Simon Willison • 7/23/2026

Quoting Seth Larson

This article quotes Seth Larson from the Python Package Index (PyPI) blog, announcing a new security measure: PyPI now rejects file uploads to releases older than 14 days. This restriction aims to prevent attackers from poisoning old, stable releases if publishing tokens or workflows are compromised. Larson notes that while no abuse has been reported, the change closes a potential vulnerability. The article is relevant to IT/technology, specifically software supply-chain security and Python packaging.

0 comments

#Python #security #Pypi