# Oidc articles

## Pages

- [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/) (2026-06-12): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass.
- [Trivy Compromise: How We Are Hardening sbomify-action](https://sbomify.com/2026/03/26/trivy-compromise-hardening-sbomify-action/) (2026-03-26): Aqua Security's Trivy was compromised twice in two weeks. Here is how we audited and hardened sbomify-action in response, and why we are moving to short-lived OIDC tokens.

---

From sbomify: https://sbomify.com/tags/oidc/