Publish npm packages with the release manager's two-factor authentication

Issue created

Manuel Leduc created this issue on 21/Oct/26 10:03

Summary:	Publish npm packages with the release manager's two-factor authentication
Issue Type:	Task
Affects Versions:	18.0.0
Assignee:	Unassigned
Components:	Development Issues only
Created:	21/Oct/26 10:03
Priority:	Major
Reporter:	Manuel Leduc
Description:	From January 2027, npm no longer lets a token that bypasses two-factor authentication publish packages. Our releases publish the `@xwiki/platform-*` packages with such a token, so the first release after that date will fail to publish them. Proposed change The release manager approves the npm publication with their own npm account and two-factor authentication, at the end of the release. The release token no longer bypasses two-factor authentication. A failed npm publication can be resumed without publishing the already published packages again. The Release Plan checks that every package version is available on npm before the release is announced.

2 updates

Changes by Manuel Leduc on 21/Oct/26 10:03

Description:

From January 2027, npm no longer lets a token that bypasses two-factor authentication publish packages. Our releases publish the {{@xwiki/platform-*}} packages with such a token, so the first release after that date will fail to publish them.

h2. Proposed change

* The release manager approves the npm publication with their own npm account and two-factor authentication, at the end of the release.
* The release token no longer bypasses two-factor authentication.
* A failed npm publication can be resumed without publishing the already published packages again.
* The Release Plan checks that every package version is available on npm before the release is announced.

Assignee:

Manuel Leduc

This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)

If image attachments aren't displayed, see this article.