[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
verdaccio (source)	^6.3.2 → ^7.0.0

---

Release Notes

verdaccio/verdaccio (verdaccio)

v7.1.0

Compare Source

Minor Changes

• 62163c2: Update the @verdaccio/* modules to the next-9 npm dist-tag.

  Minor changes

  • @verdaccio/config, @verdaccio/store, @verdaccio/tarball, @verdaccio/web: Add the experimental flags.tarballMetadata option, which lets the web UI show the README of the exact version being viewed and fills missing dist.fileCount/dist.unpackedSize from the tarball itself. (#​6409)

    The npm registry does not always include READMEs in package metadata: for some large packages (for example react) the README field is empty for every version, and Verdaccio by default keeps only the latest README for locally published packages (publish.keep_readmes). The web UI then showed "No README data found" or the README of a different version.

    With the flag on, a tarball is only ever unpacked in two situations: in the background right after a version is published, and when the web UI asks for a README the manifest does not have, reading the cached tarball or fetching it from the uplink. Package installs never unpack tarballs, so install performance is unaffected. The README is kept in memory, and dist.fileCount/dist.unpackedSize are written into the cached manifest when the uplink did not provide them. At most two tarballs are read at a time, and duplicate requests share one read.

    Tarballs larger than tarball_metadata.max_size_mb (default 20) are never unpacked; those versions keep the previous fallback to the latest README. The flag is off by default and the option may change or be removed in a later prerelease:

    flags:
      tarballMetadata: true
    tarball_metadata:
      max_size_mb: 20

  • @verdaccio/middleware, @verdaccio/proxy, @verdaccio/store, @verdaccio/ui-theme, @verdaccio/web: Show the provenance and registry signature of a version in the web UI. (#​6447)

    The package sidebar gets a "Provenance" section, under "Distribution", when the selected version carries a sigstore attestation or a registry signature, the fields registry.npmjs.org attaches to every version it signs. Its chip reads "Provenance: SLSA v1" for a version with provenance and "Registry signature" for one that only has a signature. Clicking it opens a dialog with the statement type, the signing key ids and a link to the attestation bundle. Nothing is verified in the browser: the dialog states what the registry metadata contains, and verification remains the job of npm audit signatures.

    The dialog also shows what the provenance statement says about the build, read from the attestation bundle by a new web endpoint, GET /-/verdaccio/data/package/provenance/<name>?v=<version>: the builder (GitHub Actions, self-hosted or not, or GitLab CI/CD, the two environments npm and Yarn generate provenance in), the source repository, ref and commit, the workflow file or job, the build run and the Sigstore transparency log entry, each linked to its origin. The endpoint relays the bundle from the uplink the version was synced from, applies the package access rules and answers 404 for versions without attestations. The build details therefore need an uplink that serves the npm attestation endpoint, /-/npm/v1/attestations/<name>@<version>, as registry.npmjs.org does; a Verdaccio upstream will only do so once it gains the registry signature routes, which are a separate change, and against such upstreams the dialog shows the summary and the bundle link alone. The request is made only when the dialog opens and only when the server announces the endpoint through the new capabilities.provenance UI option, so the theme keeps working against older servers without a single failing request: the chip, the dialog summary and the bundle link come from the sidebar data alone, and the build details simply stay out.

  • @verdaccio/api, @verdaccio/config, @verdaccio/core, @verdaccio/middleware, @verdaccio/proxy, @verdaccio/store: Make npm audit signatures work through Verdaccio for packages proxied from an uplink, behind the experimental flags.signatures setting. (#​6450)

    Verdaccio already kept the dist.signatures and dist.attestations fields that registry.npmjs.org attaches to every version, but it did not serve the two routes the npm CLI reads to verify them. npm resolves signing keys by registry host, so against Verdaccio it requested GET /-/npm/v1/keys, received a 404 and aborted the whole command with EMISSINGSIGNATUREKEY on the first package coming from npmjs. Attestation bundles are fetched from the registry the package was installed from as well, so GET /-/npm/v1/attestations/<name>@<version> also returned 404.

