- Granular access tokens that could bypass 2FA can no longer perform sensitive account, organization, or package management actions.
- Sensitive actions now require an interactive 2FA challenge, enforcing two‑factor authentication.
- The change tightens security for npm token usage and may impact existing automation.
Restricting npm bypass-2FA granular access tokens
Official GitHub changelog summary with source attribution, release tags, and community reactions.
Track this GitHub release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this GitHub release note into a weekly digest for the tools you actually use.
Create digestMore GitHub changelog updates
Retired GitHub Models on July 30 2026, disabling the playground, model catalog, inference API, and BYOK for all customers.
Add self-repository syntax ($/) for referencing actions or reusable workflows within the same repository
Introduces public preview of stacked pull requests, allowing large changes to be split into ordered, reviewable PR layers