npm CLI upgraded to version 8

Today, we are releasing version 8 of the npm CLI. A Semver-Major release of the CLI allows us to drop support for Node.js 10, making it easier for us to maintain npm through the LTS life cycle of Node.js 16.

With this change, most customers will automatically get the update when updating Node.js, and version 8 will be the default version installed when you run npm i -g npm. If you’re interested in reading more about this change, check out this breaking changes issue.

In March we made a change in GitHub Actions that forced workflows triggered by Dependabot to run with a read-only token. This change was made to protect your repositories from potentially malicious dependencies in the same way we prevent pull requests from forks from having privileged access to your repository. We received a lot of feedback from you on how this impacted your workflows and while it was great to be in a safe configuration by default, you wanted to have the option to continue working as you had prior to this change.

In April we introduced the permissions key in the Actions workflow config which enables you to control which permissions are given to a particular workflow or job.

Starting October 11, 2021 workflow runs on push and pull_request events triggered by Dependabot will begin to respect the permissions specified in your workflows putting you back in control of how you manage automatic dependency updates. The default token permissions will remain read-only.

In addition to the permissions change we are working to enable workflows triggered by Dependabot to use Dependabot secrets. This change will enable you to use those secrets to pull dependencies from private repositories.

Learn more about the permissions key in Actions workflows

For questions, visit the GitHub Actions community

To see what's next for Actions, visit our public roadmap

See more

Organization owners on GitHub.com and GitHub Enterprise Cloud can now export a list of the organization's members in JSON or CSV format, through the 'Export' button on the People tab at github.com/orgs/<organization>/people.

Export organization members button

See more