You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: fern/products/sdks/overview/typescript/publishing-to-npm.mdx
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ registry](https://www.npmjs.com/). After following the steps on this page,
8
8
you'll have a versioned package published on npm.
9
9
10
10
<Warningtitle="Already publishing to npm?">
11
-
If you're currently using token-based authentication, npmjs is deprecating long-lived tokens in early 2025. See [Migrating from token-based to OpenID Connect (OIDC) publishing](#migrating-from-token-based-to-oidc-publishing) to upgrade to the more secure OIDC authentication.
11
+
If you're using token-based authentication, npmjs is deprecating long-lived tokens in mid-November 2025. See [Migrating from token-based to OpenID Connect (OIDC) publishing](#migrating-from-token-based-to-oidc-publishing) to upgrade to the more secure OIDC authentication.
12
12
</Warning>
13
13
14
14
<Frame>
@@ -113,7 +113,7 @@ groups:
113
113
Choose how you want to authenticate with npmjs when publishing.
114
114
115
115
<Warning>
116
-
**Starting in early 2025**, npmjs.org is deprecating long-lived authentication tokens for publishing from CI/CD workflows. **OpenID Connect (OIDC) authentication is strongly recommended** for security.
116
+
**Starting mid-November 2025**, npmjs.org is deprecating long-lived authentication tokens for publishing from CI/CD workflows. **OpenID Connect (OIDC) authentication is strongly recommended** for security.
117
117
</Warning>
118
118
119
119
<AccordionGroup>
@@ -190,7 +190,7 @@ OIDC-based publishing (also known as "trusted publishing") is the most secure wa
190
190
Common causes:
191
191
- Workflow filename doesn't match exactly (must be `ci.yml`)
192
192
- Trusted publisher configuration on npmjs.com doesn't match your repository settings
193
-
- Using self-hosted runners (not currently supported by npmjs.org)
193
+
- Using self-hosted runners (not supported by npmjs.org)
194
194
195
195
**Solution:** Double-check your trusted publisher configuration on npmjs.com matches your repository name and workflow filename exactly.
196
196
@@ -205,7 +205,7 @@ Provenance attestations aren't generated for packages published from private rep
**This method is being deprecated by npmjs.org in early 2025.** Long-lived authentication tokens can be exposed in logs, compromised, and are difficult to manage and rotate. [OIDC-based authentication is strongly recommended instead](#migrating-from-token-based-to-oidc-publishing).
208
+
**This method is being deprecated by npmjs.org in mid-November 2025.** Long-lived authentication tokens can be exposed in logs, compromised, and are difficult to manage and rotate. [OIDC-based authentication is strongly recommended instead](#migrating-from-token-based-to-oidc-publishing).
209
209
</Warning>
210
210
211
211
<Steps>
@@ -266,7 +266,7 @@ Your SDK will automatically be published to npmjs when you create a GitHub relea
266
266
267
267
1. Create a GitHub release with a version tag (for example, `v1.0.0`)
268
268
1. The CI workflow will run automatically and publish to npm
269
-
1. View your package on npmjs.com to confirm the new version
269
+
1. View your package on npmjs.com to confirm the version
@@ -307,7 +307,7 @@ Add your `FERN_TOKEN` as a repository secret (run `fern token` to generate one),
307
307
308
308
## Migrating from token-based to OIDC publishing
309
309
310
-
If you're currently using token-based authentication and need to migrate to OIDC, follow these steps:
310
+
If you're using token-based authentication and need to migrate to OIDC, follow these steps:
311
311
312
312
### Why migrate to OIDC
313
313
@@ -522,15 +522,15 @@ After completing either migration path:
522
522
- Workflow filename doesn't match exactly (must be `ci.yml` with the `.yml` extension)
523
523
- Missing `id-token: write` permission in workflow
524
524
- npm CLI version is older than 11.5.1
525
-
- Using self-hosted runners (not currently supported)
525
+
- Using self-hosted runners (not supported)
526
526
527
527
**Solution:** Double-check your trusted publisher configuration on npmjs.com matches your actual workflow file name and verify all requirements are met.
528
528
529
529
</Accordion>
530
530
531
531
<Accordion title="Workflow still using NPM_TOKEN">
532
532
533
-
If your workflow continues using the old token-based authentication:
533
+
If your workflow continues using token-based authentication:
534
534
535
535
- Verify you've removed the `npm config set` line and the `env: NPM_TOKEN` block from the publish step
536
536
- Check that npm CLI version 11.5.1+ is installed (add the update npm step)
0 commit comments