From 9a5f0e455de53649eda0b1da14c9db54e41a0ad7 Mon Sep 17 00:00:00 2001 From: shmam Date: Fri, 17 Jul 2026 10:50:49 -0700 Subject: [PATCH 01/11] Docs: bypass-2FA GATs cannot perform account-identity actions Reflects the epic to remove account-identity capability from bypass-2FA Granular Access Tokens. Bypass 2FA still applies to publishing and other package write actions, but changes to email/password, 2FA configuration, recovery codes, token creation/escalation, and maintainer management now always require an interactive 2FA challenge. Refs github/npm#15355 Epic github/npm#15226 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 17ac1732-86bf-4b6f-a698-70850d2b7b27 --- .../about-two-factor-authentication.mdx | 2 ++ .../about-access-tokens.mdx | 14 +++++++++++++- .../creating-and-viewing-access-tokens.mdx | 5 +++-- ...ackage-publishing-and-settings-modification.mdx | 3 ++- 4 files changed, 20 insertions(+), 4 deletions(-) diff --git a/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx b/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx index e05d36801ca..dbb6cb55fe3 100644 --- a/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx +++ b/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx @@ -27,6 +27,8 @@ When you enable 2FA, you will be prompted for a second form of authentication be - Two-factor authentication (2FA) enabled on your account, OR - A granular access token with bypass 2FA enabled +Account-identity actions — changing your email or password, modifying your 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, and adding or removing maintainers — always require an interactive 2FA challenge and cannot be performed with a bypass-2FA token. + For more information, see the npm documentation on [requiring 2FA for package publishing](/requiring-2fa-for-package-publishing-and-settings-modification). diff --git a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx index 6654a7ad35a..2028b8dbd48 100644 --- a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx @@ -42,7 +42,19 @@ You can create up to 1000 granular access tokens on your npm account. You can se When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization. -The Bypass 2FA capability applies to tokens with write access and is set to false by default at token creation. When the Bypass 2FA option is set to true, this setting takes precedence over account-level and package-level 2FA settings. This means that even if account-level 2FA is enabled and/or package-level 2FA is required, 2FA will still be bypassed when using the token. Do not set Bypass 2FA to true if a package or organization requires fully enforced 2FA. +The Bypass 2FA capability applies to tokens with write access and is set to false by default at token creation. When the Bypass 2FA option is set to true, this setting takes precedence over account-level and package-level 2FA settings for package and automation actions such as publishing. This means that even if account-level 2FA is enabled and/or package-level 2FA is required, 2FA will still be bypassed when using the token to publish. Do not set Bypass 2FA to true if a package or organization requires fully enforced 2FA. + +### Account-identity actions require an interactive 2FA challenge + +Starting July 2026, tokens with **Bypass 2FA** enabled can no longer be used to perform account-identity or account-governance actions. These actions always require an interactive 2FA challenge, regardless of the token's Bypass 2FA setting: + +- Change email or password +- Modify or disable 2FA configuration +- View or generate recovery codes +- Create, escalate, or manage access tokens +- Add or remove package maintainers, or other account/package-governance changes + +Bypass-2FA tokens can still be used for direct publishing and other package automation actions permitted by their scopes. If you have automation that relies on any of the actions above (for example, programmatic token rotation or maintainer-management scripts), you must migrate it to use an interactive 2FA challenge. For CI/CD publishing, consider adopting [trusted publishing](/trusted-publishers) instead. [create-token]: creating-and-viewing-access-tokens [secure-token]: using-private-packages-in-a-ci-cd-workflow#securing-your-token diff --git a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx index d0475c2e021..8ae3d4c0e10 100644 --- a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx @@ -22,9 +22,10 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc 4. (Optional) In the **Description** field, enter a description for your token. -5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for write actions. +5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for package and automation write actions such as publishing. - This setting is unchecked (false) by default - - By checking this box, the token will bypass 2FA for write actions even if 2FA is enabled at the account or package level + - By checking this box, the token will bypass 2FA for publishing and other package write actions even if 2FA is enabled at the account or package level + - Bypass 2FA does **not** apply to account-identity actions (changing email or password, modifying 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, or adding and removing maintainers). Those actions always require an interactive 2FA challenge, regardless of this setting. For more information, see "[About access tokens](about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." 