# Unvalidated npm trusted publishing configurations now expire By Steven Van · 2026-10-02 A successful publish within 48 hours exempts a configuration from expiry, while npm also blocks tokens from issue\_comment events. npm trusted publishing configurations must complete a successful publish within **48 hours** of creation to remain usable. [GitHub]() says the change limits the risk of trusting a repository or project name that changes ownership. ## Validation and expiry The first successful publish validates a configuration and exempts it from expiry. Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window. Ordinary edits do not restart the deadline. Expired configurations can no longer authorize publishing. To start another 48-hour window, recreate the configuration. Expired entries remain visible in trusted publisher settings but do not count toward per-package limits. Other valid configurations on the package are unaffected. ## Restricted workflow events npm now also rejects trusted publishing tokens from GitHub Actions issue\_comment events, alongside the existing pull\_request\_target restriction. Affected workflows need to move publishing to a permitted event such as push, release, or workflow\_dispatch. Read the [original announcement](). [![]()]() ![GitHub]() GitHub Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos. [View GitHub →]() [Original source]() [Read Unvalidated npm trusted publishing configurations now expire on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/github-unvalidated-npm-trusted-publishing-configurations-now-expire