npm Publishing and Agent Sandboxes #129
Today's Letter
GitHub, multiple npm trusted publishing configurations
- GitHub made three npm trusted publishing updates generally available on September 3, 2026
- Each package can now define multiple independent OIDC configurations for separate stable, prerelease, or staging workflows
- Configurations specify repository, workflow, and environment criteria; publishing is authorized when any configuration matches
- Staged publishing is enabled by default, while direct publishing requires per-configuration opt-in
- Approval remains disabled until publish-time malware scanning completes, with status refreshed every minute
- Maintainers can review approval, rejection, and staging history for each version in npmjs.com’s versions tab
Source: github.blog
Cursor Cloud Agents, Vercel Sandbox Support
- Cursor Cloud Agents can now run in Vercel Sandbox instead of Cursor-hosted machines
- Cursor manages the agent harness and inference loop through its Self-Hosted Machines APIs
- Each request runs in an isolated Firecracker microVM provided by Vercel Sandbox
- Vercel Functions and Vercel Workflow provide durable request queuing, worker provisioning, monitoring, retries, and cleanup
- The architecture supports scale-to-zero workers and short-lived, user-scoped credentials
- Self-Hosted Machines requires a Cursor Enterprise plan
- Vercel published a reference implementation and deployment guide on September 3, 2026
Source: vercel.com
Jocoletter curates AI, software, and product trends for developers and builders.
#GitHub #Vercel