6. (Optional) In the **Allowed IP Ranges** field, enter IP address ranges to restrict your access token to. You must use [CIDR][cidr-wiki] notation to enter IP address ranges. To add more than one allowed IP range, click **Add IP Range** and enter an IP range in the new text field. diff --git a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx index bb9618a4b10..0fbc3f2e8e3 100644 --- a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx +++ b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx @@ -16,7 +16,8 @@ For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), w - Bypass 2FA configuration is set at token creation - When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required -- When **bypass 2FA is enabled**: The token will bypass all 2FA requirements at all times, regardless of account-level or package-level 2FA settings +- When **bypass 2FA is enabled**: The token will bypass 2FA requirements for publishing and other package write actions, regardless of account-level or package-level 2FA settings +- Bypass 2FA never applies to account-identity or account-governance actions (changing email or password, modifying 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, or adding and removing maintainers). Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." - When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting From c36e4952e14bd100d36662a1511307c9b7f7acb3 Mon Sep 17 00:00:00 2001 From: shmam Date: Fri, 17 Jul 2026 11:05:05 -0700 Subject: [PATCH 02/11] polish --- .../about-access-tokens.mdx | 4 ++-- .../creating-and-viewing-access-tokens.mdx | 2 +- ...g-2fa-for-package-publishing-and-settings-modification.mdx | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx index 2028b8dbd48..c92bbdc54be 100644 --- a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx @@ -46,7 +46,7 @@ The Bypass 2FA capability applies to tokens with write access and is set to fals ### Account-identity actions require an interactive 2FA challenge -Starting July 2026, tokens with **Bypass 2FA** enabled can no longer be used to perform account-identity or account-governance actions. These actions always require an interactive 2FA challenge, regardless of the token's Bypass 2FA setting: +Starting August 2026, tokens with **Bypass 2FA** enabled can no longer be used to perform account-identity or account-governance actions. These actions always require using a token with an interactive 2FA challenge: - Change email or password - Modify or disable 2FA configuration @@ -54,7 +54,7 @@ Starting July 2026, tokens with **Bypass 2FA** enabled can no longer be used to - Create, escalate, or manage access tokens - Add or remove package maintainers, or other account/package-governance changes -Bypass-2FA tokens can still be used for direct publishing and other package automation actions permitted by their scopes. If you have automation that relies on any of the actions above (for example, programmatic token rotation or maintainer-management scripts), you must migrate it to use an interactive 2FA challenge. For CI/CD publishing, consider adopting [trusted publishing](/trusted-publishers) instead. +Bypass-2FA tokens can still be used for direct publishing. For CI/CD publishing, consider adopting [trusted publishing](/trusted-publishers) instead. [create-token]: creating-and-viewing-access-tokens [secure-token]: using-private-packages-in-a-ci-cd-workflow#securing-your-token diff --git a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx index 8ae3d4c0e10..5f224efae0d 100644 --- a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx @@ -22,7 +22,7 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc 4. (Optional) In the **Description** field, enter a description for your token. -5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for package and automation write actions such as publishing. +5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for package publishing. - This setting is unchecked (false) by default - By checking this box, the token will bypass 2FA for publishing and other package write actions even if 2FA is enabled at the account or package level - Bypass 2FA does **not** apply to account-identity actions (changing email or password, modifying 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, or adding and removing maintainers). Those actions always require an interactive 2FA challenge, regardless of this setting. For more information, see "[About access