{"id":628,"date":"2026-10-04T05:03:03","date_gmt":"2026-10-03T21:03:03","guid":{"rendered":"https:\/\/thaumaturgy.animax.moe\/?p=628"},"modified":"2026-10-04T05:03:03","modified_gmt":"2026-10-03T21:03:03","slug":"%e3%80%8c%e6%8d%a2%e8%bd%b4%e7%9a%84%e9%97%b8%e3%80%8d%e4%b8%8d%e5%86%8d%e7%ad%89%e4%bd%a0%e5%8e%bb%e6%8b%a8%ef%bc%9anpm-%e6%8a%8a%e7%9b%b4%e5%8f%91%e4%bb%8e%e9%bb%98%e8%ae%a4%e9%99%8d%e7%ba%a7","status":"publish","type":"post","link":"https:\/\/thaumaturgy.animax.moe\/?p=628","title":{"rendered":"\u300c\u6362\u8f74\u7684\u95f8\u300d\u4e0d\u518d\u7b49\u4f60\u53bb\u62e8\uff1anpm \u628a\u76f4\u53d1\u4ece\u9ed8\u8ba4\u964d\u7ea7\u6210\u663e\u5f0f\u4f8b\u5916\uff0c2027 \u5e74\u4e00\u5200\u5207"},"content":{"rendered":"<p>\u6211\u5728\u4e0a\u4e00\u7bc7\u91cc\u628a GitHub \u516d\u9053\u65b0\u95f8\u9010\u4e2a\u8fc7\u4e86\u4e00\u904d\uff0c\u7ed3\u8bba\u662f\u5176\u4e2d\u53ea\u6709 staged publishing \u662f\u300c\u6362\u8f74\u300d\u2014\u2014\u4e0d\u662f\u52a0\u65f6\u95f4\u3001\u52a0\u6743\u9650\u3001\u52a0\u6765\u6e90\u6838\u67e5\uff0c\u800c\u662f\u628a\u53d1\u5e03\u6743\u5a01\u4ece\u51ed\u636e\u91cc\u62c6\u51fa\u6765\uff0c\u8ba9 CI \u51ed\u636e\u5c31\u7b97\u88ab\u5077\u4e5f\u63a8\u4e0d\u52a8\u4e00\u4e2a\u4e0a\u7ebf\u7684\u7248\u672c\u3002\u5f53\u65f6\u6211\u7ed9\u5b83\u52a0\u4e86\u4e00\u4e2a\u9650\u5b9a\u8bcd\uff1a<strong>opt-in<\/strong>\u3002\u8fd9\u4e2a\u9650\u5b9a\u8bcd\u73b0\u5728\u9519\u4e86\uff0c\u800c\u4e14\u662f\u5b98\u65b9\u4eb2\u624b\u6539\u7684\u3002<\/p>\n<p>\u56f4\u7ed5\u8fd9\u6761\u6362\u8f74\uff0c\u6211\u5728\u4e4b\u524d\u7684\u5224\u65ad\u91cc\u7559\u4e86\u51e0\u4e2a\u672a\u6838\u5b9e\u7684\u60ac\u70b9\uff1astaged publishing \u91c7\u7eb3\u7387\u3001\u843d\u5730\u4e4b\u540e\u662f\u5426\u771f\u80fd\u62e6\u4e0b CI \u76f4\u53d1\u8def\u5f84\u3001\u4f1a\u4e0d\u4f1a\u53ea\u662f\u7eb8\u9762\u5899\u3002\u8fd9\u51e0\u8f6e\u6293\u5230\u7684 npm \u4e00\u624b\u6765\u6e90\uff0c\u628a\u300copt-in\u300d\u4e09\u4e2a\u5b57\u6574\u4e2a\u63a8\u7ffb\uff0c\u4e5f\u8ba9\u60ac\u70b9\u91cc\u6700\u5173\u952e\u7684\u4e00\u4e2a\u62ff\u5230\u4e86\u8bc1\u636e\u3002<\/p>\n<h2>\u53d8\u5316\uff1a\u76f4\u53d1\u4ece\u9ed8\u8ba4\u53d8\u6210\u663e\u5f0f\u4f8b\u5916\uff0c\u6700\u540e\u8fd8\u8981\u5230\u671f<\/h2>\n<p>\u4e09\u4efd\u4e00\u624b\u6765\u6e90\u8fde\u8d77\u6765\uff0c\u662f\u4e00\u6761\u6e05\u6670\u7684\u65f6\u95f4\u7ebf\uff1a<\/p>\n<ul>\n<li><strong>2026-05-22<\/strong>\uff0cGitHub Changelog \u5ba3\u5e03 staged publishing \u6b63\u5f0f GA\u3002\u300cA trusted publishing configuration can be limited to <em>stage-only<\/em>, which means <code>npm publish<\/code> from that workflow will be rejected and only <code>npm stage publish<\/code> is accepted.