Skip to content

docs: clarify trusted publishing Node/npm versions... #1869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wraithgar merged 3 commits into from
Feb 9, 2026
Merged

docs: clarify trusted publishing Node/npm versions... #1869

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0f806ba
docs: clarify trusted publishing Node version, UI navigation, and iss…
david-aldo-dalessandro Jan 31, 2026
67377c7
fix: remove incorrect reporting guidance for trusted publishing
david-aldo-dalessandro Feb 7, 2026
7699920
docs: fix placeholder to avoid HTML tag parsing
david-aldo-dalessandro Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions content/packages-and-modules/securing-your-code/trusted-publishers.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Trusted publishing allows you to publish npm packages directly from your CI/CD w

<Note>

**Note:** Trusted publishing requires [npm CLI](https://docs.npmjs.com/cli/v11) version 11.5.1 or later.
**Note:** Trusted publishing requires [npm CLI](https://docs.npmjs.com/cli/v11) version 11.5.1 or later and Node version 22.14.0 or higher.

</Note>

Expand Down Expand Up @@ -141,7 +141,7 @@ The `id_tokens` configuration tells GitLab to generate an OIDC token for npm. Le

### Managing trusted publisher configurations

You can modify or remove your trusted publisher configuration at any time through your package settings on [npmjs.com](https://npmjs.com). Each package can only have one trusted publisher connection at a time, but this connection can be edited or deleted as needed. To change providers (for example, switching from GitHub Actions to GitLab CI/CD), simply edit your existing configuration and select the new provider. The change takes effect immediately for future publishes. To remove trusted publishing entirely and return to token-based authentication, delete the trusted publisher configuration from your package settings.
You can modify or remove your trusted publisher configuration at any time through your package settings on [npmjs.com](https://npmjs.com) → Packages → YOUR_PACKAGE → Settings → Trusted publishing. Each package can only have one trusted publisher connection at a time, but this connection can be edited or deleted as needed. To change providers (for example, switching from GitHub Actions to GitLab CI/CD), simply edit your existing configuration and select the new provider. The change takes effect immediately for future publishes. To remove trusted publishing entirely and return to token-based authentication, delete the trusted publisher configuration from your package settings.

## Recommended: Restrict token access when using trusted publishers

Expand Down
Loading