A quote from Seth Larson
2 hours ago
- PyPI now blocks new file uploads to releases older than 14 days.
- This restriction prevents poisoning of old and stable releases in case of compromised tokens or workflows.
- The abuse hasn't been observed yet, but was technically possible without this measure.
- The change was announced by Seth Larson on the PyPI blog on 23rd July 2026.