Summary & Key Takeaways ​

• PyPI now prevents new files from being uploaded to releases older than 14 days.
• This restriction aims to protect stable releases from potential compromise.
• The measure addresses a vulnerability where publishing tokens could be abused.
• While not yet exploited, the technical possibility existed.

Our Commentary ​

This is a smart move by PyPI. We've seen too many supply chain attacks lately, and locking down old releases feels like a no-brainer. It's a proactive step, which I appreciate. It makes me wonder what other package managers are doing to prevent similar issues. The idea of an attacker poisoning a long-stable dependency is just... unsettling.