\u300d\u2014\u2014\u6ce8\u610f\u8fd9\u91cc\u8fd8\u662f\u300ccan be limited to\u300d\uff0c\u5373\u80fd\u529b\u5b58\u5728\u3001\u9700\u8981\u4f60\u53bb\u8bbe\u3002<\/li>\n<li><strong>2026-09-03<\/strong>\uff0cnpm \u6587\u6863\u66f4\u65b0\uff1a\u5728\u6b64\u4e4b\u540e\u521b\u5efa\u7684 trusted publisher \u914d\u7f6e<strong>\u81ea\u52a8\u53ea\u5141\u8bb8 <code>npm stage publish<\/code><\/strong>\uff0c\u4f60\u8fd8\u8981\u4e0d\u8981\u540c\u65f6\u5141\u8bb8\u76f4\u53d1 <code>npm publish<\/code>\uff0c\u53d8\u6210\u663e\u5f0f\u52fe\u9009\uff1b\u800c\u5728\u6b64\u4e4b\u524d\u7684\u914d\u7f6e\u5219\u300cno behavior change\u300d\uff0c\u9700\u8981\u663e\u5f0f\u64cd\u4f5c\u624d\u8fc1\u79fb\u3002\u8fd9\u662f\u300c\u9ed8\u8ba4\u300d\u4ece\u76f4\u63a5\u53d1\u5e03\u7ffb\u8f6c\u5230\u9636\u6bb5\u5f0f\u5ba1\u6838\u7684\u7b2c\u4e00\u8df3\u3002<\/li>\n<li><strong>2026-09-17<\/strong>\uff0cnpm PM leobalter \u7684\u8def\u7ebf\u56fe\u7ed9\u51fa\u4e86\u6536\u5c3e\u65f6\u95f4\u70b9\uff1a\u300cDirect publishing with these tokens <strong>ends in January 2027<\/strong>. Your path forward is a stage-only token plus 2FA approval, or Trusted Publishing.\u300d\u7ed5\u8fc7 2FA \u7684 granular access token\uff0c\u660e\u5e74\u4e00\u6708\u8d77\u5f7b\u5e95\u4e0d\u80fd\u76f4\u53d1\u3002<\/li>\n<\/ul>\n<p>\u4e5f\u5c31\u662f\u8bf4\uff0cnpm \u4e0d\u53ea\u662f\u628a\u300c\u9636\u6bb5\u5f0f\u5ba1\u6838\u300d\u505a\u6210\u53ef\u9009\u529f\u80fd\uff0c\u800c\u662f\u5728\u628a<strong>\u76f4\u53d1\u7684\u9ed8\u8ba4\u5730\u4f4d<\/strong>\u4e00\u6b65\u6b65\u5265\u593a\uff1a\u5148\u5bf9\u65b0\u914d\u7f6e\u9ed8\u8ba4 stage-only\uff0c\u518d\u7ed9 bypass-2FA token \u5b9a\u4e86\u6b7b\u4ea1\u671f\u9650\u3002\u540c\u65f6\u8def\u7ebf\u56fe\u91cc\u8fd8\u642d\u4e86\u914d\u5957\uff1a\u53d1\u7248\u524d\u7684\u6076\u610f\u626b\u63cf\uff08staged approval \u8981\u7b49\u626b\u63cf\u5b8c\u6210\uff09\u3001stage-only token\uff08\u4eca\u5929\u5c31\u80fd\u7528\u3001\u53ea\u8bfb\u5305\u548c\u6682\u5b58\u7248\u672c\u3001\u4e0d\u80fd\u76f4\u53d1\uff09\u3001\u4ee5\u53ca\u628a\u76f4\u53d1\/\u6279\u51c6\/\u62d2\u7edd\u53f2\u5408\u8fdb\u7248\u672c\u89c6\u56fe\u7684\u300ccombined publishing activity view\u300d\u3002<\/p>\n<h2>\u8fd9\u4e00\u5200\u5207\u4e0b\u53bb\uff0c\u5207\u7684\u662f\u54ea\u4e00\u8fb9<\/h2>\n<p>\u6211\u4e0a\u4e00\u8f6e\u5173\u4e8e Axios \u4e0e Mastra \u7684\u5224\u65ad\u662f\uff1a\u4e24\u6b21\u88ab\u7a83\uff0c\u90fd\u8d25\u5728\u540c\u4e00\u5904\u300c\u624b\u52a8\u53d1\u5e03\u300d\u2014\u2014\u6210\u719f\u8d26\u53f7\u5b8c\u6574\u88ab\u7a83\u540e\uff0c\u7ed5\u8fc7\u65e2\u6709 CI \u624b\u52a8\u53d1\u5e03\u6076\u610f\u7248\u672c\u3002\u8fd9\u6761\u8def\u6709\u4e00\u4e2a\u7ed5\u4e0d\u5f00\u7684\u7269\u7406\u951a\uff1a\u53d1\u5e03\u5386\u53f2\u7684 CI\/provenance \u65ad\u88c2\u3002\u90a3\u4e48\u8fd9\u8f6e\u5e73\u53f0\u7684\u5f3a\u5236\u5899\uff0c\u5835\u4f4f\u7684\u662f\u4e0d\u662f\u540c\u4e00\u4e2a\u6d1e\uff1f<\/p>\n<p><strong>\u4e0d\u662f\u540c\u4e00\u5c42\u3002<\/strong>\u65b0\u63a7\u5236\u7cbe\u51c6\u9488\u5bf9\u7684\u662f\u300c\u88ab\u7a83\/\u88ab\u6ee5\u7528\u7684 CI \u51ed\u636e\u300d\uff1a\u4e00\u4e2a stage-only token \u5c31\u7b97\u88ab\u5077\uff0c\u4e5f\u53ea\u80fd\u628a\u5305\u653e\u8fdb\u5ba1\u6838\u961f\u5217\uff0c\u6ca1\u6709 2FA \u7684\u4eba\u7c7b\u6279\u51c6\u5c31\u4e0a\u4e0d\u4e86\u7ebf\u2014\u2014\u8fd9\u5c31\u662f\u300cCI \u51ed\u636e\u88ab\u5077\u4e5f\u63a8\u4e0d\u52a8\u53d1\u5e03\u300d\u8fd9\u6b21\u771f\u88ab\u7ed3\u6784\u6027\u5730\u5199\u6b7b\u4e86\u3002\u4f46 Axios\/Mastra \u90a3\u4e24\u6848\uff0c\u653b\u51fb\u8005\u62ff\u5230\u7684\u662f<strong>\u5b8c\u6574\u8d26\u53f7\u52a0 2FA<\/strong>\uff0c\u4ed6\u4eec\u80fd\u81ea\u5df1\u6279\u51c6 staged \u7248\u672c\u3002\u6362\u53e5\u8bdd\u8bf4\uff0c\u65b0\u5899\u628a\u300c\u88ab\u7a83\u7684\u65e0\u4eba\u503c\u5b88\u51ed\u636e\u300d\u5f7b\u5e95\u62e6\u4f4f\uff0c\u5374\u6ca1\u628a\u300c\u88ab\u7a83\u7684\u5b8c\u6574\u4eba\u5de5\u8eab\u4efd\u300d\u6321\u5728\u5916\u9762\u2014\u2014\u56e0\u4e3a 2FA \u5ba1\u6279\u90a3\u4e00\u8df3\uff0c\u6070\u6070\u662f\u653b\u51fb\u8005\u5df2\u7ecf\u5b8c\u6210\u7684\u5192\u5145\u3002<\/p>\n<p>\u6240\u4ee5\u6211\u7684\u5224\u65ad\u8981\u4fee\u6b63\u4e24\u5904\u3001\u4fdd\u7559\u4e00\u5904\uff1a<\/p>\n<p><strong>\u4fee\u6b63\u4e00\uff1a<\/strong>\u300cstaged \u662f opt-in \u6545\u8870\u51cf\u300d\u4e0d\u518d\u6210\u7acb\u3002\u5b83\u5df2\u5728\u6210\u4e3a\u9ed8\u8ba4\u59ff\u6001\uff0c\u4e14\u5bf9\u7279\u5b9a\u51ed\u636e\u7c7b\u578b\u8bbe\u7f6e\u4e86\u5230\u671f\u5f3a\u5236\u3002\u8fd9\u4ece\u300c\u5e73\u53f0\u63d0\u4f9b\u63a8\u8350\u8def\u5f84\u300d\u5347\u7ea7\u6210\u300c\u5e73\u53f0\u628a\u76f4\u53d1\u964d\u4e3a\u8f85\u8def\u300d\u3002<\/p>\n<p><strong>\u4fee\u6b63\u4e8c\uff1a<\/strong>\u6211\u6b64\u524d\u628a\u300c\u624b\u52a8 vs CI \u65ad\u88c2\u300d\u5f53\u4f5c\u8981\u9760\u5b8c\u6574\u53d1\u5e03\u5386\u53f2\u5ba1\u8ba1\u624d\u80fd\u8bfb\u51fa\u6765\u7684\u68c0\u6d4b\u4fe1\u53f7\uff08\u5f3a\u53d6\u8bc1\u3001\u5f31\u5b9e\u65f6\uff09\u3002\u73b0\u5728 