---
url: "https://www.xcademia.com/news/github-adds-opt-in-npm-dist-tag-permissions-to-trusted-publishing"
title: "GitHub Adds Opt-In npm Dist-Tag Permissions to Trusted Publishing"
description: "GitHub adds opt-in npm dist-tag permissions, allowing trusted publishing workflows to manage tags using short-lived OIDC credentials."
publishedAt: "2026-10-01T09:32:48.42+00:00"
updatedAt: "2026-10-01T12:13:38.430777+00:00"
type: news
category: cybersecurity
source_name: GitHub Changelog
source_url: "https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing/ "
tags:
  - "#npm"
  - "#GitHub"
  - "#SupplyChainSecurity"
  - "#TrustedPublishing"
  - "#OIDC"
  - "#DevSecOps"
  - "#SoftwareSecurity"
  - "#OpenSourceSecurity"
---

# GitHub Adds Opt-In npm Dist-Tag Permissions to Trusted Publishing

> GitHub has expanded npm trusted publishing with optional dist-tag permissions, allowing maintainers to manage tags such as latest, next, and beta using short-lived OIDC credentials instead of long-lived access tokens.

Source: **GitHub Changelog** · 1 October 2026

**G**itHub has introduced an update to npm trusted publishing that allows maintainers to manage package distribution tags using short-lived OpenID Connect (OIDC) credentials.

The new capability addresses a gap in token-free npm publishing workflows. Previously, trusted publishing could handle publishing and staging, but dist-tag operations still required a granular access token. GitHub says the new opt-in permission allows eligible workflows to manage these tags without maintaining a separate long-lived token.

## 
What Are npm Dist-Tags?

Dist-tags are labels that point npm users toward specific package versions.

For example, a package might use:

- `latest` for its main stable release
- `next` for a preview or upcoming release
- `beta` for a beta version

Instead of requiring users to know an exact version number, a command such as `npm install package-name` can resolve through a tag such as `latest`.

Maintainers can change these pointers when releasing a new version, promoting a release, or rolling back to another version.

## 
What Changed in Trusted Publishing?

GitHub's npm trusted publishing uses OIDC credentials rather than requiring a long-lived publishing token inside a CI/CD workflow.

Before this update, trusted publishing covered publishing and staging, but **dist-tag management remained outside that workflow**. Maintainers that had moved their publishing process to OIDC therefore still needed a granular access token specifically for tag operations.

The new permission extends the trusted publishing model to this remaining operation.

Each trusted publishing configuration now includes an optional:

`Allow npm dist-tag`

permission.

The permission is **disabled by default**, including for existing configurations. This means existing trusted publishing configurations do not automatically receive the additional capability.

## 
How the New Permission Works

The basic workflow can be understood as:

**CI/CD workflow → OIDC credential → Trusted publishing configuration → Dist-tag operation → npm package**

A maintainer first enables the `Allow npm dist-tag` permission for the trusted publishing configuration that should manage tags.

When the workflow performs a dist-tag operation, npm checks whether the incoming OIDC token matches a trusted publishing configuration that has the permission enabled.

If the configuration matches, the operation is authorized.

![manages-dist-tags](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790846512076-manages-dist-tags.webp)

## 
The Permission Is Independent From Direct Publishing

One important detail is that dist-tag management is not tied directly to direct package publishing.

GitHub states that the permission is independent of direct publishing. This means a **staging-only trusted publishing configuration can also be given dist-tag management permission**.
This provides maintainers with more granular control over what an individual trusted publishing configuration can do.

For example, an organization could maintain separate configurations for different workflows and selectively allow one of them to manage dist-tags without necessarily granting it direct publishing capabilities.

The exact configuration should depend on how the project's release workflow is structured.

## 
What Happens to Existing Token-Based Workflows?

Existing token-based dist-tag management continues to work unchanged.

The update therefore does not automatically force maintainers to migrate existing tag-management workflows. Instead, the new permission provides another option for projects that want to move more of their npm automation to OIDC-based trusted publishing.

## 
Why This Matters for npm Supply Chain Security

Package registries are an important part of the software supply chain. A compromised publishing credential can potentially be used to modify software that downstream applications depend on.

GitHub has been expanding npm's security controls around publishing and automation.

