npm bulk trusted publishing config and script security

[leobalter]

now available in CLI v11.10.0+

We've shipped two new features to make npm publishing safer and easier to manage:

Bulk configuration for OIDC trusted publishing

Maintainers can now add or update trusted publishing configurations across multiple packages in a single operation using the npm trust command, instead of configuring each package individually.

This is a first step in making trusted publishing easier to adopt for all users and providers. CircleCI support is already in progress and coming soon, along with additional improvements to make migrating to and managing trusted publishing simpler for maintainers with many packages.

New --allow-git flag for npm install

Git dependencies — direct or transitive — can include .npmrc files that override the git executable path, enabling arbitrary code execution during install even when using --ignore-scripts. The new --allow-git flag gives you explicit control over this behavior.

The flag defaults to all for backward compatibility, but we highly encourage using --allow-git=none now and only re-enabling it when git dependencies are truly necessary:

npm install --allow-git=none

--allow-git=none is expected to become the default in npm CLI v12. See the documentation for details.

---

We'd love to hear your feedback — what's working, what's missing, and what would make these features better for your workflows. Let us know in the comments!

[robertobandini]

The bulk function is really useful, I happened to set it up manually on dozens of packages just last week, thanks!

[peterc]

Why wasn't min-release-age mentioned in this release post? It's in the repo's release page for v11.10.

[leobalter]

Great question and I don't a better excuse other than I focused only on 2 items for this release's changelog. Saying that, we have another changelog coming relatively soon and I'll include min-release-age.

[peterc]

😄 No problem! It just seemed significant (or at least topical) so I wondered if it wasn't quite ready for prime time or something like that.