Unvalidated npm trusted publishing configurations now expire

Automated excerpt

Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. Expired configurations remain visible in trusted publisher settings but don’t count toward per-package limits. Other valid configurations on the package are unaffected. npm also now rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target restriction.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.