Stage-only npm tokens for safer automation are now available
GitHub has introduced a new "Read and write (stage only)" option for npm granular access tokens, enhancing security for automated publishing workflows. This allows CI/CD to stage package versions for maintainer review and 2FA approval, preventing direct, unauthorized publication to the npm registry. The feature helps teams transition away from bypass-2FA tokens, which will be deprecated by January 2027. It requires `npm stage publish` and npm CLI 11.15.0+ with Node.js 22.14.0+ for use.
Features (1) ›
- Enable stage-only npm tokens for secure automated publishing
Automated workflows can now use new granular access tokens with 'Read and write (stage only)' permissions. These tokens allow staging package versions for review, which a maintainer must approve with 2FA before actual publication, preventing direct pushes to the npm registry. This is a crucial step for preparing automation for the upcoming removal of direct publishing via bypass-2FA tokens by January 2027.
https://github.blog/changelog/2026-09-18-stage-only-npm-tokens-for-safer-automation
Related releases
- GitHub REST API Now Supports Code Coverage Ruleset Management GitHub Changelog ·
- GitHub Copilot to deprecate several AI models by October 2026, advises users to update GitHub Changelog ·
- GitHub Copilot adds new model selection, code review features, and Sentry integration GitHub Changelog ·
- GitHub Copilot Usage Metrics API Adds Agentic CLI Customization Data GitHub Changelog ·
- GitHub Copilot Impact Dashboard Adds Feature Engagement Metrics GitHub Changelog ·
- GitHub Actions Workflow Execution Protections Now Generally Available GitHub Changelog ·