npm Trusted Publishing Configs Now Expire in 48 Hours Unless a Publish Validates Them

Sun, 11 Oct 2026 08:30:00 +0530

If you set up an npm trusted publisher and do not complete a publish from it within two days, it stops working. That is the behavior GitHub announced on October 2: configurations that have never been validated by a successful publish expire 48 hours after creation and can no longer authorize publishing. The same change adds a second restriction, covered below, for workflows triggered by issue_comment.

This reads like housekeeping. It is closer to a fix for a specific hole in how trust is declared.

Npm on Kuldeep Pisda

npm Trusted Publishing Configs Now Expire in 48 Hours Unless a Publish Validates Them