Patch intelligence record
GitHub / Copilot Unvalidated npm trusted publishing configurations now expire
Too few reports for a verdict yet.
- Accepted reports
- 0
- Latest evidence run
- Healthy sources
- 0 fresh (success / no reports) · need 2
Monitoring reflects community-evidence collection health for this exact release — an absence of reports is not a safety guarantee, and this is separate from the AUXSAYS verdict.
Vendor Known Issues — No vendor-known issue data captured for this patch.
AUXSAYS has not captured official issue data for this patch. This does not indicate the vendor has no issues. Not counted as community reports.
Official Patch Notes — not captured
Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This limits the risk of trusting a repository or project name that changes ownership. Your configuration becomes validated and exempt from expiry after its first successful publish. Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window—ordinary edits don’t restart the deadline. If your configuration expires, recreate it to start a new 48-hour window. Expired configurations remain visible in trusted publisher settings but don’t count toward per-package limits. Other valid configurations on the package are unaffected. npm also now rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target restriction. If affected, move publishing to a permitted event such as push , release , or workflow_dispatch . Join the discussion within GitHub Community . The post Unvalidated npm trusted publishing configurations now expire appeared first on The GitHub Blog .
GitHub / Copilot in these notes: .
Official body text was not cleanly captured. AUXSAYS is showing structured official additions/fixes where available and links to the source for the full vendor notes.
Technical Details
- Released
- Oct 2, 2026
- File size
- Official source checked
- Oct 6, 2026
- Official notes checked
- Oct 6, 2026
Checksum
Use these hashes to verify downloaded installers match the files published with the official release.
User Reports / Sources (0)
No user report sources have been counted for this record yet.
Official sources
- GitHub. (2026, October 2). GitHub / Copilot Unvalidated npm trusted publishing configurations now expire.rss-feed
- GitHub. Download page.download