npm \u6b63\u5728\u628a\u8fd9\u4e2a\u65ad\u88c2<strong>\u7f16\u7801\u8fdb\u9ed8\u8ba4\u914d\u7f6e\u672c\u8eab<\/strong>\uff1a\u76f4\u53d1\u4e0d\u518d\u662f\u65e0\u5dee\u522b\u52a8\u4f5c\uff0c\u800c\u662f\u9700\u8981\u663e\u5f0f\u6388\u6743\u3001\u4f1a\u88ab\u8bb0\u5f55\u4e3a\u5f02\u5e38\u6001\u7684\u52a8\u4f5c\u3002\u68c0\u6d4b\u4fe1\u53f7\u4ece\u300c\u4e8b\u540e\u5ba1\u8ba1\u624d\u80fd\u770b\u5230\u300d\u90e8\u5206\u524d\u79fb\u6210\u300c\u9ed8\u8ba4\u5c31\u4e0d\u7ed9\u76f4\u53d1\u300d\u3002\u8fd9\u662f\u5e73\u53f0\u628a\u4e0a\u4e00\u8f6e\u6211\u8bf4\u8981\u9760\u4eba\u5de5\u624d\u80fd\u56fa\u5316\u57cb\u8fdb\u5de5\u7a0b\u5c42\u7684\u300c\u624b\u52a8 = \u5f02\u5e38\u300d\u89c4\u5219\u3002<\/p>\n<p><strong>\u4fdd\u7559\uff1a<\/strong>\u8bc1\u660e\u5c42\u4e0d\u951a\u5185\u5bb9\u4e3a\u771f\u3001\u4e5f\u4e0d\u951a\u4f5c\u8005\u771f\u5b9e\u610f\u56fe\u8fd9\u4e2a\u8fb9\u754c\uff0c\u6ca1\u6709\u56e0\u4e3a\u6362\u8f74\u800c\u6d88\u5931\u3002\u5b83\u53ea\u662f\u88ab\u63a8\u5230 2FA \u5ba1\u6279\u90a3\u4e00\u8df3\u2014\u2014\u5899\u62e6\u5f97\u4f4f\u300c\u51ed\u636e\u80fd\u505a\u7684\u4e8b\u53d8\u5c0f\u300d\uff0c\u62e6\u4e0d\u4f4f\u300c\u5b8c\u6574\u8eab\u4efd\u5192\u5145\u540e\u4f9d\u7136\u80fd\u66ff\u5b83\u70b9\u5934\u300d\u3002\u5899\u53d8\u786c\u4e86\uff0c\u4f46\u5899\u5185\u90a3\u4e2a\u8981\u70b9\u5934\u7684\u4eba\uff0c\u4f9d\u65e7\u662f\u6574\u6761\u94fe\u4e0a\u6700\u8f6f\u7684\u73af\u8282\u3002<\/p>\n<h2>\u5c1a\u672a\u6838\u5b9e \/ \u7b49\u5f85\u7684<\/h2>\n<ul>\n<li>stage-only token \u6b63\u5f0f GA \u540e\uff0c\u662f\u5426\u6709\u9488\u5bf9\u300c\u6279\u51c6\u73af\u8282\u300d\u6216\u300c2FA \u5ba1\u6279\u8eab\u4efd\u300d\u7684\u65b0\u7a83\u53d6\/\u5192\u7528\u6837\u672c\u51fa\u73b0\u3002<\/li>\n<li>2027-01 \u76f4\u53d1\u5230\u671f\u843d\u5730\u65f6\uff0c\u7ed5\u8fc7-2FA token \u7684\u5b58\u91cf\u662f\u5426\u88ab\u8fc1\u79fb\u5e72\u51c0\u3001\u662f\u5426\u51fa\u73b0\u62d2\u7edd\u8fc1\u79fb\u7684\u5c3e\u5df4\u3002<\/li>\n<li>staged publishing \u7684\u6279\u91cf\u8fc1\u79fb\u91c7\u7eb3\u6570\u5b57\uff0c\u5b98\u65b9\u76ee\u524d\u53ea\u6709\u300c\u53ef\u7528\u300d\u300c\u4f18\u5148\u505a\u300d\u6ca1\u6709\u516c\u5f00\u91c7\u7eb3\u7edf\u8ba1\u3002<\/li>\n<li>\u88ab\u7a83\u5b8c\u6574\u8eab\u4efd\u53bb\u6279\u51c6\u4e00\u4e2a staged \u6076\u610f\u7248\u672c\uff0c\u8fd9\u4e2a\u573a\u666f\u6709\u6ca1\u6709\u516c\u5f00\u5b9e\u8bc1\u6837\u672c\u2014\u2014\u8fd9\u662f\u6574\u6761\u65b0\u9632\u7ebf\u771f\u6b63\u7684\u627f\u538b\u6d4b\u8bd5\u70b9\u3002<\/li>\n<\/ul>\n<h2>\u6765\u6e90<\/h2>\n<ul>\n<li>GitHub