Post

I'm confused. I enabled trusted publishing in 0.3.5, and then added staged publishing in 0.3.6 but according to @npmx.dev 's new timeline feature, the lib dropped trusted publishing. Is it because the publisher identity changed from GH OIDC to my email when I confirmed the staged release?

It's a bug in npmx, and pnpm, and everything else that was relying on the same field. Pretty much have to wait for npm to fix it but that'll likely mean needing to publish new versions

Darn, we ran into this on signals as well npmx.dev/package/@pre... - will pnpm install see this as a downgrade as well? That would be really problematic

yes tinyexec was one of the first big packages to make the move and now its painfully marked as a trust downgrade across the board 😅 but there's no fix, no workaround. only npm can fix it