tokens](about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." diff --git a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx index 0fbc3f2e8e3..6ca8b3e9a1c 100644 --- a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx +++ b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx @@ -16,7 +16,7 @@ For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), w - Bypass 2FA configuration is set at token creation - When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required -- When **bypass 2FA is enabled**: The token will bypass 2FA requirements for publishing and other package write actions, regardless of account-level or package-level 2FA settings +- When **bypass 2FA is enabled**: The token will bypass 2FA requirements for publishing, regardless of account-level or package-level 2FA settings - Bypass 2FA never applies to account-identity or account-governance actions (changing email or password, modifying 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, or adding and removing maintainers). Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." - When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting From a3c6617446a410bda0d3cfdfe2210b7903c7aa5b Mon Sep 17 00:00:00 2001 From: shmam Date: Wed, 22 Jul 2026 14:29:19 -0700 Subject: [PATCH 03/11] PR feedback --- .../about-two-factor-authentication.mdx | 2 +- .../about-access-tokens.mdx | 6 +++--- .../creating-and-viewing-access-tokens.mdx | 4 ++-- ...2fa-for-package-publishing-and-settings-modification.mdx | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx b/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx index dbb6cb55fe3..63438e037a2 100644 --- a/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx +++ b/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx @@ -27,7 +27,7 @@ When you enable 2FA, you will be prompted for a second form of authentication be - Two-factor authentication (2FA) enabled on your account, OR - A granular access token with bypass 2FA enabled -Account-identity actions — changing your email or password, modifying your 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, and adding or removing maintainers — always require an interactive 2FA challenge and cannot be performed with a bypass-2FA token. +Starting August 2026, Account-identity and organization-governance actions cannot be performed with a bypass-2FA token. For more information, see the npm documentation on [requiring 2FA for package publishing](/requiring-2fa-for-package-publishing-and-settings-modification). diff --git a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx index c92bbdc54be..19e5826309a 100644 --- a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx @@ -50,11 +50,11 @@ Starting August 2026, tokens with **Bypass 2FA** enabled can no longer be used t - Change email or password - Modify or disable 2FA configuration -- View or generate recovery codes - Create, escalate, or manage access tokens -- Add or remove package maintainers, or other account/package-governance changes +- Add or remove package maintainers +- Organization and team governance actions -Bypass-2FA tokens can still be used for direct publishing. For CI/CD publishing, consider adopting [trusted publishing](/trusted-publishers) instead. +At the moment, bypass-2FA tokens can still be used for direct publishing. For CI/CD publishing, consider adopting [trusted publishing](/trusted-publishers) instead. [create-token]: creating-and-viewing-access-tokens [secure-token]: using-private-packages-in-a-ci-cd-workflow#securing-your-token diff --git a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx index 5f224efae0d..5dd55a430c6 100644 --- a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx @@ -24,8 +24,8 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc 5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for package publishing. - This setting is unchecked (false) by default - - By checking this box, the token will bypass 2FA for publishing and other package write actions even if 2FA is enabled at the account or package level - - Bypass 2FA does **not** apply to account-identity actions (changing email or password, modifying 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, or adding and removing maintainers). Those actions always require an interactive 2FA challenge, regardless of this setting. For more information, see "[About access tokens](about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." + - By checking this box, the token will bypass 2FA for publishing even if 2FA is enabled at the account or package level + - Starting August 2026, bypass 2FA does **not** apply to account-identity or organization-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." 