PyPI Blocks New Files on Package Releases Older Than 14 Days
Supply Chain Risk · 3 sources · Updated 3mo ago · First seen Jul 23, 2026
PyPI has begun rejecting uploads of new files to package releases more than 14 days old, a security change designed to make it harder for attackers to poison long-stable versions after compromising a project's publishing token or CI workflow. The policy was driven in part by supply-chain incidents involving the LiteLLM and Telnyx packages, whose March 2026 compromises were tied to a mutable reference in the Trivy GitHub Action.
PyPI maintainers said the operational impact should be limited: analysis found that only 56 of the top 15,000 packages uploaded a Python 3.14-compatible wheel more than 14 days after the original release. The approach gained support during discussions around PEP 740 and at the 2026 Packaging Summit, where participants favored publishing a new package version instead of modifying an older release; the implementation by Seth Larson was merged on July 8.
