Github/npm has announced security changes that take effect on December 9, 2025. These changes include the deprecation of classic tokens and a 90-day maximum lifetime for granular access write tokens used in publishing workflows. Note, read-only tokens do not have a 90-day maximum. What’s Changing G…

Is there any update here? This is becoming an issue, all of the manual token rotation is a chore that we’d prefer not to have.

I apologize for the delayed reply. Unfortunately, we do not have an update. We are still working with all stakeholders to improve the experience, and will share when we have a change in status.

[image] marksreid-displayr: Is there any update here? This is becoming an issue, all of the manual token rotation is a chore that we’d prefer not to have. following up on previous comment, is there any update here?

GitHub blog npm trusted publishing now supports CircleCI dated April 6, 2026 announces this support.

Update: CircleCI is now an officially supported npm Trusted Publisher! We’ve posted a follow-up with the full details, including an onboarding tool that handles both single project and bulk setup to take the pain out of the UUID lookup process. Check out the update here.

CircleCI and npm Trusted Publishing

Announcements Notices

rachael June 10, 2026, 9:27pm 8

Hello there! We have a new update here. Thank you for your patience.

Topic		Replies	Views
Npm Trusted Publishing with CircleCI - Improvements Announcements	0	77	June 10, 2026
NPM Trusted Publishing integration is way too much of a hassle, we shouldn't have to look up all these UUIDs Integrations and Accounts npm	8	286	July 23, 2026
How to prevent token leaking? Feedback & Bug Reports	2	1123	September 25, 2018
Publishing npm Packages Using CircleCI 2.0 Build Environment	1	1458	August 23, 2018
[FAQ Compilation] Security Alert - Rotate any secrets stored in CircleCI Security	1	4389	January 5, 2023

CircleCI and npm Trusted Publishing

Related topics