Skip to content

Commit 19028f3

Browse files
authored
fix: Correct timeline for npm OIDC publishing (#1569)
1 parent 1f9bb23 commit 19028f3

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

fern/products/sdks/overview/typescript/publishing-to-npm.mdx

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ registry](https://www.npmjs.com/). After following the steps on this page,
88
you'll have a versioned package published on npm.
99

1010
<Warning title="Already publishing to npm?">
11-
If you're currently using token-based authentication, npmjs is deprecating long-lived tokens in early 2025. See [Migrating from token-based to OpenID Connect (OIDC) publishing](#migrating-from-token-based-to-oidc-publishing) to upgrade to the more secure OIDC authentication.
11+
If you're using token-based authentication, npmjs is deprecating long-lived tokens in mid-November 2025. See [Migrating from token-based to OpenID Connect (OIDC) publishing](#migrating-from-token-based-to-oidc-publishing) to upgrade to the more secure OIDC authentication.
1212
</Warning>
1313

1414
<Frame>
@@ -113,7 +113,7 @@ groups:
113113
Choose how you want to authenticate with npmjs when publishing.
114114
115115
<Warning>
116-
**Starting in early 2025**, npmjs.org is deprecating long-lived authentication tokens for publishing from CI/CD workflows. **OpenID Connect (OIDC) authentication is strongly recommended** for security.
116+
**Starting mid-November 2025**, npmjs.org is deprecating long-lived authentication tokens for publishing from CI/CD workflows. **OpenID Connect (OIDC) authentication is strongly recommended** for security.
117117
</Warning>
118118
119119
<AccordionGroup>
@@ -190,7 +190,7 @@ OIDC-based publishing (also known as "trusted publishing") is the most secure wa
190190
Common causes:
191191
- Workflow filename doesn't match exactly (must be `ci.yml`)
192192
- Trusted publisher configuration on npmjs.com doesn't match your repository settings
193-
- Using self-hosted runners (not currently supported by npmjs.org)
193+
- Using self-hosted runners (not supported by npmjs.org)
194194

195195
**Solution:** Double-check your trusted publisher configuration on npmjs.com matches your repository name and workflow filename exactly.
196196

@@ -205,7 +205,7 @@ Provenance attestations aren't generated for packages published from private rep
205205
<Accordion title="Token-based authentication (Legacy)">
206206

207207
<Warning>
208-
**This method is being deprecated by npmjs.org in early 2025.** Long-lived authentication tokens can be exposed in logs, compromised, and are difficult to manage and rotate. [OIDC-based authentication is strongly recommended instead](#migrating-from-token-based-to-oidc-publishing).
208+
**This method is being deprecated by npmjs.org in mid-November 2025.** Long-lived authentication tokens can be exposed in logs, compromised, and are difficult to manage and rotate. [OIDC-based authentication is strongly recommended instead](#migrating-from-token-based-to-oidc-publishing).
209209
</Warning>
210210

211211
<Steps>
@@ -266,7 +266,7 @@ Your SDK will automatically be published to npmjs when you create a GitHub relea
266266

267267
1. Create a GitHub release with a version tag (for example, `v1.0.0`)
268268
1. The CI workflow will run automatically and publish to npm
269-
1. View your package on npmjs.com to confirm the new version
269+
1. View your package on npmjs.com to confirm the version
270270

271271
<Accordion title="Alternative: Manual workflow dispatch">
272272

@@ -307,7 +307,7 @@ Add your `FERN_TOKEN` as a repository secret (run `fern token` to generate one),
307307

308308
## Migrating from token-based to OIDC publishing
309309

310-
If you're currently using token-based authentication and need to migrate to OIDC, follow these steps:
310+
If you're using token-based authentication and need to migrate to OIDC, follow these steps:
311311

312312
### Why migrate to OIDC
313313

@@ -522,15 +522,15 @@ After completing either migration path:
522522
- Workflow filename doesn't match exactly (must be `ci.yml` with the `.yml` extension)
523523
- Missing `id-token: write` permission in workflow
524524
- npm CLI version is older than 11.5.1
525-
- Using self-hosted runners (not currently supported)
525+
- Using self-hosted runners (not supported)
526526

527527
**Solution:** Double-check your trusted publisher configuration on npmjs.com matches your actual workflow file name and verify all requirements are met.
528528

529529
</Accordion>
530530

531531
<Accordion title="Workflow still using NPM_TOKEN">
532532

533-
If your workflow continues using the old token-based authentication:
533+
If your workflow continues using token-based authentication:
534534

535535
- Verify you've removed the `npm config set` line and the `env: NPM_TOKEN` block from the publish step
536536
- Check that npm CLI version 11.5.1+ is installed (add the update npm step)

0 commit comments

Comments
 (0)