diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 080a477..d391681 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -1,6 +1,3 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
-
 name: Publish to NPM
 
 on:
@@ -24,15 +21,18 @@ jobs:
   publish-npm:
     needs: build
     runs-on: ubuntu-latest
+    # npm trusted publishing: OIDC replaces NPM_TOKEN. npm needs this workflow's
+    # filename (npm-publish.yml) registered as the package's trusted publisher.
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
           node-version: 26
-          registry-url: https://registry.npmjs.org/
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
       - run: npm ci
       - run: npm run build
-      - run: npm run lint
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 095bf62..becafc5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,16 @@ All notable changes to this project will be documented in this file, per [the Ke
 
 ## [next]
 
+## [0.8.0] - 2026-11-04
+
 ### Changed
 - Require Node.js 22.18 or above.
 - Bump all npm packages to the latest version, except yargs, which stays on 17.
 - Ship code compiled for Node 22.18, with native async/await.
 
+### Security
+- Clear all 6 npm audit advisories in production dependencies, including 1 critical in form-data and 2 high in lodash and tmp.
+
 ## [0.7.0] - 2022-02-13
 
 ### Added
diff --git a/CLAUDE.md b/CLAUDE.md
index 5d4b1da..11de1ad 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -42,6 +42,11 @@ Try the CLI locally with `node bin/cf <command>` after a build, or `npm link` to
 
 Tests live in `test/utils/` and cover only the utilities and `Config`, importing from `lib/`. `Config` tests stub `Config.getConfigFile` with sinon and copy `test/fixtures/config/` into a temp dir. There are no tests for commands or API classes.
 
+## Releasing
+
+1. In a PR: set the version with `npm pkg set version=X.Y.Z && npm install --package-lock-only --ignore-scripts`, and move `CHANGELOG.md` entries from `[next]` to `[X.Y.Z] - <date>`. Don't use `npm version`: its `postversion` script pushes straight to `main`, which the branch ruleset rejects.
+2. After merge, create a GitHub release with tag `X.Y.Z` (no `v`, matching earlier tags). `.github/workflows/npm-publish.yml` publishes it through npm trusted publishing (OIDC), so there is no npm token in the repo. The package's trusted publisher on npmjs.com must name `ivankristianto/cloudflare-cli-node` and `npm-publish.yml`, and `repository.url` in `package.json` must keep pointing at that repo.
+
 ## Reference
 
 `HOWTO.md` lists example invocations for every command, including the `xargs` pipeline pattern. Full command docs are in the project wiki: https://github.com/ivankristianto/cloudflare-cli-node/wiki
diff --git a/package-lock.json b/package-lock.json
index 108fc99..e2758b7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "cloudflare-cli-node",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cloudflare-cli-node",
-      "version": "0.7.0",
+      "version": "0.8.0",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^8.1.0",
diff --git a/package.json b/package.json
index 88f6a33..ed91824 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-cli-node",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Cloudflare API CLI Interface with Node.js",
   "bin": {
     "cf": "bin/cf"
@@ -56,7 +56,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git@github.com:ivankristianto/cloudflare-cli-node.git"
+    "url": "git+https://github.com/ivankristianto/cloudflare-cli-node.git"
   },
   "keywords": [
     "cloudflare",