6. (Optional) In the **Allowed IP Ranges** field, enter IP address ranges to restrict your access token to. You must use [CIDR][cidr-wiki] notation to enter IP address ranges. To add more than one allowed IP range, click **Add IP Range** and enter an IP range in the new text field. diff --git a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx index 6ca8b3e9a1c..c52846df872 100644 --- a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx +++ b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx @@ -17,7 +17,7 @@ For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), w - Bypass 2FA configuration is set at token creation - When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required - When **bypass 2FA is enabled**: The token will bypass 2FA requirements for publishing, regardless of account-level or package-level 2FA settings -- Bypass 2FA never applies to account-identity or account-governance actions (changing email or password, modifying 2FA configuration, viewing or generating recovery codes, creating or escalating tokens, or adding and removing maintainers). Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." +- As of August 2026, bypass 2FA token cannot be used for account-identity or organization-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." - When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting From 78c1a1c7ec00e089334c347b83b3380fa8027de5 Mon Sep 17 00:00:00 2001 From: shmam Date: Wed, 22 Jul 2026 14:42:31 -0700 Subject: [PATCH 04/11] changes --- content/cli/v12/commands/npm-stage.mdx | 28 +++++++++++++------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/content/cli/v12/commands/npm-stage.mdx b/content/cli/v12/commands/npm-stage.mdx index 2707a2db204..4b9606f6fdd 100644 --- a/content/cli/v12/commands/npm-stage.mdx +++ b/content/cli/v12/commands/npm-stage.mdx @@ -77,14 +77,14 @@ Before using `npm stage` commands, ensure the following requirements are met: ### 2FA Requirements by Subcommand -| Command | Requires 2FA | Notes | -| -------------------- | ------------ | -------------------------------------------------------- | -| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | -| `npm stage list` | No | View staged packages | -| `npm stage view` | No | View staged package details | -| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | -| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | -| `npm stage download` | No | Downloads the tarball for local inspection | +| Command | Requires 2FA | Notes | +| --- | --- | --- | +| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | +| `npm stage list` | No | View staged packages | +| `npm stage view` | No | View staged package details | +| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | +| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | +| `npm stage download` | No | Downloads the tarball for local inspection | ### Tag Behavior @@ -96,12 +96,12 @@ The tag is an immutable property of the staged package. Once a package is staged The key difference with staged publishing is that `npm stage publish` never requires a 2FA prompt, regardless of token type. This is what makes it suitable for automated workflows. The goal of `npm stage publish` is deferring proof-of-presence to a later point in time. -| Token Type | `npm stage publish` | `npm publish` | -| ------------------ | ---------------------- | ----------------------------------------------------- | -| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | -| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | -| Session token | Can stage | 2FA prompt | -| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | +| Token Type | `npm stage publish` | `npm publish` | +| --- | --- | --- | +| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | +| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | +| Session token | Can stage | 2FA prompt | +| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | ### Trust Relationship Permissions From 1b9a255dc447a4ea25a374d4cece6f0381a48a57 Mon Sep 17 00:00:00 2001 From: shmam Date: Wed, 22 Jul 2026 14:45:38 -0700 Subject: [PATCH 05/11] cli changes --- content/cli/v12/commands/npm-stage.mdx | 28 +++++++++++++------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/content/cli/v12/commands/npm-stage.mdx b/content/cli/v12/commands/npm-stage.mdx index 4b9606f6fdd..2707a2db204 100644 --- a/content/cli/v12/commands/npm-stage.mdx +++ b/content/cli/v12/commands/npm-stage.mdx @@ -77,14 +77,14 @@ Before using `npm stage` commands, ensure the following requirements are met: ### 2FA Requirements by Subcommand -| Command | Requires 2FA | Notes | -| --- | --- | --- | -| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | -| `npm stage list` | No | View staged packages | -| `npm stage view` | No | View staged package details | -| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | -| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | -| `npm stage download` | No | Downloads the tarball for local inspection | +| Command | Requires 2FA | Notes | +| -------------------- | ------------ | -------------------------------------------------------- | +| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | +| `npm stage list` | No | View staged packages | +| `npm stage view` | No | View staged package