    Both routes now exist when flags.signatures: true is set in the configuration (the feature is experimental and may change). GET /-/npm/v1/keys returns the signing keys of every configured uplink merged by key id (refreshed hourly) and answers 404 when none publishes keys. GET /-/npm/v1/attestations/<name>@<version> relays the attestations from the first uplink that proxies the package, applying the package access rules, and answers 404 when the uplink has none. With this npm audit signatures verifies registry signatures and provenance attestations of proxied packages exactly as it does against registry.npmjs.org. Enable it with:

    flags:
      signatures: true

    Packages published to Verdaccio itself are not signed yet. npm treats any registry that publishes keys as a registry whose packages should all be signed, so once the flag is on npm audit signatures lists every locally published package as having a missing registry signature and exits with code 1; proxied packages verify, local ones are reported. Keep the flag off if that report would break a CI gate, until Verdaccio signs local packages. npm publish --provenance is still rejected.

  Patch changes

  • @verdaccio/core, @verdaccio/package-filter: Fix HTTP 500 responses for package requests when an installation forces minimatch 11. The access-rule matcher called the removed makeRe API. Use the supported matching API while retaining case-insensitive package access rules and first-match precedence. (#​6434)

    On the master and 7.x release lines, affected @verdaccio/core releases are 9.0.0-next-9.0 through 9.0.0-next-9.41. Verdaccio releases using these modules include 9.0.0-next-9.0 through 9.0.0-next-9.41 and stable releases 7.0.0 through 7.0.2. The affected 7.x prereleases using these modules are 7.0.0-beta.4, 7.0.0-beta.6, and 7.0.0-next-7.21 through 7.0.0-next-7.32.

    The failure requires an override or resolution that replaces the declared minimatch dependency with version 11; default installations of those releases are not affected. Upgrade to a Verdaccio release containing the corrected core module before forcing minimatch 11.

    Update the package filter's direct minimatch dependency as well. Existing package access and filter configuration does not need to change.

  • @verdaccio/api: Fix the registry closing the client connection after answering a failed tarball download, which made the next request on that keep-alive connection fail with ECONNRESET or "other side closed". (#​6438)

    When a tarball request fails before any data is sent, for example a 404 for a tarball that does not exist locally or on any uplink, the registry sent the JSON error response and then also passed the same error on to the HTTP framework. Because the response was already sent, the framework reacted by destroying the socket. Package managers reuse connections, so the request that followed on the same socket failed whenever the client sent it before noticing the close, which keep-alive clients under load usually do. Each of these failures also printed a raw NotFoundError stack trace to stderr. The download of a staged tarball (available when the stage flag is enabled) had the same problem.

    A failed tarball request is now answered once with its JSON error and the connection stays open for the next request. Failures after the download has started are unchanged: the connection is still terminated, because no error status can be sent at that point. No configuration change is needed.

    Affected: verdaccio 7.x (7.0.0 to 7.0.2) and the @verdaccio/api 9.0.0-next prereleases it ships, up to 9.0.0-next-9.42. verdaccio 6.x is not affected.

v7.0.2

Compare Source

Patch Changes

• c017767: Remove the HEALTHCHECK from the Docker image.

  The probe used localhost, which resolves to ::1 on Alpine, while the image listens on IPv4 only by default. The container was always reported as unhealthy even though it served requests normally. The image no longer declares a health check, as in 6.x.

  If you need one, add it yourself probing 127.0.0.1, for example in docker-compose.yaml:

  services:
    verdaccio:
      image: verdaccio/verdaccio
      healthcheck:
        test: ['CMD-SHELL', 'wget --quiet --tries=1 --spider http://127.0.0.1:4873/-/ping || exit 1']
        interval: 30s
        timeout: 5s
        start_period: 10s
        retries: 3

  See Health check in the Docker documentation for the docker run and HTTPS variants.

v7.0.1

Compare Source

Patch Changes

• 449ad6b: Restore the @verdaccio/package-filter plugin in the verdaccio 7 package so the filter configuration works again.

