PyPI has implemented a security measure that rejects new file uploads to releases older than 14 days, aiming to prevent package poisoning from compromised tokens. This change was accelerated after the compromise of popular packages like LiteLLM and Telnyx, though it may disrupt workflows for projects adding late Python version support.
Background
The Python Package Index (PyPI) serves as the default repository for Python software, making its security critical for the entire ecosystem. Recent high-profile compromises highlighted vulnerabilities in how old releases could be modified if publishing credentials were stolen.
- Source
- Lobsters
- Published
- Jul 22, 2026 at 11:01 PM
- Score
- 8.0 / 10