Post

I'm confused. I enabled trusted publishing in 0.3.5, and then added staged publishing in 0.3.6 but according to @npmx.dev 's new timeline feature, the lib dropped trusted publishing. Is it because the publisher identity changed from GH OIDC to my email when I confirmed the staged release?

23/5/26, 7:40 pm0 reposts1 like

ian / maybebot

@ianb.dev

23 May

Forgot to add screenshot

ian / maybebot

@ianb.dev

23 May

This is on [this small lib](npmx.dev/package-time...) of mine. Sorry npmx people if I'm using the (very new) timeline feature as a source of truth for the (even more new) npm staged publishing :D I need validation :D

James

@43081j.com

23 May

It's a bug in npmx, and pnpm, and everything else that was relying on the same field. Pretty much have to wait for npm to fix it but that'll likely mean needing to publish new versions

ian / maybebot

@ianb.dev

23 May

Got it! Just got me confused for a second, but I totally understand how the bug happened now! Thanks

Jovi 🐨

@jovidecroock.com

26 May

Darn, we ran into this on signals as well npmx.dev/package/@pre... - will pnpm install see this as a downgrade as well? That would be really problematic

npmx.dev@preact/signals - npmxManage state with style in Preact

James

@43081j.com

26 May

yes tinyexec was one of the first big packages to make the move and now its painfully marked as a trust downgrade across the board 😅 but there's no fix, no workaround. only npm can fix it