# Opt-in dist-tag permissions for npm trusted publishing

Publisher-attributed story with a reviewed brief or permitted publisher paragraph. The original publisher is responsible for the linked reporting.

- Publisher: GitHub Changelog
- Author credit: Allison
- Category: IT
- Original publication time: 2026-09-30T21:03:09Z
- First observed by NexusTechWire: 2026-10-01T15:54:37Z
- Original source: https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing
- NexusTechWire record: https://nexustechwire.com/news/news-8f738e218bb88ed3b1aa

## The brief

npm release automation can now move distribution tags using short-lived OIDC credentials instead of retaining a token just for that step. GitHub says the new trusted-publishing permission is opt-in and starts disabled. It can also be granted to staging-only configurations, while existing token-based tag management continues unchanged.

AI-assisted NexusTechWire summary, checked against the linked source on 2026-10-01T19:12:54Z. Not independent reporting.

Read the full original: [GitHub Changelog](https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing)

This record does not reproduce the complete article or represent independent confirmation of every source claim.