details | +| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | +| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | +| `npm stage download` | No | Downloads the tarball for local inspection | ### Tag Behavior @@ -96,12 +96,12 @@ The tag is an immutable property of the staged package. Once a package is staged The key difference with staged publishing is that `npm stage publish` never requires a 2FA prompt, regardless of token type. This is what makes it suitable for automated workflows. The goal of `npm stage publish` is deferring proof-of-presence to a later point in time. -| Token Type | `npm stage publish` | `npm publish` | -| --- | --- | --- | -| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | -| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | -| Session token | Can stage | 2FA prompt | -| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | +| Token Type | `npm stage publish` | `npm publish` | +| ------------------ | ---------------------- | ----------------------------------------------------- | +| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | +| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | +| Session token | Can stage | 2FA prompt | +| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | ### Trust Relationship Permissions From 6daf83197963db093a6e52ae7363bc7e80e908dc Mon Sep 17 00:00:00 2001 From: sam crochet Date: Wed, 22 Jul 2026 14:49:58 -0700 Subject: [PATCH 06/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../about-two-factor-authentication.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx b/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx index 63438e037a2..2b58125ab87 100644 --- a/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx +++ b/content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx @@ -27,7 +27,7 @@ When you enable 2FA, you will be prompted for a second form of authentication be - Two-factor authentication (2FA) enabled on your account, OR - A granular access token with bypass 2FA enabled -Starting August 2026, Account-identity and organization-governance actions cannot be performed with a bypass-2FA token. +Starting August 2026, account-identity and account-governance actions cannot be performed with a bypass-2FA token. For more information, see the npm documentation on [requiring 2FA for package publishing](/requiring-2fa-for-package-publishing-and-settings-modification). From 4fac6d804a73b044098927586cbeff55e5a02890 Mon Sep 17 00:00:00 2001 From: sam crochet Date: Wed, 22 Jul 2026 14:50:25 -0700 Subject: [PATCH 07/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../about-access-tokens.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx index 19e5826309a..4dc48ab61f4 100644 --- a/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx @@ -46,7 +46,7 @@ The Bypass 2FA capability applies to tokens with write access and is set to fals ### Account-identity actions require an interactive 2FA challenge -Starting August 2026, tokens with **Bypass 2FA** enabled can no longer be used to perform account-identity or account-governance actions. These actions always require using a token with an interactive 2FA challenge: +Starting August 2026, tokens with **Bypass 2FA** enabled can no longer be used to perform account-identity or account-governance actions. These actions always require an interactive 2FA challenge: - Change email or password - Modify or disable 2FA configuration From 546c341e80d6ed948960a6b9c90d690d1f9146fe Mon Sep 17 00:00:00 2001 From: sam crochet Date: Wed, 22 Jul 2026 14:51:01 -0700 Subject: [PATCH 08/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- ...ing-2fa-for-package-publishing-and-settings-modification.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx index c52846df872..056b87c8dda 100644 --- a/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx +++ b/content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx @@ -17,7 +17,7 @@ For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), w - Bypass 2FA configuration is set at token creation - When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required - When **bypass 2FA is enabled**: The token will bypass 2FA requirements for publishing, regardless of account-level or package-level 2FA settings -- As of August 2026, bypass 2FA token cannot be used for account-identity or organization-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." +- As of August 2026, bypass-2FA tokens cannot be used for account-identity or account-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." - When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting From 60c6192e623bf489bdf0fae80010afae4b5ba391 Mon Sep 17 00:00:00 2001 From: sam crochet Date: Wed, 22 Jul 2026 14:51:13 -0700 Subject: [PATCH 09/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../creating-and-viewing-access-tokens.