---
title: "PyPI Implements 14-Day Upload Window to Prevent Supply Chain Poisoning"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Jul/23/seth-larson/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_e36aa4d640d1bfa566ce427c"
published: "2026-07-23T04:50:36.000Z"
score: 80
channel: "tech"
tags: ["PyPI","Python","Upload Restriction","supply chain security"]
---

# PyPI Implements 14-Day Upload Window to Prevent Supply Chain Poisoning

## AI commentary

> This is a critical message for the Python ecosystem. If you maintain any PyPI project, check your release workflow immediately — the 14-day window means you can no longer patch or overwrite files on old releases; you must publish a new version. For security teams, this is a best practice in supply chain security worth emulating by other package managers.

## At a glance

The Python Package Index (PyPI) now rejects file uploads to releases older than 14 days. This restriction prevents poisoning of long-stable releases via compromised publishing tokens or workflows. No known exploitation has occurred, but attackers were previously unaware of the possibility. The measure strengthens Python software supply chain security.

## Key points

- PyPI prohibits uploading new files to releases older than 14 days.
- The measure prevents poisoning of long-stable releases due to credential leaks.
- No known exploitation has occurred, but the technical possibility existed.
- Enhances PyPI's defense against supply chain attacks.

## Full text

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible. — Seth Larson, PyPI blog Tags: packaging, python, supply-chain, pypi, seth-michael-larson

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_e36aa4d640d1bfa566ce427c