Skip to content

v0.23.3

Choose a tag to compare

View all tags
@himerus himerus released this 20 May 00:57
· 41 commits to main since this release
v0.23.3
78df563
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch Changes

  • 4faf83d: fix(release): pin npm to 11.5.1 for OIDC trusted-publishing auth

    The previous corepack-based install activated npm 10.9.7 (corepack's
    npm@latest alias is stale), which supports --provenance for sigstore
    attestation but lacks native trusted-publishing OIDC auth. The publish
    PUT to the registry therefore went out unauthenticated and was rejected
    with a misleading E404. Pinning to npm 11.5.1 ensures both provenance
    signing and TP auth function correctly.

Assets 2
Loading