npm trusted publishing breaks silently on versions older than 11.15.0

·1 views

Developers setting up trusted publishing for npm packages may encounter a cryptic 400 Bad Request error with no explanation in CLI output or debug logs. The root cause is that npm versions 11.14.1 and older send a payload missing a required permissions field, after the registry began mandating at least one allowed action from 20 May 2026 onward. npm 11.15.0 and newer correctly catch the error client-side and prompt users to add the --allow-publish or --allow-stage-publish flag. Developers unable to upgrade Node to meet npm 12 requirements can work around the issue by running a compatible newer version via npx without a global install. Additionally, unlike PyPI, npm requires a package to already exist before trusted publishing can be configured, meaning the first release must always be published manually.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why AI-Generated DB Migrations Need a Clone-Based Dry Run, Not Just Tests

A commentary published on DEV Community argues that passing test suites are insufficient to validate AI-generated database migrations, since tests only run against the post-migration schema and cannot detect data loss that occurs during execution. The author notes that as AI tools lower the cost of generating migrations to near zero, the volume of unreviewed migrations rises, increasing the risk of silent data destruction in production. Down migrations, which serve as the primary rollback safety net, are often treated as afterthoughts despite being critical when deployments fail. The recommended approach involves cloning the production schema with a representative data sample and running both the up and down migrations while capturing row counts, null rates, and constraint counts at each step. The article, disclosed as part of MonkeyCode product outreach, includes a Bash script implementing this dry-run workflow for PostgreSQL databases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New tool mcp-drift-monitor catches unauthorized changes in MCP servers

A developer named Pedro S has released mcp-drift-monitor, an open-source tool designed to detect unauthorized or unnoticed changes in Model Context Protocol (MCP) servers. The tool addresses a critical blind spot identified in a research paper (arXiv:2608.00997), which studied 19,099 MCP servers over 88.6 days and found that traditional change-detection methods miss silent description hash changes and newly added servers. mcp-drift-monitor implements a periodic full-catalog sweep — the primary control proposed but not built in the original paper — using a unified diff engine that handles both incremental polling and complete sweeps. The tool was calibrated against the paper's real dataset, successfully matching 19,877 server additions and 911 removals recorded during the study period. It is available on GitHub and Docker Hub under the AGPL-3.0 license, with CI/CD pipelines and multi-platform container support included.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developers Build AI Mental Health Monitor Using HuBERT and Acoustic Speech Analysis

A new developer tutorial on DEV Community outlines how to build an AI-powered mental health monitoring tool called Psycho-Acoustic, which analyzes non-verbal speech cues rather than spoken words. The system combines Facebook's HuBERT deep learning model with the Librosa audio processing library to detect subtle vocal markers such as pitch variation, speech tempo, and frequency instability known as jitter. These acoustic features are associated with early signs of depression and anxiety in clinical psychology research. The tool uses a multimodal approach, fusing traditional signal processing features with HuBERT embeddings through a classification layer to produce a quantified mental health score. For real-world deployment in applications such as telehealth platforms, the guide also covers optimizing the model using ONNX Runtime to enable faster, lightweight inference.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LLMs Open Door to Invisible Reputation Damage and AI Training Manipulation

A developer essay warns that large language models like ChatGPT are vulnerable to deliberate poisoning through mass-generated negative content, which could distort how AI perceives lesser-known individuals, businesses, and properties. Unlike Google searches, victims may never discover the reputational harm unless someone directly asks an LLM the right question. The author argues that automation tools make it trivially easy to flood the web with fabricated or malicious content at scale, potentially influencing future AI training data. This risk is amplified by growing public reliance on LLMs as authoritative information sources, blurring the line between verified fact and AI-generated falsehood. The piece concludes that well-funded actors could systematically shape AI knowledge bases for propaganda or competitive harm, with few current safeguards in place.

0 comments Read more at DEV Community