Ensure the NPM Token is updated

Open philippjfr opened this issue 2 months ago • 3 comments

Apparently npm is changing their token policy resulting in tokens expiring every 3 months. We need to make sure we keep it up-to-date.

Oct 22 '25 15:10 philippjfr

More info can be seen here: https://github.com/bokeh/bokeh/discussions/14669

Oct 27 '25 07:10 hoxbro

I have updated the token and it'll expire on January 27th 2026. Not sure what process we should add so we don't forget to update it.

Oct 29 '25 13:10 philippjfr

Opened https://github.com/holoviz/panel/pull/8276. Which will hopeful catch it before a release, I don't think there is much more we can do than that.

Oct 30 '25 15:10 hoxbro

Maybe we should migrate to trusted publishing as we do for PyPI: https://docs.npmjs.com/trusted-publishers

Dec 15 '25 07:12 hoxbro

We should!

Dec 15 '25 16:12 philippjfr