Strengthening supply chain security: Preparing for the next malware campaign (github.blog)

"Staged publishing: A new publication model that gives maintainers a review period before packages go live, with MFA-verified approval from package owners. This empowers teams to catch unintended changes before they reach downstream users—a capability the community has been requesting for years."

Overdue but welcome!