The Python Package Index (PyPI) has rolled out a new security restriction that rejects file uploads to any release older than 14 days.
Announced by Seth Larson, the change aims to close a long-standing gap that let attackers poison stable, previously published releases if publishing credentials or CI/CD workflows were compromised.
Previously, PyPI allowed maintainers to add new files to releases indefinitely, even years after initial publication.
PyPI Blocks Files on 14-Day-Old Releases
This “open-ended” model meant a compromised token or workflow could inject malicious files into a release that users had already trusted and installed from, without triggering a new version number.
While PyPI says there’s no confirmed case of this specific attack vector being exploited yet, officials noted there was “no technical reason beyond attackers weren’t aware it was possible” to abuse it.
The 14-day cutoff removes that lingering attack surface. Once a release passes two weeks old, its file list is effectively frozen, closing the window for silent, retroactive tampering.
The push for this restriction traces back to PEP 740 (Digital Attestations) discussions in January 2024, but stalled until a March 2026 supply-chain incident reignited urgency.
Popular packages LiteLLM and Telnyx were compromised via a “mutable reference” vulnerability in their use of the Trivy GitHub Action, exposing exactly the kind of retroactive-poisoning risk this policy addresses.
Before implementing the change, PyPI needed to confirm it wouldn’t break legitimate workflows, particularly maintainers who added wheels for new Python versions to existing releases rather than publishing fresh versions. The team analyzed usage patterns:
- Queried the PyPI database for projects publishing new files to old releases, bucketed by days since release
- Specifically examined cp314 wheel uploads across the top 15,000 packages
- Found only 56 of 15,000 projects had published a Python 3.14–compatible wheel more than 14 days after the original release
The findings were presented at the Packaging Summit at PyCon US 2026 by PyPI Safety & Security Engineer Mike Fiedler, where attendees reached rough consensus that requiring a version bump for new Python-version support was an acceptable tradeoff for the security benefit.
With data and community consensus in hand, Larson merged the patch on July 8, 2026. Notably, PyPI cautions that this behavior shouldn’t yet be relied upon programmatically, since there’s no formal API or defined semantics confirming a release’s “closed” state.
That clarity is expected to arrive with PEP 694’s “Upload 2.0 API” and “Staged Previews” features.
Once a release ages past 14 days, its contents are locked, giving PyPI admins clearer incident response boundaries and giving users more confidence in packages they’ve already installed.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 has rolled out a new security restriction that rejects file uploads to any release older than 14 days.){kind=link}