Npm - 1

2026 (8)

October (3)

github: Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4

GitHub

2026-10-20

Dependabot now supports upgrades to npm 12, pnpm 11 and 12, and Bun 1.4. Projects using these package manager versions can continue receiving Dependabot updates.

github: Unvalidated npm trusted publishing configurations now expire

GitHub

2026-10-02

Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This reduces the risk of a repository or project name changing after the configuration is created.

github: npm staged publishing now supports creating new packages

GitHub

2026-10-02

npm staged publishing now supports creating new packages. You can create a new package with `npm stage publish` using either a local session or a granular access token, including a stage-only token.

September (4)

github: Opt-in dist-tag permissions for npm trusted publishing

GitHub

2026-09-30

npm trusted publishing can now optionally get permission to manage dist-tags using short-lived OIDC credentials. This covers actions like moving tags such as latest, next, and beta without using long-lived credentials.

github: Stage-only npm tokens for safer automation

GitHub

2026-09-18

GitHub added a new npm granular access token permission option, Read and write (stage only). It allows automated workflows to stage package versions for review without granting the token full publish access.

github: npm extends recovery-code security holds to all accounts

GitHub

2026-09-09

npm now applies a 72-hour security hold to any account after a successful recovery-code sign-in. The hold was previously limited to high-impact accounts.

github: Multiple trusted publishing configurations for npm

GitHub

2026-09-03

GitHub says three npm publishing updates are now generally available, including support for multiple trusted publishing configurations per package. The post also mentions staged publishing and another publishing-related change, but the provided excerpt does not include the full details.

August (1)

github: License data quality improvements

GitHub

2026-08-13

GitHub now sources license information for dependency graph software components from package registries such as npmjs.org and PyPI. This is intended to improve the accuracy and completeness of displayed license data.