResult = semver.compare(newVersion, oldVersion);\n\n  return comparisonResult === 1 || comparisonResult === 0;\n}\n\n/**\n * Remove duplicates from search results.\n * @param {Array} objects\n * @return {Array} filtered array\n */\nexport function removeLowerVersions(objects: searchUtils.SearchPackageItem[]) {\n  const versionMap = new Map();\n\n  // Iterate through the array and keep the highest version for each name\n  objects.forEach((item) => {\n    const { name, version } = item.package;\n    const key = name;\n\n    if (versionMap.has(name) === false || isNewerVersion(version, versionMap.get(name))) {\n      debug('keeping %o@%o', name, version);\n      versionMap.set(key, version);\n    }\n  });\n\n  // Filter objects based on the version map\n  return objects.reduce((acc, item) => {\n    const { name, version } = item.package;\n    if (\n      versionMap.has(name) &&\n      versionMap.get(name) === version &&\n      acc.find((i) => i.package.name === name) === undefined\n    ) {\n      debug('adding %o@%o', name, version);\n      acc.push(item);\n    }\n    return acc;\n  }, [] as searchUtils.SearchPackageItem[]);\n}\n"],"mappings":";;;;;AASA,IAAM,QAAQ,WAAW,yBAAyB;;;;;AAMlD,SAAgB,WAAW,UAAoB,SAAsC;CACnF,IAAI,CAAC,UACH;CAIF,IAAI,MAAM,SAAS,QAAQ,MAAM,OAC/B,OAAO,SAAS;CAGlB,MAAM,gBAA+B,OAAO,MAAM,SAAS,IAAI;CAC/D,IAAI,kBAAkB,MACpB;CAGF,KAAK,MAAM,eAAe,UACxB,IAAI,OAAO,UAAU,eAAe,KAAK,UAAU,WAAW,GAExD;MAAA,cAAc,QAAQ,OAAO,MAAM,aAAa,IAAI,CAAC,MAAM,GAC7D,OAAO,SAAS;CAAA;AAIxB;;;;;AAMA,SAAgB,6BAA6B,cAA+C;CAC1F,OAAO,aACJ,OAAO,SAAU,SAAkB;EAClC,IAAI,CAAC,OAAO,MAAM,SAAS,IAAI,GAC7B,OAAO;EAET,OAAO;CACT,CAAC,CAAC,CACD,KAAK,OAAO,YAAY,CAAC,CACzB,IAAI,MAAM;AACf;;;;;;;;;AAUA,SAAgB,WAAW,MAAgB,SAAiB,KAA2B;CACrF,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,WAAW,OAAO,MAAM,SAAS,IAAI,GAAG;EAE1E,KAAK,UAAU,CAAC,OAAO;EACvB,OAAO;CACT;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,UAAoB,SAAiB,KAA4B;CAC9F,MAAM,OAAO,EAAE,GAAG,SAAS;CAC3B,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,WAAW,OAAO,MAAM,SAAS,IAAI,GAEvE,KAAK,UAAU,CAAC,OAAO;CAEzB,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,YAAY,YAAY;CACrD,MAAM,mBAAmB,OAAO,QAAQ,YAAY,UAAU;CAE9D,OAAO,qBAAqB,KAAK,qBAAqB;AACxD;;;;;;AAOA,SAAgB,oBAAoB,SAA0C;CAC5E,MAAM,6BAAa,IAAI,IAAI;CAG3B,QAAQ,SAAS,SAAS;EACxB,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,MAAM,MAAM;EAEZ,IAAI,WAAW,IAAI,IAAI,MAAM,SAAS,eAAe,SAAS,WAAW,IAAI,IAAI,CAAC,GAAG;GACnF,MAAM,iBAAiB,MAAM,OAAO;GACpC,WAAW,IAAI,KAAK,OAAO;EAC7B;CACF,CAAC;CAGD,OAAO,QAAQ,QAAQ,KAAK,SAAS;EACnC,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,IACE,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,MAAM,WACzB,IAAI,MAAM,MAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,KAAA,GAC7C;GACA,MAAM,gBAAgB,MAAM,OAAO;GACnC,IAAI,KAAK,IAAI;EACf;EACA,OAAO;CACT,GAAG,CAAC,CAAoC;AAC1C"}