  Verdaccio 7.0.0 shipped a default config.yaml (also the one inside the verdaccio/verdaccio:7 Docker image) with the filters: '@verdaccio/package-filter' section enabled, but the package no longer declared the plugin as a dependency: it was dropped when the 7.x line moved to the published @verdaccio/* modules. On startup the plugin loader logged package not found, try to install @verdaccio/package-filter with a package manager and continued without it, so any minAgeDays, dateThreshold or block rules configured under filters were silently not enforced.

  The plugin is a dependency of verdaccio again, as it is on the 6.x line, and the startup error is gone. No configuration change is needed; installations that worked around the problem by commenting out the filters section can enable it again. Affected: verdaccio@7.0.0 and the verdaccio/verdaccio:7 Docker image.

• 14aaded: Show the verdaccio package version in the web UI footer instead of the internal module version.

  verdaccio@7.0.0 (and the verdaccio/verdaccio:7 Docker image) displayed 9.0.0-next-9.40 in the bottom-right corner of the web UI. The 7 binary is a thin layer over the published @verdaccio/* 9.x modules, and @verdaccio/server filled the version shown by the UI from its own package while the command line and the startup log already reported the right one.

  This release updates the @verdaccio/* modules to 9.0.0-next-9.41, whose @verdaccio/server lets the embedding binary set that value, and passes the verdaccio package version to it, so the UI now shows the same version as verdaccio --version. No configuration change is needed.

v7.0.0

Compare Source

Major Changes

• d33944c: Verdaccio 7.0.0 is the first stable release of the 7.x line. It is published to npm as latest and to Docker Hub as verdaccio/verdaccio:7, 7.0 and latest; the 6.x line continues under the latest-6 npm dist-tag and the 6 image tag. The release post is at https://verdaccio.org/blog/2026/10/25/verdaccio-7-release, the migration guide at https://verdaccio.org/blog/2026/09/27/verdaccio-6-to-7-migration, and the complete tracker with every pull request and backport at #​5680.

  Highlights

  • Staged publishing (experimental, flags.stage, npm 11.17 or newer): a pipeline uploads a version, a maintainer reviews it, and only then it becomes installable (#​6176). GET /-/package/{name}/version/{version}/status reports whether a version is published or staged (#​6365).
  • Two-factor authentication (experimental, flags.tfa): time-based one-time passwords for login, account operations and publishing (#​6176).
  • Ownership and unpublish checks on every change: publish.check_owners now covers npm deprecate, version unpublish and dist-tag changes (#​6219); removing a version requires the unpublish permission on its own route (#​6384); publish rejects invalid tarball attachment names before saving metadata and records an upload only after the tarball is fully written (#​6367).
  • Pure ESM plugins through async plugin loading, and a promise-based storage plugin API with a compatibility adapter for callback-based storage plugins (#​5933).
  • Web UI: dark mode, refreshed login, signup and password screens and SWR-based state (#​5563); packages sorted by update time (#​5659); web.assetFolder (#​5653); home toolbar to filter, scope and sort, onboarding guide for empty registries, web.footer, web.poweredBy and web.help, package tabs in the URL and bun among the package managers (#​6400); per-language translation progress with a single translation source (#​6395); password changes from the account menu (#​6366).
  • Package filter plugins with allow and block rules (#​5548), glob patterns (#​5872) and excludeDeprecated (#​6028); notification hooks for publish and unpublish (#​5920).
  • Configuration: ConfigBuilder covers web, listen, https, publish, flags, notify, middlewares, filters, maxBodySize, userRateLimit, urlPrefix and i18n (#​5805); new server.cors (#​6255), server.dotfiles, server.hideStaticLogs, server.hidePingLogs (#​6192) and server.legacyAuthCache (#​6133).
  • Authentication: htpasswd verify_cache_ms caches successful password verifications for clients that send credentials on every request (#​6351); npm login, yarn npm login and pnpm login keep working through the Basic exception on the login routes (#​6354).
  • Uplinks and search: @verdaccio/proxy on got (#​5646, #​5746) with upstream errors mapped to registry errors (#​6022); /-/v1/search with rate limits, bounded pagination and batched access checks, uplink results paginated before the client offset (#​6235), configured uplink subpaths and headers preserved (#​6209), ISO timestamps, version validation and original uplink errors preserved (#​6263, #​6264, #​6265).
  • Distribution: the server composition and CLI helpers are exported for downstream distributions (#​5932, #​6286), and the new experimental @verdaccio/admin-cli ships a verdaccio-admin storage command group (#​6231).

