Trusted Publishing - 1

2026 (3)

October (1)

github: Unvalidated npm trusted publishing configurations now expire

GitHub

2026-10-02

Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This reduces the risk of a repository or project name changing after the configuration is created.

September (2)

github: Opt-in dist-tag permissions for npm trusted publishing

GitHub

2026-09-30

npm trusted publishing can now optionally get permission to manage dist-tags using short-lived OIDC credentials. This covers actions like moving tags such as latest, next, and beta without using long-lived credentials.

github: Multiple trusted publishing configurations for npm

GitHub

2026-09-03

GitHub says three npm publishing updates are now generally available, including support for multiple trusted publishing configurations per package. The post also mentions staged publishing and another publishing-related change, but the provided excerpt does not include the full details.