Trusted npm publishing configurations can now manage distribution tags using short-lived OIDC credentials.
The permission defaults to off and is separate from direct publication rights. Staging-only configurations can receive it, while existing token-based tag management remains supported.
Source announcement: . This is an original summary, not independent on-the-ground reporting.
Last updated: . Editorial policy & corrections
Global
GitHub Team organizations can now start trials of Code Security and Secret Protection themselves.
Read update : GitHub Team gains self-serve Advanced Security trialsGlobal
GitHub Enterprise Cloud with data residency will stop accepting clients offering only X25519 key agreement on October 7.
Read update : GitHub warns of October 7 TLS change for data-residency customersGlobal
Repository administrators can now select runner types, labels and groups for Dependabot updates.
Read update : Dependabot gains repository-level runner controls