This is a supply-chain move, and a sensible one. A NuGet.org API key is a publish password, and the old 365-day default meant a key leaked into a repo secret or baked into a build config stayed useful to an attacker for the better part of a year. Starting today, new keys are capped at 30 days and the year-long option is gone. The part that'll bite is retroactive. Every existing long-lived key expires November 1. So any pipeline still publishing packages with a static key has a hard deadline — rotate on the new 30-day cadence, or move to Trusted Publishing, the OIDC flow Microsoft has pushed since last year. Grep your release workflows now. Better to find the stale key today than on a red build in November.