pnpm 12.12.1 lets CI manage npm tags without a stored token
OIDC trusted publishing now covers pnpm dist-tag commands, and a new tool: protocol lets you pin Node, Bun, Deno or Yarn versions like any dependency.
pnpm 12.12.1 shipped on 11 October and extends OIDC trusted publishing beyond npm publish to tag management. pnpm dist-tag add, rm and ls can now authenticate to the npm registry with a short-lived OIDC token from CI instead of a long-lived NPM_TOKEN secret. You switch it on per package, by enabling “Allow npm dist-tag” in that package’s trusted publishing settings on npmjs.com.
Publishing itself got a tightening too: pnpm now checks that the OIDC token’s aud claim actually matches the registry you’re publishing to, such as npm:registry.npmjs.org, before it will use it.
Separately, the release adds a tool: protocol for the runtimes pnpm manages for you:
pnpm add bun@tool:1.3.0
pnx node@tool:22This pins Node, Bun, Deno or Yarn the same way you’d pin any other dependency. The older runtime: spelling still works as an alias, and lockfiles stay compatible if you switch between the two.
Why it matters: dist-tag commands were one of the last places a publish pipeline still needed a stored npm token as a CI secret. Closing that gap removes a credential that, if leaked, could move your package’s latest tag to malicious code. The tool: protocol is smaller, but useful if you’ve ever had a CI matrix where the Node version in the lockfile quietly drifted from the version actually installed.