asif7774 · Oct 27, 2026 · Oct 27, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,15 @@
 
 ## [Unreleased]
 
+## [3.11.1] — 2026-10-27
+
+No library changes; this release moves publishing to npm trusted publishing.
+
+### Changed
+
+- **Releases are published through npm trusted publishing** (OIDC from the `npm-publish.yml` GitHub Actions workflow) instead of a stored npm token, and carry npm provenance: the package page links each version to the commit and workflow run that built it.
+- CI retries a stalled Playwright browser install instead of failing the job, in both the CI and publish workflows.
+
 ## [3.11.0] — 2026-10-26
 
 ### Added

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -14,7 +14,7 @@ This file is auto-loaded by Claude Code and other AI coding assistants. It provi
 - **Build:** `npm run build:lib` produces the published `dist/opengridx.es.js` / `dist/opengridx.umd.js`. `npm run build` type-checks the lib and builds the **demo site**.
 - **Published:** yes — on npm as `@opencorestack/opengridx` with external consumers. Treat public types and behaviour changes as semver-relevant.
 - **Lint:** `npm run lint` (ESLint). Must pass before every commit.
-- **Current version:** 3.11.0
+- **Current version:** 3.11.1
 
 ---
 
@@ -158,6 +158,11 @@ The GitHub wiki is generated from `docs/` + `wiki/` by `scripts/build-wiki.mjs`
 
 ---
 
+## v3.11.1 — significant changes
+
+- **npm publishing uses trusted publishing (OIDC)**: `npm-publish.yml` has `id-token: write`, installs npm 11 (Node 22 ships npm 10; OIDC needs ≥ 11.5.1) and publishes without a token. npm trusts exactly `OpenCoreStack/OpenGridX` + `npm-publish.yml`, so renaming the workflow file needs the same change in the package's npm settings. The package disallows token publishing; a local publish needs 2FA
+- The Playwright install steps (`ci.yml`, `npm-publish.yml`) retry 3 × 6 min. apt is configured to retry and wait for the dpkg lock, and the root `apt-get` that `timeout` cannot reach is killed between attempts
+
 ## v3.11.0 — significant changes
 
 - **Context menu** (`contextMenu`, `getContextMenuItems`; guide `docs/features/context-menu.md`). Hook step 37a `useGridContextMenu`: a native `contextmenu` listener on the grid root; the row comes from `data-rowindex`, which already indexes [top-pinned, page rows, bottom-pinned], so there is no pinned offset. `openAt` reaches keyboard navigation (Shift+F10 / Menu key) through a ref created before `useGridKeyboardNavigation`

diff --git a/demo/public/llms.txt b/demo/public/llms.txt
@@ -1,6 +1,6 @@
 # OpenGridX — AI Agent Context
 # Package: @opencorestack/opengridx
-# Version: 3.11.0
+# Version: 3.11.1
 # Docs: https://opencorestack.github.io/OpenGridX/
 # This file is machine-readable. AI developers: start here.
 

diff --git a/docs/roadmap.md b/docs/roadmap.md
@@ -95,7 +95,8 @@ This document tracks the current status of features in `OpenGridX` and outlines
 | **3.9.1** ✅ | shipped 13 Oct | **npm package no longer ships 1.6 MB of test baselines** | `check:package` guard in CI; version badges read `package.json`; docs brought up to date |
 | **3.10.0** ✅ | shipped 13 Oct | **Backlog cleared**: refactors (R4–R6), CI guards, select-all ~2× faster | AI change chips translatable; demo syntax highlighting |
 | **3.10.1** ✅ | shipped 13 Oct | **1M-row performance**: select-all ~60–90 ms, grouping ~190 ms, quick filter first search ~1.6–2 s | Next.js smoke fixture; RTL operator symbols not mirrored |
-| **3.11.0** | 26 Oct | **Context menu** (`contextMenu`, `getContextMenuItems`): Copy, Copy with headers, Undo / Redo, custom items | Menu keyboard handling shared with the column menu |
+| **3.11.0** ✅ | shipped 26 Oct | **Context menu** (`contextMenu`, `getContextMenuItems`): Copy, Copy with headers, Undo / Redo, custom items | Menu keyboard handling shared with the column menu |
+| **3.11.1** | 27 Oct | Publishing through npm trusted publishing (provenance); CI install retries | No library changes |
 | Freeze | 19 Dec – 5 Jan | Bug fixes only | — |
 
 ### Now: backlog first (feature hold since 13 Oct; backlog cleared in 3.10)

diff --git a/llms.txt b/llms.txt
@@ -1,6 +1,6 @@
 # OpenGridX — AI Agent Context
 # Package: @opencorestack/opengridx
-# Version: 3.11.0
+# Version: 3.11.1
 # Docs: https://opencorestack.github.io/OpenGridX/
 # This file is machine-readable. AI developers: start here.
 

diff --git a/opengridx-ai-context.md b/opengridx-ai-context.md
@@ -8,7 +8,7 @@ that uses the `@opencorestack/opengridx` library. Read it in full before writing
 ## What this library is
 
 `@opencorestack/opengridx` is a zero-dependency, high-performance React DataGrid component.
-Current version: **3.11.0**. It is a full custom implementation — not a wrapper around MUI or any
+Current version: **3.11.1**. It is a full custom implementation — not a wrapper around MUI or any
 other library.
 
 ---

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opencorestack/opengridx",
-  "version": "3.11.0",
+  "version": "3.11.1",
   "description": "OpenGridX: High-performance React data infrastructure. Unlock advanced Row Grouping, Excel Export, and Column Pinning without the usual \"Pro\" gatekeeping. Built for speed, scale, and complete architectural freedom. Fully open, virtualization-ready, and feature-complete.",
   "type": "module",
   "main": "./dist/opengridx.umd.js",