fix(container): update image verdaccio/verdaccio ( 6.10.1 → 6.10.3 )

[renovate]

This PR contains the following updates:

Package	Update	Change
verdaccio/verdaccio	patch	6.10.1 → 6.10.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

verdaccio/verdaccio (verdaccio/verdaccio)

v6.10.3

Compare Source

Patch Changes

• 98b58ef: fix: do not fetch client-controlled dist.tarball urls off-uplink @​cOmrade3267

  Only fetch a tarball url that a configured uplink actually serves. Off-uplink urls are
  fetched without uplink credentials and only for uplink-synced packages (recorded in
  _distfiles); a locally published package returns 404 instead of being fetched. Prevents
  sending an uplink Authorization header to an unrelated host.

v6.10.2

Compare Source

Patch Changes

• 6d972d1: fix: resolve fast-uri and brace-expansion security advisories

  fast-uri 3.1.6. Bumps the ajv/fast-uri resolution from 3.1.5 to 3.1.6, which
  fixes four high-severity advisories in the URI parser used by ajv for schema
  format validation: host confusion via skipped IDN canonicalization
  (GHSA-5jgf-p345-68v8),
  SSRF via malformed IPv6 normalization
  (GHSA-f65p-4m7j-42xc),
  SSRF via repeated hostname percent-decoding
  (GHSA-fph4-wmhf-6fwf),
  and host confusion via percent-encoded scheme normalization
  (GHSA-jqff-g426-hqxp).

  brace-expansion DoS cleanup. Updates the remaining vulnerable
  brace-expansion trees (1.1.11 → 1.1.18, 2.0.1 → 2.1.4) for
  GHSA-mh99-v99m-4gvg and
  drops the temporary audit ignores that covered them while the patched
  releases were still quarantined by the minimal-age gate.

• 6d972d1: chore: update e2e library

• ca00ee0: fix: stop re-compressing tarballs for gzip-accepting clients

  mime-db marks application/octet-stream as compressible, so the compression
  middleware re-gzipped every (already gzipped) .tgz download for clients
  that accept gzip — npm and undici do by default — wasting CPU on every
  download and stripping the Content-Length header. Tarball responses are
  now excluded from compression; JSON metadata responses stay compressed.

  Measured on a 30 MB tarball: ~18x less server CPU and ~20x faster downloads,
  with slightly fewer bytes on the wire (gzip over gzip nets negative).

• d4b8199: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.28 → 9.0.0-next-9.30

• d94ebff: fix: validate the scope segment on the web package endpoints

  The readme and sidebar web endpoints now validate the :scope route segment
  and return 404 for malformed requests.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Path: main/homelab/pkg-cache

--- /tmp/tmp.MQyBTcZk57	2026-09-06 02:20:40.611471973 +0000
+++ /tmp/tmp.D14Ew3im69	2026-09-06 02:20:41.084484688 +0000
@@ -201,7 +201,7 @@
         - env:
             - name: VERDACCIO_PORT
               value: "4873"
-          image: verdaccio/verdaccio:6.10.1
+          image: verdaccio/verdaccio:6.10.3
           name: main
           resources:
             limits: