PyPI now rejects new files after 14 days
5 hours ago
- PyPI now rejects new files uploaded to releases older than 14 days to prevent poisoning of old releases if publishing tokens or workflows are compromised.
- The policy discussion began during PEP 740 (Digital Attestations) in January 2024 and was restarted after the LiteLLM and Telnyx packages were compromised in March 2026 due to a mutable reference in the Trivy GitHub Action.
- Some projects relied on the ability to add support for new Python versions to already-published releases, but a PyPI database query showed only 56 of the top 15,000 packages published a 3.14-compatible wheel more than 14 days after a release.