In September 2026, GitHub also introduced multiple trusted publishing configurations for npm, allowing packages to have separate OIDC configurations for different workflows. That update also expanded staged publishing and added additional visibility into staged package history.

GitHub has previously described trusted publishing as a way to remove API tokens from build systems. Its broader npm security strategy includes stronger authentication, granular tokens and trusted publishing.

The latest dist-tag update fits into that broader direction by extending short-lived OIDC authorization to another package-management operation.

![supply-chain](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790846624160-supply-chain.webp)

## 
What npm Maintainers Need to Do

The new functionality is **opt-in**.

Maintainers who want a trusted publishing configuration to manage dist-tags need to open their package's trusted publishing settings and enable **Allow npm dist-tag** for the configurations that should have this capability.

The important points are:

Area

Current behavior

Dist-tag permission

Opt-in

New configurations

Permission is off by default

Existing configurations

Permission remains off

Authentication

Short-lived OIDC credentials

Direct publishing

Separate permission

Staging-only configuration

Can receive dist-tag permission

Existing token workflows

Continue to work

This design gives maintainers control over which workflows can modify release pointers.

## 
Dist-Tags and Release Automation

Dist-tags are particularly relevant to automated release pipelines.

Consider a simplified release process:

**Version 1.5.0 released → package staged → release approved → **`latest`** points to 1.5.0**

Later, a problem is discovered:

`latest`** → 1.4.9**

The dist-tag operation changes which version the tag points to without necessarily requiring a new package version.

The new trusted publishing permission allows this type of tag management to be authorized through an eligible OIDC configuration rather than requiring a separate long-lived access token. GitHub specifically identifies promoting a version to `latest` and updating `next` and `beta` pointers as examples.

![npm-dist-tags](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790846697070-npm-dist-tags.webp)

## 
What Developers Should Know

For developers who publish npm packages through CI/CD, the change is mainly about **authorization and credential management**.

If your workflow already uses npm trusted publishing, you can now decide whether that configuration should also manage dist-tags.

If your workflow still uses access tokens for dist-tag operations, GitHub says those existing workflows continue to work.

There is therefore no requirement in this announcement to immediately change an existing token-based workflow. The new capability provides an additional option for maintainers who want to reduce their reliance on long-lived credentials.

For organizations managing multiple publishing workflows, the ability to separate permissions can also make it easier to define which automation is responsible for specific package operations.

## 
The Bigger Picture

The announcement highlights a broader industry shift toward reducing the presence of long-lived credentials in automated software delivery.

OIDC-based trusted publishing changes the authentication model by allowing a workflow to prove its identity through a short-lived credential rather than depending on a persistent access token stored in the automation environment.

GitHub has been progressively expanding npm's trusted publishing capabilities. Earlier in September 2026, it added support for multiple trusted publishing configurations, while another September update introduced stage-only npm tokens for workflows that need to submit packages for review without granting direct publishing permission.

For enterprises and open source maintainers, these changes could mean more granular control over automated package releases while reducing the number of long-lived credentials that need to be protected.

However, the announcement does not provide specific information about measured security improvements or adoption numbers.

## 
Final Takeaway

GitHub's latest npm update extends trusted publishing to **dist-tag management**.

The new `Allow npm dist-tag` permission lets eligible trusted publishing configurations manage tags such as `latest`, `next`, and `beta` using short-lived OIDC credentials. The permission is disabled by default, remains separate from direct publishing, and does not change existing token-based dist-tag workflows.

For npm maintainers already moving toward OIDC-based automation, this closes another gap in token-free publishing workflows.

## Original source

https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing/

## Tags

`#npm` · `#GitHub` · `#SupplyChainSecurity` · `#TrustedPublishing` · `#OIDC` · `#DevSecOps` · `#SoftwareSecurity` · `#OpenSourceSecurity`

---

## About this content

This Markdown news article is the citation-grade twin of [GitHub Adds Opt-In npm Dist-Tag Permissions to Trusted Publishing](https://www.xcademia.com/news/github-adds-opt-in-npm-dist-tag-permissions-to-trusted-publishing). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://www.xcademia.com/news/github-adds-opt-in-npm-dist-tag-permissions-to-trusted-publishing
- Publisher: Xcademia, https://www.xcademia.com
- Catalogue index: https://www.xcademia.com/llms-full.txt