+{"version":3,"file":"versions-utils.mjs","names":[],"sources":["../../src/lib/versions-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\nimport type { SemVer } from 'semver';\nimport semver from 'semver';\n\nimport type { searchUtils } from '@verdaccio/core';\nimport { DIST_TAGS, pkgUtils } from '@verdaccio/core';\nimport type { Manifest, StringValue, Version, Versions } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:storage:utils');\n\n/**\n * Gets version from a package object taking into account semver weirdness.\n * @return {String} return the semantic version of a package\n */\nexport function getVersion(versions: Versions, version: string): Version | undefined {\n  if (!versions) {\n    return;\n  }\n\n  // this condition must allow cast\n  if (isNil(versions[version]) === false) {\n    return versions[version];\n  }\n\n  const versionSemver: SemVer | null = semver.parse(version, true);\n  if (versionSemver === null) {\n    return;\n  }\n\n  for (const versionItem in versions) {\n    if (Object.prototype.hasOwnProperty.call(versions, versionItem)) {\n      // @ts-ignore\n      if (versionSemver.compare(semver.parse(versionItem, true)) === 0) {\n        return versions[versionItem];\n      }\n    }\n  }\n}\n\n/**\n * Function filters out bad semver versions and sorts the array.\n * @return {Array} sorted Array\n */\nexport function sortVersionsAndFilterInvalid(listVersions: string[] /* logger */): string[] {\n  return listVersions\n    .filter(function (version): boolean {\n      if (!semver.parse(version, true)) {\n        return false;\n      }\n      return true;\n    })\n    .sort(semver.compareLoose)\n    .map(String);\n}\n\n/**\n * Create a tag for a package\n * @param {*} data\n * @param {*} version\n * @param {*} tag\n * @return {Boolean} whether a package has been tagged\n * @deprecated\n */\nexport function tagVersion(data: Manifest, version: string, tag: StringValue): boolean {\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n    return true;\n  }\n  return false;\n}\n\n/**\n *\n * @param manifest\n * @param version\n * @param tag\n * @returns\n */\nexport function tagVersionNext(manifest: Manifest, version: string, tag: StringValue): Manifest {\n  const data = { ...manifest };\n  if (tag && data[DIST_TAGS][tag] !== version && semver.parse(version, true)) {\n    // valid version - store\n    data[DIST_TAGS][tag] = version;\n  }\n  return data;\n}\n\n/**\n * Whether `newVersion` is strictly newer than `oldVersion` under loose semver.\n * Equal versions in any spelling (`1.2.3`, `v1.2.3`, `01.2.3`, `1.2.3+build`) are\n * not newer, so search merges keep the entry they saw first, which is the local one.\n * Both arguments must already pass `pkgUtils.isValidVersion`.\n */\nexport function isNewerVersion(newVersion: string, oldVersion: string): boolean {\n  return semver.compareLoose(newVersion, oldVersion) === 1;\n}\n\n/**\n * Remove duplicates from search results.\n * @param {Array} objects\n * @return {Array} filtered array\n */\nexport function removeLowerVersions(objects: searchUtils.SearchPackageItem[]) {\n  const versionMap = new Map();\n  const validObjects = objects.filter((item) => {\n    const version = item?.package?.version;\n    const valid = pkgUtils.isValidVersion(version);\n    if (!valid) debug('ignoring invalid search version %o', version);\n    return valid;\n  });\n\n  // Iterate through the array and keep the highest version for each name\n  validObjects.forEach((item) => {\n    const { name, version } = item.package;\n    const key = name;\n\n    if (versionMap.has(name) === false || isNewerVersion(version, versionMap.get(name))) {\n      debug('keeping %o@%o', name, version);\n      versionMap.set(key, version);\n    }\n  });\n\n  // Filter objects