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx index 5dd55a430c6..0afdd113352 100644 --- a/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx +++ b/content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx @@ -25,7 +25,7 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc 5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for package publishing. - This setting is unchecked (false) by default - By checking this box, the token will bypass 2FA for publishing even if 2FA is enabled at the account or package level - - Starting August 2026, bypass 2FA does **not** apply to account-identity or organization-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." + - Starting August 2026, the Bypass 2FA setting does **not** apply to account-identity or account-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)." 6. (Optional) In the **Allowed IP Ranges** field, enter IP address ranges to restrict your access token to. You must use [CIDR][cidr-wiki] notation to enter IP address ranges. To add more than one allowed IP range, click **Add IP Range** and enter an IP range in the new text field. From 2126d9faea74b0b9f87dd90d4e7cbfe18d3d0e86 Mon Sep 17 00:00:00 2001 From: shmam Date: Wed, 22 Jul 2026 14:53:41 -0700 Subject: [PATCH 10/11] changes --- cli-cache.json | 2 +- package-lock.json | 122 ++++++++++++++++++++++++++-------------------- 2 files changed, 69 insertions(+), 55 deletions(-) diff --git a/cli-cache.json b/cli-cache.json index 6e4e86ff542..2491e195376 100644 --- a/cli-cache.json +++ b/cli-cache.json @@ -3,5 +3,5 @@ "v9": "64763a341e7aa5b456e696f956759bf9b3440dc1", "v10": "189ba136a75c773927a5cb8922e6b00c71814d35", "v11": "7d39aa6956117ed2af95e8ecba3533f66c4bc050", - "v12": "7b1f6c173d17b3bf30e45426f6df39473c6a1163" + "v12": "882d0b246b224c37e078f9c581177d99b289476c" } \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index 5ae614f4da5..ca036d503ad 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14976,6 +14976,74 @@ "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==", "license": "MIT" }, + "node_modules/body-parser": { + "version": "1.20.6", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz", + "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==", + "license": "MIT", + "dependencies": { + "bytes": "~3.1.2", + "content-type": "~1.0.5", + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "~1.2.0", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "on-finished": "~2.4.1", + "qs": "~6.15.1", + "raw-body": "~2.5.3", + "type-is": "~1.6.18", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/body-parser/node_modules/debug": { + "version": "2.6.9", + "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", + "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/body-parser/node_modules/http-errors": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "license": "MIT", + "dependencies": { + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" + }, + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/body-parser/node_modules/ms": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz", + "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", + "license": "MIT" + }, + "node_modules/body-parser/node_modules/statuses": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, "node_modules/boolbase": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz", @@ -21014,45 +21082,6 @@ "ms": "^2.1.1" } }, - "node_modules/express/node_modules/body-parser": { - "version": "1.20.3", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz", - "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==", - "license": "MIT", - "dependencies": { - "bytes": "3.1.2", - "content-type": "~1.0.5", - "debug": "2.6.9", - "depd": "2.0.0", - "destroy": "1.2.0", - "http-errors": "2.0.0", - "iconv-lite": "0.4.24", - "on-finished": "2.4.1", - "qs": "6.13.0", - "raw-body": "2.5.2", - "type-is": "~1.6.18", - "unpipe": "1.0.0" - }, - "engines": { - "node": ">= 0.8", - "npm": "1.2.8000 || >= 1.4.16" - } - }, - "node_modules/express/node_modules/body-parser/node_modules/qs": { - "version": "6.13.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz", - "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==", - "license": "BSD-3-Clause", - "dependencies": { - "side-channel": "^1.0.6" - }, - "engines": { - "node": ">=0.6" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/express/node_modules/cookie": { "version": "0.7.1", "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.1.tgz", @@ -21077,21 +21106,6 @@ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", "license": "MIT" }, - "node_modules/express/node_modules/raw-body": { - "version": "2.5.2", - "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz", - "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==", - "license": "MIT", - "dependencies": { - "bytes": "3.1.2", - "http-errors": "2.0.0", - "iconv-lite": "0.4.24", - "unpipe": "1.0.0" - }, - "engines": { - "node": ">= 0.8" - } - }, "node_modules/ext": { "version": "1.7.0", "resolved": "https://registry.npmjs.org/ext/-/ext-1.7.0.tgz", From c0a65fcdf143a5621be6cf9b0247eeab18a66763 Mon Sep 17 00:00:00 2001 