PyPI now rejects uploads of files older than 14 days to existing releases

Simon Willison's Blog·high signal

Seth Larson, quoted by Simon Willison, details PyPI's new restriction rejecting new file uploads to releases older than 14 days. The change closes a supply-chain path where an attacker with a compromised maintainer account could quietly poison a long-stable, widely-pinned release by adding a new artifact to it. Anyone with release automation that backfills wheels or sdists onto old versions needs to check their pipelines now.