based on the version map\n  return validObjects.reduce((acc, item) => {\n    const { name, version } = item.package;\n    if (\n      versionMap.has(name) &&\n      versionMap.get(name) === version &&\n      acc.find((i) => i.package.name === name) === undefined\n    ) {\n      debug('adding %o@%o', name, version);\n      acc.push(item);\n    }\n    return acc;\n  }, [] as searchUtils.SearchPackageItem[]);\n}\n"],"mappings":";;;;;AASA,IAAM,QAAQ,WAAW,yBAAyB;;;;;AAMlD,SAAgB,WAAW,UAAoB,SAAsC;CACnF,IAAI,CAAC,UACH;CAIF,IAAI,MAAM,SAAS,QAAQ,MAAM,OAC/B,OAAO,SAAS;CAGlB,MAAM,gBAA+B,OAAO,MAAM,SAAS,IAAI;CAC/D,IAAI,kBAAkB,MACpB;CAGF,KAAK,MAAM,eAAe,UACxB,IAAI,OAAO,UAAU,eAAe,KAAK,UAAU,WAAW,GAExD;MAAA,cAAc,QAAQ,OAAO,MAAM,aAAa,IAAI,CAAC,MAAM,GAC7D,OAAO,SAAS;CAAA;AAIxB;;;;;AAMA,SAAgB,6BAA6B,cAA+C;CAC1F,OAAO,aACJ,OAAO,SAAU,SAAkB;EAClC,IAAI,CAAC,OAAO,MAAM,SAAS,IAAI,GAC7B,OAAO;EAET,OAAO;CACT,CAAC,CAAC,CACD,KAAK,OAAO,YAAY,CAAC,CACzB,IAAI,MAAM;AACf;;;;;;;;;AAUA,SAAgB,WAAW,MAAgB,SAAiB,KAA2B;CACrF,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,WAAW,OAAO,MAAM,SAAS,IAAI,GAAG;EAE1E,KAAK,UAAU,CAAC,OAAO;EACvB,OAAO;CACT;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,UAAoB,SAAiB,KAA4B;CAC9F,MAAM,OAAO,EAAE,GAAG,SAAS;CAC3B,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,WAAW,OAAO,MAAM,SAAS,IAAI,GAEvE,KAAK,UAAU,CAAC,OAAO;CAEzB,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,YAAoB,YAA6B;CAC9E,OAAO,OAAO,aAAa,YAAY,UAAU,MAAM;AACzD;;;;;;AAOA,SAAgB,oBAAoB,SAA0C;CAC5E,MAAM,6BAAa,IAAI,IAAI;CAC3B,MAAM,eAAe,QAAQ,QAAQ,SAAS;EAC5C,MAAM,UAAU,MAAM,SAAS;EAC/B,MAAM,QAAQ,SAAS,eAAe,OAAO;EAC7C,IAAI,CAAC,OAAO,MAAM,sCAAsC,OAAO;EAC/D,OAAO;CACT,CAAC;CAGD,aAAa,SAAS,SAAS;EAC7B,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,MAAM,MAAM;EAEZ,IAAI,WAAW,IAAI,IAAI,MAAM,SAAS,eAAe,SAAS,WAAW,IAAI,IAAI,CAAC,GAAG;GACnF,MAAM,iBAAiB,MAAM,OAAO;GACpC,WAAW,IAAI,KAAK,OAAO;EAC7B;CACF,CAAC;CAGD,OAAO,aAAa,QAAQ,KAAK,SAAS;EACxC,MAAM,EAAE,MAAM,YAAY,KAAK;EAC/B,IACE,WAAW,IAAI,IAAI,KACnB,WAAW,IAAI,IAAI,MAAM,WACzB,IAAI,MAAM,MAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,KAAA,GAC7C;GACA,MAAM,gBAAgB,MAAM,OAAO;GACnC,IAAI,KAAK,IAAI;EACf;EACA,OAAO;CACT,GAAG,CAAC,CAAoC;AAC1C"}

package/build/storage.d.ts

@@ -42,6 +42,8 @@ declare class Storage {
      * (privated and cached).
      */
     search(options: ProxySearchParams): Promise<searchUtils.SearchPackageItem[]>;
+    /** Cumulative, stable prefixes for Search v1; consumers stop once their page is full. */
+    searchPages(options: ProxySearchParams): AsyncGenerator<searchUtils.SearchPackageItem[], void, unknown>;
     private getTarballFromUpstream;
     private fetchTarballFromDistFile;
     /**
@@ -120,6 +122,16 @@ declare class Storage {
      * @param tags list of dist-tags
      */
     mergeTagsNext(name: string, tags: MergeTags): Promise<Manifest>;
+    /**
+     * Resolve the uplink to fetch a distfile url from, or null when the fetch
+     * must be refused.
+     *
+     * Off-uplink urls on a locally published package are not fetched: the
+     * client's `dist.tarball` is stored verbatim, and fetching it would be SSRF
+     * (and would attach uplink credentials when only one uplink is configured).
+     * Uplink-synced packages may still use an autogenerated proxy without
+     * credentials for CDN-hosted tarballs.