  Bug fixes

  • Tarball downloads: uplink selection by URL, cleanup of failed downloads, no client hangs and a correct content-length (#​6194, #​6234); client-controlled dist.tarball URLs are not fetched off-uplink (#​6225); the uplink cache is refreshed on 304 (#​6276).
  • Package access, publish and unpublish rules match case-insensitively (#​6091); package and token name validation aligned with npm (#​6309, #​6314); search validation (#​6306, #​6317); missing versions, dist-tags and packages return not found (#​6332); 401 for invalid credentials on GET /-/user/ (#​5844); local storage no longer uses uncontrolled data in paths (#​5847); the home directory resolves through HOME on Windows (#​6247); missing Host header handled (#​5641).
  • Web: scope validation on the web package endpoints (#​6202), search component fixes (#​5647), signup, error states, i18n and routing (#​6210, #​6213), password change validation (#​6326), English fallback for untranslated strings (#​6406), JSON viewer (#​5651).
  • Logger: JSON sync output honoured, unused pretty destinations removed and file destination errors handled (#​6242, #​6260).

  Breaking changes

  • Node.js 24 or newer is required (#​5615).
  • Express 5 (#​5524): middleware plugins must use named wildcards (/*splat, /{*splat}), res.sendFile(filename, { root }) for absolute paths, and req.body is already parsed when plugins run.
  • YAML configuration only (#​5851); config.self_path was replaced by config.configPath (#​5850).
  • Bearer tokens for the package API (#​6152): _auth entries in .npmrc must move to _authToken; 401 responses advertise only Bearer. The login routes accept Basic credentials while security.api.basicLogin is enabled (the default).
  • Removed: the /-/all search endpoint (use /-/v1/search), npm star/unstar (#​5930), the deprecated AES encryption helpers (#​5744), the searchRemote flag (#​5801) and the debug-only PUT /:package/:version/-tag/:tag route.
  • Programmatic API (#​5808): the default export is the asynchronous runServer, which no longer accepts { listenArg }; await runServer(config) then call .listen(). Import Config, ConfigBuilder, getDefaultConfig and parseConfigFile from @verdaccio/core.
  • Logger: @verdaccio/logger-commons and @verdaccio/logger-prettify are merged into @verdaccio/logger (#​5657).
  • Build: dual ESM/CJS output built with Vite (#​5643); package exports changed, so update deep imports.
  • Relocated plugins: verdaccio-aws-s3-storage, verdaccio-google-cloud and verdaccio-active-directory moved to their own repositories.
  • A server secret shorter than 32 characters stops the server, and .sinopia-db.json databases are no longer read.

  Also in 6.x

  Dual ESM/CJS output, the package filter plugin, publish and unpublish notifications, the bounded /-/v1/search, the @verdaccio/e2e-cli workflow, the shared @verdaccio/ui-theme Web UI, the htpasswd, name and search validation fixes and the new Web UI home were also backported to 6.x; the tracker lists the 6.x release that carries each one.

