chore(deps): update dependency verdaccio to v6.7.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
verdaccio (source)	6.7.1 → 6.7.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

verdaccio/verdaccio (verdaccio)

v6.7.4

Compare Source

Patch Changes

• 0205c78: fix: run jwt middleware before middleware plugins

  Register the JWT middleware before middleware plugins are loaded so that
  req.remote_user (anonymous by default) is available inside a plugin's
  register_middlewares. The API router keeps its own JWT middleware behind a
  guard so it is not executed twice.

  Backport of #​5697

  Closes #​5167

v6.7.3

Compare Source

Patch Changes

• f8fdfc2: fix: enforce generated npm token metadata

  Generated npm tokens (POST /-/npm/v1/tokens) stored their readonly and
  cidr_whitelist restrictions but never enforced them, and deleting a token did
  not revoke it for the package APIs. A token marked read-only or pinned to a CIDR
  range could still publish packages and change dist-tags, and a deleted token
  remained usable.

  Generated tokens now embed a server-issued key (in the JWT claim, or in the
  encrypted legacy AES payload) and a new enforceGeneratedTokenMetadata
  middleware looks that key up on each request, rejecting the token when it is
  missing/revoked, used outside its CIDR whitelist, or used for a write while
  read-only. Enforcement applies to both AES and JWT API-token modes.

  Note: tokens issued before upgrading carry no key and are not retroactively
  constrained — regenerate them to apply the restrictions.

• be80623: fix: allow npm token create without readonly/cidr_whitelist

  npm token create in npm >= 11 (and the npm 12 prereleases) rewrote the
  request body: it no longer sends readonly and only sends cidr_whitelist
  when --cidr is passed. The POST /-/npm/v1/tokens endpoint required both,
  so modern npm clients failed with 422 the parameters are not valid.

  The endpoint now defaults readonly to false and cidr_whitelist to []
  when they are absent, while still rejecting values of the wrong type.

• 75c85d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.19 → 9.0.0-next-9.20

• d5e5332: chore: update dependencies

  Updates runtime dependencies @verdaccio/ui-theme (9.0.0-next-9.19) and
  semver (7.8.2), along with development dependencies: Babel 7.29.7,
  @changesets/cli 2.31.0, ESLint 10.4.1, Vitest 4.1.8, Cypress 15.16.0,
  Prettier 3.8.3, @verdaccio/test-helper 4.0.4, @verdaccio/eslint-config
13.1.2, and assorted type definitions.

v6.7.2

Compare Source

Patch Changes

• a89aca1: chore: fix unit test
• a28cf71: chore: add missing types #​5889 by @​mbtools

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.
Managed by the SAP Open Source Program Office. For questions/issues please raise an issue in the renovate-controller repository.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[cypress]

spartacus    Run #53903

Run Properties:   Passed #53903  •  9b16cb49cb ℹ️: Merge 3c736baca61d6c4aa0e23125da0852f3c3edd58e into a583ca4dbf8b59fa70ab52f2e32c...

Project	spartacus
Branch Review	renovate/verdaccio-6.x
Run status	Passed #53903
Run duration	04m 14s
Commit	9b16cb49cb ℹ️: Merge 3c736baca61d6c4aa0e23125da0852f3c3edd58e into a583ca4dbf8b59fa70ab52f2e32c...
Committer	renovate[bot]
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	3
Pending	0
Skipped	0
Passing	103
View all changes introduced in this branch ↗︎