Quoting Seth Larson

This article covers a new security measure implemented by the Python Package Index (PyPI) as of July 23, 2026: rejecting new file uploads to releases that are older than 14 days. The change aims to prevent attackers from poisoning old, stable releases if publishing tokens or workflows are compromised. Seth Larson from the PyPI blog notes that while this attack vector has not been exploited yet, it was technically possible. The article is relevant to IT/technology, specifically software supply-chain security and Python packaging.