- PyPI now rejects new file uploads to releases older than 14 days to prevent poisoning of old releases in case of compromised tokens or workflows.
- The restriction has not been abused yet but there was no technical barrier preventing it.
- Users should not rely on this behavior as semantics for 'closed' releases and APIs are not yet defined; they will be standardized under PEP 694 (Upload 2.0 API and Staged Previews).
- The discussion started during PEP 740 in January 2024 and was restarted in March 2026 after compromises of LiteLLM and Telnyx due to a mutable reference in the Trivy GitHub Action.
- To gauge disruption, PyPI database queries showed that only 56 of the top 15,000 packages had published a Python 3.14 wheel more than 14 days after the release.
- The Packaging Summit at PyCon US 2026 reached rough consensus that requiring users to bump versions for new Python support was acceptable, leading to a patch merged on July 8, 2026.
- This change protects users, reduces cleanup work for PyPI admins, and prevents releases from being in an indeterminate state where only some files are compromised.
- The work by Seth Larson and Mike Fiedler is supported by Alpha-Omega.