PyPI blocks uploads to releases older than two weeks to foil supply‑chain attacks
PyPI now refuses any new files added to releases that are over 14 days old. The move caps a supply‑chain attack vector: compromised publishing tokens or CI pipelines can no longer poison long‑standing releases. No abuse reported yet, but the policy tightens Python’s package security.