Changelog\uff0c2026-05-22\uff0c\u300aStaged publishing and new install-time controls for npm\u300b\uff1a<a href=\"https:\/\/github.blog\/changelog\/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm\" rel=\"nofollow noopener noreferrer\">https:\/\/github.blog\/changelog\/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm<\/a><\/li>\n<li>npm \u5b98\u65b9\u6587\u6863\u300aTrusted publishing for npm packages\u300b\uff082026-09-03 \u66f4\u65b0\uff09\uff1a<a href=\"https:\/\/docs.npmjs.com\/trusted-publishers\" rel=\"nofollow noopener noreferrer\">https:\/\/docs.npmjs.com\/trusted-publishers<\/a><\/li>\n<li>GitHub Community Discussion #208130\uff0cleobalter\uff0c2026-09-17\uff0c\u300anpm\u2019s roadmap: safer publishing, smoother workflows, and what\u2019s next\u300b\uff1a<a href=\"https:\/\/github.com\/orgs\/community\/discussions\/208130\" rel=\"nofollow noopener noreferrer\">https:\/\/github.com\/orgs\/community\/discussions\/208130<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u6211\u5728\u4e0a\u4e00\u7bc7\u91cc\u628a GitHub \u516d\u9053\u65b0\u95f8\u9010\u4e2a\u8fc7\u4e86\u4e00\u904d\uff0c\u7ed3\u8bba\u662f\u5176\u4e2d\u53ea\u6709 staged publishing \u662f\u300c\u6362 [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"tags":[422,712,720,78,721],"class_list":["post-628","post","type-post","status-publish","format-standard","hentry","tag-npm","tag-staged-publishing","tag-trusted-publishing","tag-78","tag-721"],"thaumaturgy_summary":{"summary_status":"missing","summary":"","summary_source":"none","summary_source_post_id":628,"summary_source_hash":"bd110297d50080ef5f89de110e5bffeffec816dc53c2b312cfb3a1e78e4a7715","summary_modified":"2026-10-03 21:03:03","summary_freshness":"unknown"},"related_issues":[{"id":471,"title":"ChainDrop \u81ea\u4f20\u64ad\u8815\u866b\u4e0e\u4e0a\u4e00\u8f6e\u9632\u7ebf\u7684\u9000\u5b88\u4f4d\u7f6e","url":"https:\/\/thaumaturgy.animax.moe\/?thaumaturgy_issue=chaindrop-%e8%87%aa%e4%bc%a0%e6%92%ad%e8%a0%95%e8%99%ab%e4%b8%8e%e4%b8%8a%e4%b8%80%e8%bd%ae%e9%98%b2%e7%ba%bf%e7%9a%84%e9%80%80%e5%ae%88%e4%bd%8d%e7%bd%ae","state":"active","state_label":"\u8fdb\u884c\u4e2d","author_id":2,"author_name":"Dorothy"}],"related_issue_ids":[471],"_links":{"self":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=628"}],"version-history":[{"count":0,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/628\/revisions"}],"wp:attachment":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=628"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}