+     */
     private getUpLinkForDistFile;
     updateManifest(manifest: Manifest | OwnerManifestBody | UnPublishManifest, options: UpdateManifestOptions): Promise<string | undefined>;
     private deprecate;

package/build/storage.js

@@ -159,6 +159,41 @@ var Storage = class {
 		debug$1("unique results %o", uniqueResults.length);
 		return uniqueResults;
 	}
+	/** Cumulative, stable prefixes for Search v1; consumers stop once their page is full. */
+	async *searchPages(options) {
+		options.abort.signal.throwIfAborted();
+		const local = await this.getCachedPackages({
+			...options.query,
+			from: 0,
+			size: _verdaccio_search.SEARCH_MAX_CANDIDATES
+		});
+		const merged = /* @__PURE__ */ new Map();
+		let candidates = 0;
+		const append = (items) => {
+			options.abort.signal.throwIfAborted();
+			candidates += items.length;
+			if (candidates > _verdaccio_search.SEARCH_MAX_CANDIDATES) throw _verdaccio_core.errorUtils.getServiceUnavailable("search pagination budget exhausted");
+			for (const item of items) {
+				if (!_verdaccio_core.pkgUtils.isValidVersion(item?.package?.version)) {
+					this.logger.warn({
+						name: item?.package?.name,
+						version: item?.package?.version
+					}, "ignoring invalid search version for @{name}: @{version}");
+					continue;
+				}
+				const previous = merged.get(item.package.name);
+				if (!previous || require_versions_utils.isNewerVersion(item.package.version, previous.package.version)) merged.set(item.package.name, item);
+			}
+			return [...merged.values()];
+		};
+		append(local);
+		let hadRound = false;
+		for await (const round of this.searchService.searchPages(options)) {
+			hadRound = true;
+			yield append(round);
+		}
+		if (!hadRound) yield [...merged.values()];
+	}
 	async getTarballFromUpstream(name, filename, { signal }) {
 		this.logger.info({
 			name,
@@ -174,7 +209,7 @@ var Storage = class {
 		const cachedDistFile = cachedManifest !== null ? require_storage_utils.lookupDistFile(cachedManifest, filename) : null;
 		if (cachedDistFile !== null && typeof cachedDistFile.url === "string") {
 			debug$1("dist file found, using it %o", cachedDistFile.url);
-			return this.fetchTarballFromDistFile(name, filename, cachedDistFile, { signal });
+			return this.fetchTarballFromDistFile(name, filename, cachedDistFile, cachedManifest, { signal });
 		} else {
 			debug$1("dist file not found, proceed update upstream");
 			const [updatedManifest] = await this.syncUplinksMetadata(name, cachedManifest, { uplinksLook: true });
@@ -183,15 +218,19 @@ var Storage = class {
 				debug$1("remote tarball not found");
 				throw _verdaccio_core.errorUtils.getNotFound(_verdaccio_core.API_ERROR.NO_SUCH_FILE);
 			}
-			return this.fetchTarballFromDistFile(name, filename, distFile, { signal });
+			return this.fetchTarballFromDistFile(name, filename, distFile, updatedManifest, { signal });
 		}
 	}
-	fetchTarballFromDistFile(name, filename, distFile, { signal }) {
+	fetchTarballFromDistFile(name, filename, distFile, origin, { signal }) {
 		let current_length = 0;
 		let expected_length;
 		let uplinkStatusError = null;
 		const passThroughRemoteStream = new node_stream.PassThrough();
-		const proxy = this.getUpLinkForDistFile(name, distFile);
+		const proxy = this.getUpLinkForDistFile(name, filename, distFile, origin);
+		if (proxy === null) {
+			setImmediate(() => passThroughRemoteStream.emit("error", _verdaccio_core.errorUtils.getNotFound(_verdaccio_core.API_ERROR.NO_SUCH_FILE)));
+			return passThroughRemoteStream;
+		}
 		const remoteStream = proxy.fetchTarball(distFile.url, { throwHttpErrors: false });
 		const readRemoteBody = () => new Promise((resolve) => {
 			const chunks = [];
@@ -296,7 +335,14 @@ var Storage = class {
 		const localStream = await this.getLocalTarball(name, filename, { signal });
 		forwardContentLength(localStream);
 		localStream.on("open", async () => {
-			await (0, node_stream_promises.pipeline)(localStream, localTarballStream, { signal });
+			try {
+				await (0, node_stream_promises.pipeline)(localStream, localTarballStream, { signal });
+			} catch (err) {
+				this.logger.warn({
+					err,
+					filename
+				}, "error streaming local tarball @{filename}: @{err.message}");
+			}
 		});
 		localStream.on("error", (err) => {
 			if (err.code === require_storage_utils.STORAGE.NO_SUCH_FILE_ERROR || err.code === _verdaccio_core.HTTP_STATUS.NOT_FOUND) this.getTarballFromUpstream(name, filename, { signal }).then((uplinkStream) => {
@@ -628,18 +674,45 @@ var Storage = class {
 			return newData;
 		});
 	}
-	getUpLinkForDistFile(pkgName, distFile) {
-		if (distFile.registry && this.uplinks[distFile.registry]) {
-			debug$1("tarball is served by the recorded uplink %o", distFile.registry);
-			return this.uplinks[distFile.registry];
-		}
+	/**
+	* Resolve the uplink to fetch a distfile url from, or null when the fetch
+	* must be refused.
