Replies: 6 comments 8 replies
-
|
Are the "established trust" changes going to land before this change? This is great for those using other ci providers, but it will still almost certainly result in storing the actual login credentials in secrets unless we can completely eliminate the need for a token |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the great question — totally get the concern about "established trust" landing in time. For anyone using non-GitHub/GitLab CI providers, this change still means falling back to storing some kind of secret unless we can fully eliminate tokens. Token removal is now back to Nov 19 (not Dec 9 as earlier planned). CLI support for granular tokens will land at the same time, along with 2FA-by-default for new packages. Yarn v1/v2 auth is safe — the CouchDB endpoint is restored and live. What you can do right now to avoid storing long-term credentials: If you're on GitHub Actions or GitLab CI → switch to Trusted Publishing (OIDC). No token needed at all. If you drop your CI setup (Jenkins? CircleCI? Azure?), I can help draft a migration script or workflow. |
Beta Was this translation helpful? Give feedback.
-
|
It is not an enjoyable experience having to subscribe to new threads in order stay apprised of the state of things since the previous threads keep getting marked as resolved. |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
If the date was moved to 2025-12-09, why do I have users complaining that their tokens were disabled yesterday?! |
Beta Was this translation helpful? Give feedback.
-
|
Hi, is mandatory 2FA for local publishing still apart of the plan? I see we've enabled 2fa bypass on the Granular tokens, but is that a permanent policy or just a way to buffer the transition to Trusted Publishing? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi everyone,
Quick update on our npm security timeline: We're moving the classic token removal from November 19 to December 9, 2025.
Why the change? We're bundling this breaking change with a highly-requested feature that will make the transition smoother. On December 9, we're shipping CLI support for managing granular access tokens directly from your terminal, in addition to classic token removal.
What's coming December 9
Classic tokens will be permanently revoked, with all remaining npm classic tokens stopping work. Going forward, login sessions will use 2-hour tokens requiring periodic re-authentication. Learn more about the token changes in our security strengthening post.
CLI token management for granular tokens is finally arriving. You'll be able to create, list, and revoke granular access tokens from your terminal with a similar experience to the classic
npm tokencommand, adapted for granular tokens now with enforced 2fa. No more web-only token management! Check out the documentation on granular access tokens to prepare.We're also making packages secure-by-default, with 2FA enforcement becoming the default option for all new packages. This means better security out of the box without manual configuration. Learn about 2FA for publishing on npm if you haven't set it up yet.
Good news for Yarn users: The
/user/org.couchdb.user:usernameAPI endpoint has been restored, so Yarn v1 and v2 authentication workflows will continue working. This fix is already live.What this means for you
By delivering these features together, you'll have the tools you need right when you need them. Instead of losing classic tokens and having to navigate the website for replacements, you can manage granular tokens directly from your familiar CLI workflow.
No action needed until December 9. Your existing classic tokens continue working until then.
Stay informed
Review our previous update about classic token creation being disabled (Nov 5) and the original security roadmap announcement. You can start creating granular access tokens now if you want to get ahead of the change.
We'll share more details as we approach December 9. Thank you for your patience as we strengthen npm's security foundation while keeping your experience as smooth as possible.
Questions or concerns? Let us know below.
Beta Was this translation helpful? Give feedback.
All reactions