The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days
#python #security #supplychain #pypi
Python Package Index
npub1g5…68fy6
2026-07-22 14:26:28 UTC
Author Public Key
npub1g52zm7t45x9srp48swy44hc03k2qzkckd63vyqfl0jvnvkzz8n0ql68fy6Seen on
wss://relay.momostr.pinkPublished at
2026-07-22 14:26:28 UTCEvent JSON
{
"id": "3f811c1b445effd7c83df9eb4ac1fef8a11612f6f4c7727e3d6d671c449ca532",
"pubkey": "45142df975a18b0186a783895adf0f8d94015b166ea2c2013f7c993658423cde",
"created_at": 1784730388,
"kind": 1,
"tags": [
[
"t",
"supplychain"
],
[
"t",
"python"
],
[
"t",
"pypi"
],
[
"t",
"security"
],
[
"proxy",
"https://fosstodon.org/@pypi/116964090713548160",
"web"
],
[
"proxy",
"https://fosstodon.org/users/pypi/statuses/116964090713548160",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://fosstodon.org/users/pypi/statuses/116964090713548160",
"pink.momostr"
],
[
"-"
]
],
"content": "The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.\n\nhttps://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days\n\n#python #security #supplychain #pypi",
"sig": "caaf32c3c17f91972ea62744363a18517e75f1f9494d607206ba3fe7334a629354eabb8b1c298388f1a9bd928a513d351e55f158c25c2012058205ab5ae278d7"
}