Claim◆Article
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days.
PyPI has implemented a policy that blocks new file uploads to any release that is more than 14 days old, as a security measure. ✦ AI generated
Seth Larson · Simon Willison's Weblog · 2026-07-23 · original ↗
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days.
Read full article ↗excerpt · fair-use quotation
- ·PyPI now rejects new file uploads to releases older than 14 days
- ·Policy acts as a security measure against malicious uploads
- ·Applies to all packages on the Python Package Index
- ·Prevents attackers from backdooring old, stable releases
- ·Limits the window for retroactive malicious file injection
- ·Encourages proper versioning for security patches
Around this claim
This moment responds to
provides context → The goal of this recipe is to use Python tools in GitHub Actions without every workflow run hitting PyPI to download a fresh copy of the tool and its dependencies.Simon Willison · Simon Willison's Weblogextends → Setting UV_EXCLUDE_NEWER to a specific date makes uvx tool-name resolve to the most recent tool version available as of that date, and the cache can be busted and tools upgraded simply by bumping that date later.Simon Willison · Simon Willison's Weblogprovides context → As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.Seth Larson · Simon Willison's Weblog