npm Trusted Publishing 404 errors often stem from outdated npm version, not registry issues

·1 views

npm is phasing out 2FA-bypass automation tokens, replacing them with OIDC Trusted Publishing, which uses short-lived tokens tied to a registered GitHub repository and workflow. A developer migrating to the new system encountered repeated 404 errors during publishing, with error messages that pointed away from the actual cause. The root issue was that Node 20's bundled npm version (10.8.2) predates OIDC Trusted Publishing support, which only arrived in npm 11.5.1. Two misleading signals complicated debugging: successful provenance signing via sigstore falsely suggested OIDC was working, and a dummy credential string written by actions/setup-node@v4 resembled a masked secret. The fix requires explicitly upgrading npm to version 11.5.1 or later within the workflow, regardless of the Node.js version in use.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Publishing a Browser Extension in 2026 Is Far Harder Than Tutorials Suggest

Developers hoping to publish a browser extension face a lengthy, multi-stage review process that goes well beyond writing code and hitting upload. The Chrome Web Store alone hosts roughly 303,800 extensions as of mid-2026, with nearly 50,000 new ones added in a single quarter, meaning every submission enters an increasingly crowded queue. Before even reaching the dashboard, developers must prepare multiple icon sizes, high-resolution screenshots, promotional tiles, detailed store copy, a valid privacy policy, and ideally translations across 40-plus locales. While AI agents can now accelerate asset creation and copywriting, they cannot navigate review queues or respond to store reviewers on a developer's behalf. Every error during review resets the clock, making the post-coding publication phase a slow, high-stakes gauntlet rather than a simple final step.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WPS Embraces MCP Protocol, Letting AI Agents Directly Edit Office Documents

Kingsoft Office (WPS) has adopted the Model Context Protocol (MCP), enabling AI tools like Claude and Cursor to directly create and edit Word, Excel, and PowerPoint files without manual copy-pasting. MCP, developed by Anthropic and described as a universal 'USB-C standard' for AI integrations, allows any compatible AI client to interface with supported services through a unified protocol. Three open-source projects on GitHub — most notably wps-skills, with 243 available tools — give individual developers a ready-made MCP server to connect their AI agents to WPS. Setup requires Node.js, a local WPS installation, and a configuration file pointing AI clients to the server via an absolute file path. Once configured, developers can issue natural-language commands to automate document creation, spreadsheet edits, and even multi-page presentation generation entirely within WPS.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer open-sources bilingual Bazi terminology database and React chart component

A developer has released bazi-kit, an MIT-licensed open-source monorepo designed to simplify building software around Bazi, the Chinese Four Pillars of Destiny system. The toolkit includes two packages: bazi-terms, a zero-dependency bilingual (Chinese/English) terminology database, and bazi-chart, a React component for rendering Bazi charts from any data source. A core design principle is that bazi-kit performs no calculations itself, instead acting purely as a presentation and vocabulary layer that works with any existing calculation engine. The project addresses a longstanding problem in the Bazi software ecosystem where terminology, math, and rendering are typically bundled together, making it difficult to swap engines or reuse components. By open-sourcing only the vocabulary and UI layers, the library aims to serve as generic infrastructure that any Bazi application can adopt without exposing proprietary interpretation logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Message Queues Explained: When and Why to Use Them in Backend Systems

Message queues allow backend applications to offload slow or non-critical tasks — such as video processing or sending notifications — from the main API request, so users receive faster responses. Instead of waiting for every operation to complete, the API saves the request, places a message in a queue, and lets background workers handle the rest. This approach improves scalability, reliability, and service decoupling, with popular tools including Kafka, RabbitMQ, and Amazon SQS. However, message queues introduce added complexity, requiring developers to manage concerns like duplicate messages, retries, ordering, and monitoring. Experts advise using them only when genuinely needed — such as for high-traffic systems or background processing — rather than as a default architectural choice.

0 comments Read more at DEV Community