Quoting Seth Larson
- ID
- 7098
- Status
- summarized
- Published
- 23 Jul 2026, 12:50 PM
- Fetched
- 23 Jul 2026, 1:40 PM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Jul/23/seth-larson/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 7.5
- Created
- 23 Jul 2026, 1:40 PM
- Tags
- Audience
- developersvibe_coders
What happened
PyPI now rejects new file uploads to releases older than 14 days, closing a supply-chain attack vector where compromised tokens could poison long-stable package versions. Seth Larson notes this abuse hasn't been observed yet but was technically possible. The change is a preventive hardening of Python's package infrastructure.
Why it matters
For Malaysian developers and teams shipping Python packages or relying on PyPI in CI/CD, this changes how you handle late patches and re-publishes. If you maintain packages, plan releases within the 14-day window or use new version numbers for older fixes. It also reinforces why supply-chain hygiene—token rotation, scoped permissions, and release workflows—matters for any local startup or team building on open-source ecosystems.
Discussion angle
How should Malaysian dev teams audit their own package publishing workflows and CI/CD pipelines to avoid getting bitten by similar supply-chain restrictions or attacks?