Plan
archived
npm trusted publishing gains opt-in dist-tag permissions via OIDC
- Platform/SRE — Skip
- CI/CD — Plan: New GA capability lets npm trusted publishing configs manage dist-tags (latest, next, beta promotion) with short-lived OIDC credentials instead of long-lived tokens — schedule adoption to reduce static secret exposure in publish workflows.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.