As cited
Copy frozen at (site build).
Microsoft shortens NuGet API key lifetime to improve supply chain security
Microsoft is reducing the maximum lifetime of new NuGet.org API keys from 365 days to 30 days effective August 17, 2026. Existing keys created before that date will remain valid until November 1, 2026, after which developers must generate new keys or adopt NuGet Trusted Publishing. The change aims to limit exposure from compromised credentials in the .NET package supply chain.
Why it matters: .NET developers using NuGet must update their API key management procedures by November 1, 2026, or lose package publishing access; this reduces the window of exposure if an API key is compromised.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
Microsoft shortens NuGet API key lifetime to improve supply chain security
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Microsoft shortens NuGet API key lifetime to improve supply chain security
Microsoft will reduce the maximum lifetime of new NuGet.org application programming interface (API) keys from 365 days to 30 days beginning August 17, 2026, to strengthen supply chain security for its .NET package repository. Existing keys generated before that date will continue functioning until November 1, 2026, when developers must create replacements or adopt NuGet Trusted Publishing. The measure tightens credential exposure windows while acknowledging that shorter key lifespans alone do not eliminate API key risks.
Why it matters: NuGet package maintainers must rotate API keys by November 1, 2026, or lose ability to publish updates, creating potential disruption to .NET software supply chain operations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Microsoft shortens NuGet API key lifetime to improve supply chain security
Microsoft will reduce the maximum lifetime of new NuGet.org application programming interface (API) keys from 365 days to 30 days beginning August 17, 2026, to strengthen supply chain security for its .NET package repository. Existing keys generated before that date will continue functioning until November 1, 2026, when developers must create replacements or adopt NuGet Trusted Publishing. The measure tightens credential exposure windows while acknowledging that shorter key lifespans alone do not eliminate API key risks.
Why it matters: NuGet package maintainers must rotate API keys by November 1, 2026, or lose ability to publish updates, creating potential disruption to .NET software supply chain operations.
- Source published
- First seen by Cybersecurity Tracker