  Tooling and dependencies

  pnpm 12 replaces Yarn for the workspace and CI (#​5748, #​6216); CI runs on Windows (#​6248); end-to-end tests run through @verdaccio/e2e-cli (#​5678); the repository carries AGENTS.md and agent skills (#​6252). Runtime dependencies move to Express 5.3, got 15, js-yaml 5, TypeScript 7 and Vite 8, with the published advisories in body-parser, proxy-addr, compression, lodash-es, dompurify and fast-uri patched (#​6334, #​6388).

  Upgrading

  Back up the configuration, storage and .verdaccio-db.json, update the runtime to Node.js 24, convert any JSON or JS configuration to YAML and test with a copy of the storage before switching. Do not run 6.x and 7.x against the same storage at the same time.

  Thanks to @​juanpicado, @​mbtools, @​dianmorales, @​jotadeveloper, @​davidus27, @​koliveira15, @​moglerdev, @​pranshuchittora, @​ReemX, @​RuneStone0, @​tmota900 and @​vsugrob for the work in this release line.

Minor Changes

• ddf993c: Adopt @verdaccio/server and drop the local api/web/storage forks. A thin Storage wrapper is kept to support legacy callback-based storage plugins, and the unused helpers in src/lib/utils.ts were removed.

Patch Changes

• e404c82: Updates the runtime dependencies express to 5.3.0 and semver to 7.8.5, and moves body-parser (used by Express to read request bodies) to 2.4.0.

  body-parser 2.4.0 fixes a denial of service where trailing bytes after a compressed request body could keep the server busy (GHSA-27r3-jxmh-p828). Transitive dependencies with published advisories (fast-uri, qs, ip-address) are also moved to their patched releases. None of these change any API: no configuration or plugin changes are needed.

  The rest of the changes in this release only affect the development toolchain and the test suite (@cypress/request is no longer used by the tests).

• a307098: Migrate the 7.x release workflow to Changesets action v2 and CLI v3.

• 256fd40: Disable dependency lifecycle scripts and require third-party dependencies to be at least three days old when installing Verdaccio in the final Docker image stage.

  The production installation now uses npm's --ignore-scripts and --min-release-age=3 options. Verdaccio and packages matching @verdaccio/* or verdaccio-* are excluded from the age restriction so new Verdaccio releases can be built immediately. The final stage updates npm to support these exclusions and disables installation audit and funding output. Image builds still fail if another required dependency has no eligible version. No configuration changes are required for operators.

  The Docker base image uses Node.js 24.15.0 for compatibility with the updated npm.

• f565393: Update the proxy address dependency to correctly match trusted proxy subnets when determining client IP addresses. Earlier 7.x prereleases using the affected dependency can misidentify clients with certain IPv6 trust configurations. No configuration migration is required.

  Update @verdaccio/e2e-cli to 4.0.0, which drops pnpm 10, and remove pnpm 10 from the CLI e2e matrix.

• 6fd3e8a: Make /-/v1/search work for storage plugins that still use the callback API.

  Verdaccio 7 keeps callback-based storage plugins running through a compatibility
  adapter. Its search collected whatever the plugin streamed and handed the list
  straight back, with two consequences for every such plugin.

  The search query was dropped before it reached the plugin, and the adapter passed a
  name predicate that always returned true, so the plugin emitted its whole catalogue and
  nothing ever filtered it. /-/v1/search answered with every package in the registry
  regardless of the text searched for, and paginated over that full list. It failed
  silently: the endpoint returned 200 and the npm client still found what it asked for,
  buried among everything else.

  The adapter also passed the items through unchanged. The legacy contract emits the
  package itself, while the store reads item.package.name, so a plugin following the
  documented contract made the endpoint fail with a 500 instead.

  The adapter now filters the collected results by the query text and wraps anything that
  is not already in the store's shape. The filtering is done on the emitted name, never on
  the name predicate a plugin is given: that one receives the basename, so rejecting there
  would drop scoped packages whose full name does match. Operators running a callback-based
  storage plugin get working search without touching the plugin; plugins already on the
  promise-based API were never wrapped and are unaffected.