+	*
+	* Off-uplink urls on a locally published package are not fetched: the
+	* client's `dist.tarball` is stored verbatim, and fetching it would be SSRF
+	* (and would attach uplink credentials when only one uplink is configured).
+	* Uplink-synced packages may still use an autogenerated proxy without
+	* credentials for CDN-hosted tarballs.
+	*/
+	getUpLinkForDistFile(pkgName, filename, distFile, origin) {
 		const candidates = [];
 		for (const uplinkName in this.uplinks) if ((0, _verdaccio_config.hasProxyTo)(pkgName, uplinkName, this.config.packages)) candidates.push(this.uplinks[uplinkName]);
 		let uplink = null;
-		for (const candidate of candidates) if (require_storage_utils.uplinkServesUrl(candidate.url, distFile.url)) uplink = candidate;
-		if (uplink === null && candidates.length === 1) uplink = candidates[0];
+		if (distFile.registry && this.uplinks[distFile.registry]) {
+			const recorded = this.uplinks[distFile.registry];
+			if (require_storage_utils.uplinkServesUrl(recorded.url, distFile.url)) {
+				debug$1("tarball is served by the recorded uplink %o", distFile.registry);
+				uplink = recorded;
+			}
+		}
+		if (uplink === null) {
+			for (const candidate of candidates) if (require_storage_utils.uplinkServesUrl(candidate.url, distFile.url)) uplink = candidate;
+		}
 		if (uplink === null) {
-			debug$1("upstream not found, creating one for %o", pkgName);
+			if (!Boolean(origin?._distfiles?.[filename])) {
+				debug$1("refusing off-uplink tarball fetch for locally published %o (%o)", pkgName, distFile.url);
+				this.logger.warn({
+					name: pkgName,
+					filename,
+					url: distFile.url
+				}, "refused off-uplink tarball fetch for @{name} (@{url})");
+				return null;
+			}
+			debug$1("upstream not found, creating one for %o without uplink credentials", pkgName);
+			this.logger.http({
+				name: pkgName,
+				url: distFile.url
+			}, "serving off-uplink tarball via autogenerated proxy for @{name} (@{url})");
 			uplink = new _verdaccio_proxy.ProxyStorage(`verdaccio-${pkgName}`, {
 				url: distFile.url,
 				cache: true
@@ -887,10 +960,24 @@ var Storage = class {
 		});
 		else {
 			const localStorageWriteStream = await storage.writeTarball(filename, { signal });
+			let uploadFailed = false;
 			localStorageWriteStream.on("open", async () => {
-				await (0, node_stream_promises.pipeline)(uploadStream, transformHash, localStorageWriteStream, { signal });
+				try {
+					await (0, node_stream_promises.pipeline)(uploadStream, transformHash, localStorageWriteStream, { signal });
+				} catch (err) {
+					uploadFailed = true;
+					this.logger.warn({
+						err,
+						filename,
+						pkgName
+					}, "error uploading tarball @{filename} for @{pkgName}: @{err.message}");
+				}
 			});
 			localStorageWriteStream.on("close", async () => {
+				if (uploadFailed) {
+					debug$1("skip metadata update for failed upload %o for %o", filename, pkgName);
+					return;
+				}
 				try {
 					debug$1("uploaded tarball %o for %o", filename, pkgName);
 					await this.updatePackage(pkgName, async (data) => {
@@ -907,6 +994,7 @@ var Storage = class {
 				}
 			});
 			localStorageWriteStream.on("error", async (err) => {
+				uploadFailed = true;
 				uploadStream.emit("error", err);
 			});
 		}