PyPI Implements 14-Day Upload Limit for Older Release Files
The Python Package Index (PyPI) has introduced a new policy restricting the upload of files to release versions older than 14 days. This measure aims to safeguard against the "poisoning" of long-established and stable releases. The concern is that if publishing tokens or automated workflows associated with PyPI projects were compromised, malicious actors could potentially upload harmful files to older, seemingly secure releases. While PyPI has stated that this type of abuse has not yet been observed, the platform acknowledges that attackers could exploit this vulnerability if they became aware of it. The decision reflects a proactive approach to enhancing the security of the Python software supply chain by preventing potential tampering with historical package versions.
This policy change by PyPI addresses a potential vulnerability in the software supply chain by introducing a time-based gate for package updates. By limiting modifications to recent releases, PyPI aims to mitigate risks associated with compromised credentials or automated build processes, thereby preserving the integrity of established software versions. This proactive measure acknowledges the evolving threat landscape where even seemingly immutable historical data can become a vector for attack. The 14-day window represents a trade-off between security and flexibility, prompting consideration of how such controls might impact long-term maintenance or legitimate updates for older, but still critical, software components.
AI-generated to prompt reflection — not editorial opinion, not advice, not a statement of fact. How this works.