• f1f5d34: chore: trigger release

• a768d16: chore: replace eslint and prettier with oxlint and oxfmt

• 594f438: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 88bd996: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 908ccbb: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• e862a9a: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 1aef95b: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• 304f155: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• c461320: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

• a4ced54: Update verdaccio dependencies (@verdaccio/*, verdaccio, verdaccio-*) to the next-9 npm dist-tag.

v6.11.1

Compare Source

Patch Changes

• 62d8556: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.39 → 9.0.0-next-9.40

v6.11.0

Compare Source

Minor Changes

• 93010b3: web.showSearch: false now also disables the web search endpoint.

  Until now the option only hid the search box in the header, while /-/verdaccio/data/search kept answering. With showSearch: false the endpoint is no longer registered and answers 404, the same way web.login: false removes the web login endpoints. The npm search API used by npm search (/-/v1/search) is not affected, and nothing changes for registries that leave showSearch unset or set it to true.

Patch Changes

• a3a664b: Releases are published with npm provenance again.

  verdaccio 6.10.5, 6.10.6 and 6.10.7 reached the npm registry without a provenance attestation, while every release from 6.9.0 to 6.10.4 had one. The release pipeline switched from npm publish to yarn npm publish, and yarn ignored the setting that requested provenance, so those versions were published through trusted publishing but without a signed SLSA statement. The package contents were not affected.

  Package managers that compare trust evidence between versions, such as pnpm with trustPolicy: no-downgrade, refuse to install those three versions with ERR_PNPM_TRUST_DOWNGRADE. This release carries provenance again, so upgrading to it, or pinning 6.10.4 or earlier, installs cleanly; nothing else needs to change on the operator side.

• 90fde27: Update the bundled @verdaccio/* modules to their latest releases, which forward the new web UI options to the UI and fix a denial-of-service in request body parsing.

  The web UI options web.footer, web.poweredBy, web.help and web.showPackageListToolbar now reach the UI (@verdaccio/ui-theme 9.0.0-next-9.39); before this update the server dropped them. showPackageListToolbar defaults to false, so the home page looks the same after upgrading unless you turn it on, and bun is now listed among the default package managers shown on a package page.

  body-parser moves to 1.20.9, fixing a denial of service where trailing bytes after a compressed request body could tie up the server (GHSA-27r3-jxmh-p828). All 6.x releases that use express 4.22.3 are affected; no configuration change is needed.

v6.10.7

Compare Source

Patch Changes

• 7bd480a: The Docker image no longer trusts certificates issued through the compromised eMudhra (emSign) intermediate CAs.

  In October 2026, eMudhra disclosed that the private keys of several of its intermediate certificate authorities had been compromised. Anyone holding those keys can issue a TLS certificate that a client trusting the eMudhra chain accepts as valid, for any host. Verdaccio connects to its uplinks (such as registry.npmjs.org) over HTTPS, so an attacker able to intercept that traffic could impersonate an uplink and serve tampered metadata or tarballs, which Verdaccio would then cache.

  The image is now built on node:24.22.1-alpine instead of node:24.15.0-alpine. Node.js 24.22.1 updates its bundled root certificates to NSS 3.131.1, which removes emSign ECC Root CA - G3, and rejects chains that contain the compromised public keys. Node.js uses that bundled store for outgoing HTTPS by default. The image also upgrades Alpine's ca-certificates package at build time. That package matters only if you make Node.js read the system store, for example with NODE_EXTRA_CA_CERTS or --use-system-ca.

  Every earlier verdaccio/verdaccio 6.x image is affected. To get the fix, pull the new image. If you install Verdaccio from npm instead of Docker, upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bbf21071-fe37-4093-954f-ede388857ac1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[github-actions]

📊 Benchmark results

Comparing with 3fe8202

• Dependency count: 965 (no change)
• Package size: 360 MB ⬇️ 0.00% decrease vs. 3fe8202
• Number of ts-expect-error directives: 281 (no change)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@9077

commit: 29cf15a