PyPI blocks file uploads to releases older than 14 days

PyPI now rejects file uploads to any release more than 14 days old, per Seth Larson's write-up covered by Simon Willison. The mechanism is simple. A compromised maintainer account could quietly attach a new wheel or sdist to a release that shipped years ago. Nobody re-audits a pin that old, so every project trusting that version inherits the risk silently.

Version pinning is supposed to be a safety mechanism. This closes the loophole that turned it into a liability.

If you run release automation that backfills wheels or sdists onto older versions, that automation is about to start failing. Willison flags this directly, and the failure won't throw a clear error. It'll just quietly stop uploading, and you'll notice only when a downstream build breaks.

Go check those pipelines now, before the failure finds you.

Two hardening moves, one quarter

This lands the same day GitHub restructured its bug bounty program around researcher experience instead of payout mechanics, according to the GitHub Blog. Different problem, same instinct: package ecosystems and the platforms around them are tightening process, the same quarter agents started publishing packages themselves.

A 14-day upload window on old releases is a small, specific control. It fits a world where the thing checking a release before install might not be a person.