As cited
Copy frozen at (site build).
vulnerabilities
PyPI hardens package security with new upload restrictions
The Python Package Index (PyPI) now blocks uploads of new files to releases that are more than 14 days old, preventing attackers from modifying established versions if they compromise a project's publishing credentials. The change reduces the risk of poisoning stable releases and simplifies recovery procedures for project maintainers and PyPI administrators. This restriction prevents releases from entering a state where they could be both compromised and uncompromised simultaneously.
Why it matters: Python developers and maintainers should understand this new upload restriction to avoid failed deployment attempts on older releases and to benefit from improved protection against supply chain attacks through compromised publishing tokens.
- Source published
- First seen by Cybersecurity Tracker