npm install-time security and GAT bypass2fa deprecation
DeprecationVerifiedAdded Sep 22, 2026
npm v12 is now generally available and tagged latest . This major release turns on the install-time security defaults we announced in June , and it’s also where we begin a deprecation of the most sensitive uses of 2FA-bypass granular access tokens (GATs).
Topics: Security
Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.
More GitHub Advanced Security releases
Every GitHub Advanced Security release| Date | Release | Type |
|---|---|---|
| Jul 8 | Innersource security advisories are generally available GA | GA |
| Jul 9 | Organization-level targeting for GitHub Code Quality Preview | Preview |
| Jul 7 | Secret scanning extended metadata and multipart validation GA | GA |
| Jul 10 | CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection Update | Update |
| Jul 10 | Clearer names for secret scanning detector types Update | Update |
| Jul 13 | Manage secret scanning custom patterns via REST API GA | GA |
| Jul 13 | GitHub Code Quality license estimate in public preview Preview | Preview |
| Jul 14 | Code scanning shows AI security detections on pull requests Update | Update |