From: shmam Date: Mon, 3 Aug 2026 09:06:23 -0700 Subject: [PATCH 11/11] format --- content/cli/v11/commands/npm-stage.mdx | 28 +++++++++++++------------- content/cli/v12/commands/npm-stage.mdx | 28 +++++++++++++------------- 2 files changed, 28 insertions(+), 28 deletions(-) diff --git a/content/cli/v11/commands/npm-stage.mdx b/content/cli/v11/commands/npm-stage.mdx index 08aa2ed1d4b..4688a166722 100644 --- a/content/cli/v11/commands/npm-stage.mdx +++ b/content/cli/v11/commands/npm-stage.mdx @@ -61,14 +61,14 @@ Before using `npm stage` commands, ensure the following requirements are met: ### 2FA Requirements by Subcommand -| Command | Requires 2FA | Notes | -| --- | --- | --- | -| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | -| `npm stage list` | No | View staged packages | -| `npm stage view` | No | View staged package details | -| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | -| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | -| `npm stage download` | No | Downloads the tarball for local inspection | +| Command | Requires 2FA | Notes | +| -------------------- | ------------ | -------------------------------------------------------- | +| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | +| `npm stage list` | No | View staged packages | +| `npm stage view` | No | View staged package details | +| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | +| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | +| `npm stage download` | No | Downloads the tarball for local inspection | ### Tag Behavior @@ -80,12 +80,12 @@ The tag is an immutable property of the staged package. Once a package is staged The key difference with staged publishing is that `npm stage publish` never requires a 2FA prompt, regardless of token type. This is what makes it suitable for automated workflows. The goal of `npm stage publish` is deferring proof-of-presence to a later point in time. -| Token Type | `npm stage publish` | `npm publish` | -| --- | --- | --- | -| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | -| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | -| Session token | Can stage | 2FA prompt | -| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | +| Token Type | `npm stage publish` | `npm publish` | +| ------------------ | ---------------------- | ----------------------------------------------------- | +| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | +| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | +| Session token | Can stage | 2FA prompt | +| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | ### Trust Relationship Permissions diff --git a/content/cli/v12/commands/npm-stage.mdx b/content/cli/v12/commands/npm-stage.mdx index 4b9606f6fdd..2707a2db204 100644 --- a/content/cli/v12/commands/npm-stage.mdx +++ b/content/cli/v12/commands/npm-stage.mdx @@ -77,14 +77,14 @@ Before using `npm stage` commands, ensure the following requirements are met: ### 2FA Requirements by Subcommand -| Command | Requires 2FA | Notes | -| --- | --- | --- | -| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | -| `npm stage list` | No | View staged packages | -| `npm stage view` | No | View staged package details | -| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | -| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | -| `npm stage download` | No | Downloads the tarball for local inspection | +| Command | Requires 2FA | Notes | +| -------------------- | ------------ | -------------------------------------------------------- | +| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval | +| `npm stage list` | No | View staged packages | +| `npm stage view` | No | View staged package details | +| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package | +| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package | +| `npm stage download` | No | Downloads the tarball for local inspection | ### Tag Behavior @@ -96,12 +96,12 @@ The tag is an immutable property of the staged package. Once a package is staged The key difference with staged publishing is that `npm stage publish` never requires a 2FA prompt, regardless of token type. This is what makes it suitable for automated workflows. The goal of `npm stage publish` is deferring proof-of-presence to a later point in time. -| Token Type | `npm stage publish` | `npm publish` | -| --- | --- | --- | -| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | -| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | -| Session token | Can stage | 2FA prompt | -| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | +| Token Type | `npm stage publish` | `npm publish` | +| ------------------ | ---------------------- | ----------------------------------------------------- | +| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) | +| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) | +| Session token | Can stage | 2FA prompt | +| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) | ### Trust Relationship Permissions