PyPI Hardens Package Security by Restricting Uploads to Recent Releases
The Python Package Index (PyPI) now prevents new files from being uploaded to releases older than 14 days, a move designed to thwart supply-chain attacks that compromise older, trusted packages.
The Python Package Index (PyPI), the central repository for Python software packages, has implemented a significant security enhancement aimed at protecting the vast ecosystem of Python users from supply-chain attacks. Effective immediately, PyPI will reject any attempts to upload new files to package releases that are older than 14 days. This measure is specifically designed to prevent attackers from compromising project publishing tokens or release workflows and subsequently injecting malicious code into long-established, trusted package versions.
According to Seth Larson, Security Developer-in-Residence at the Python Software Foundation, this change is crucial for safeguarding Python users and reducing the burden on PyPI administrators. "This restriction also means that compromises don’t put releases into an indeterminate and confusing state of both 'compromised' and 'not compromised', where only a subset of files could be poisoned with malware," Larson explained. Previously, a compromised release could lead to a situation where some files were legitimate while others contained malware, creating ambiguity and complicating cleanup efforts.
While PyPI has not historically defined specific semantics for releases that cease accepting new files, nor provided an API to ascertain a release's status, the project intends to address these aspects following the standardization of the Upload 2.0 API and Staged Previews under PEP 694. This PEP proposes an extensible API for uploading files to a Python package index, which will likely pave the way for more robust release management and status reporting.
The proposal for this 14-day upload restriction gained traction following discussions around PEP 740 (Digital Attestations) in early 2024. It was further spurred by the March 2026 compromise of the LiteLLM and Telnyx packages, which were affected by a mutable reference in their use of the Trivy GitHub Action. This incident highlighted the risks associated with mutable release artifacts.
Initially, the restriction was postponed due to concerns that some legitimate projects might update older releases to add support for newer Python versions. However, an analysis conducted by the PyPI team revealed this practice to be rare. Among the top 15,000 most popular packages, only 56 were found to have uploaded a wheel compatible with Python 3.14 more than 14 days after the original release date. This data suggests that the new policy will have a minimal impact on the majority of projects.
Mike Fiedler, a PyPI Safety & Security Engineer, initially proposed the change. It received substantial support during discussions at the 2026 Packaging Summit, where a consensus emerged that projects should instead publish a new package version when adding support for newer Python releases, rather than modifying existing ones. Larson subsequently implemented the change, with the patch being merged into the PyPI codebase on July 8, 2026.
This proactive measure by PyPI is a critical step in fortifying the software supply chain against increasingly sophisticated attacks. By limiting the mutability of older releases, PyPI significantly reduces the attack surface for threat actors seeking to inject malware into widely used libraries, thereby enhancing the overall security and integrity of the Python ecosystem.