npm trusted publishing now allows multiple OIDC configurations per package and blocks approval mid-scan.

Three changes GA on September 3. Packages can hold more than one trusted publishing configuration, each operating independently with per-config direct-publishing opt-in. The staged-package approval button is disabled while a scan runs and only enables on completion. The versions tab on npmjs.com now shows whether each version was approved, rejected or still staged. GitHub recommends staging-only, which inserts a human approval step before a version goes live. GitHub Changelog