PyPI now rejects new files after 14 days
The Python Package Index (PyPI) will now reject new files that are uploaded to releases older than 14 days to prevent the poisoning of old releases if publishing tokens or workflows of PyPI projects are compromised.
Intelligence analysis by Llama
PyPI has implemented a 14-day restriction on new file uploads to prevent the poisoning of old releases. This change aims to prevent the compromise of publishing tokens or workflows of PyPI projects.
Imagine you have a package manager that lets you update packages without changing the version number. This can lead to confusion and security issues. PyPI has implemented a 14-day restriction on new file uploads to prevent this. This means that if you try to update a package more than 14 days after it was released, PyPI will reject the update.
Analysis
A $60B Vote of Confidence
The decision to reject new files after 14 days is a significant step towards improving the security of PyPI. This change is a response to the recent compromise of popular packages LiteLLM and Telnyx, which were affected by a mutable reference in their usage of the Trivy GitHub Action. The discussion around this behavior began during PEP 740 (Digital Attestations) in January 2024 and was restarted in March 2026 after the LiteLLM compromise. The PyPI database was queried for projects that have published new files to old releases, revealing that only 56 projects of 15,000 had published a 3.14-compatible wheel more than 14 days after a release was available. This change is expected to prevent the poisoning of old releases if publishing tokens or workflows of PyPI projects are compromised.
Why Cursor?
The 14-day restriction is a middle step towards making releases immutable. This change is aimed at preventing the compromise of old releases, which could lead to security issues. The discussion around this behavior has been ongoing, and the recent compromise of LiteLLM and Telnyx has highlighted the need for this change. The PyPI team has implemented this change to ensure that old releases are not compromised, which could lead to security issues.
The Road Ahead
The implementation of the 14-day restriction is a significant step towards improving the security of PyPI. This change is expected to prevent the poisoning of old releases if publishing tokens or workflows of PyPI projects are compromised. The PyPI team will continue to monitor the situation and make necessary changes to ensure the security of PyPI.
Key points
- PyPI will reject new files that are uploaded to releases older than 14 days
- This change is aimed at preventing the compromise of old releases
- The 14-day restriction is a middle step towards making releases immutable
- The PyPI team will continue to monitor the situation and make necessary changes
This change is expected to improve the security of PyPI and prevent the poisoning of old releases. It will also encourage developers to update their packages regularly, which will lead to a more secure and reliable package manager.
The 14-day restriction may cause inconvenience to developers who are used to updating their packages without changing the version number. It may also lead to a decrease in the number of packages being updated regularly, which could have negative consequences for the Python community.