--- title: PyPI now rejects new files after 14 days | daily.dev description: PyPI now rejects file uploads to releases older than 14 days. The change was driven by supply chain security concerns, specifically incidents where LiteLLM and... canonical: https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PyPI now rejects new files after 14 days | daily.dev og:description: PyPI now rejects file uploads to releases older than 14 days. The change was driven by supply chain security concerns, specifically incidents where LiteLLM and... og:url: https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1 og:image: https://api.daily.dev/og/posts/7wiqqz6y1.png og:image:alt: PyPI now rejects new files after 14 days og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PyPI now rejects new files after 14 days **[LWN.net](https://daily.dev/sources/lwn)** · 2 min read · 3 upvotes · 0 comments ## Summary PyPI now rejects file uploads to releases older than 14 days. The change was driven by supply chain security concerns, specifically incidents where LiteLLM and Telnyx packages were compromised via a mutable reference in the Trivy GitHub Action, allowing attackers to poison old releases using stolen publishing tokens. The restriction was initially delayed due to concerns about workflows that add new Python version wheels to existing releases, but analysis of the PyPI database showed only 56 of the top 15,000 packages had published cp314 wheels more than 14 days after a release — making the impact minimal. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't I upload a new file to an old PyPI release anymore? PyPI now rejects new file uploads to any release older than 14 days. The Python Software Foundation implemented this to prevent attackers from poisoning old releases if a project's publishing tokens or CI workflows are compromised. The change followed compromises of the LiteLLM and Telnyx packages caused by a mutable reference in their Trivy GitHub Action usage. _Track supply chain policy changes like PyPI's upload restrictions on daily.dev before they break your release pipeline._ ### Will PyPI's 14-day upload restriction break my workflow for adding new Python version wheels to old releases? Unlikely for most projects. PyPI queried the top 15,000 packages and found only 56 had published a Python 3.14-compatible wheel more than 14 days after the original release, so the vast majority of projects already comply with the new 14-day window for adding files to existing releases. _Maintainers weighing packaging workflow changes can follow PyPI policy shifts like this on daily.dev._ ### What caused the LiteLLM and Telnyx package compromises on PyPI? Both packages were compromised due to a mutable reference in their usage of the Trivy GitHub Action, which allowed attackers to inject malicious code into the projects' release process. This incident, along with earlier PEP 740 discussions, prompted PyPI to restart work on restricting late uploads to existing releases. _Developers hardening CI/CD pipelines against supply chain attacks can follow incidents like this on daily.dev._ ## Similar posts on daily.dev - [Pip 26.1 Ships Dependency Cooldowns and Experimental Lockfile Support to Combat Supply Chain Attacks](https://daily.dev/posts/pip-26-1-ships-dependency-cooldowns-and-experimental-lockfile-support-to-combat-supply-chain-attacks-j2wgrl3af) · InfoQ · 1 upvotes · 0 comments - [GitHub Actions security in Python packages](https://daily.dev/posts/github-actions-security-in-python-packages-ngn5b2ads) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PyPI now rejects new files after 14 days","url":"https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1"},"datePublished":"2026-07-22T16:10:04.179Z","dateModified":"2026-09-13T21:06:23.829Z","description":"PyPI now rejects file uploads to releases older than 14 days. The change was driven by supply chain security concerns, specifically incidents where LiteLLM and...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"LWN.net","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LWN.net","logo":"https://media.daily.dev/image/upload/s--4jjE7GIK--/f_auto,q_auto/v1774960833/logos/lwn?_a=BAMAMiWQ0","url":"https://daily.dev/sources/lwn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LWN.net","item":"https://daily.dev/sources/lwn"},{"@type":"ListItem","position":3,"name":"PyPI now rejects new files after 14 days"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pypi-now-rejects-new-files-after-14-days-7wiqqz6y1#faq","mainEntity":[{"@type":"Question","name":"Why can't I upload a new file to an old PyPI release anymore?","acceptedAnswer":{"@type":"Answer","text":"PyPI now rejects new file uploads to any release older than 14 days. The Python Software Foundation implemented this to prevent attackers from poisoning old releases if a project's publishing tokens or CI workflows are compromised. The change followed compromises of the LiteLLM and Telnyx packages caused by a mutable reference in their Trivy GitHub Action usage. Track supply chain policy changes like PyPI's upload restrictions on daily.dev before they break your release pipeline."}},{"@type":"Question","name":"Will PyPI's 14-day upload restriction break my workflow for adding new Python version wheels to old releases?","acceptedAnswer":{"@type":"Answer","text":"Unlikely for most projects. PyPI queried the top 15,000 packages and found only 56 had published a Python 3.14-compatible wheel more than 14 days after the original release, so the vast majority of projects already comply with the new 14-day window for adding files to existing releases. Maintainers weighing packaging workflow changes can follow PyPI policy shifts like this on daily.dev."}},{"@type":"Question","name":"What caused the LiteLLM and Telnyx package compromises on PyPI?","acceptedAnswer":{"@type":"Answer","text":"Both packages were compromised due to a mutable reference in their usage of the Trivy GitHub Action, which allowed attackers to inject malicious code into the projects' release process. This incident, along with earlier PEP 740 discussions, prompted PyPI to restart work on restricting late uploads to existing releases. Developers hardening CI/CD pipelines against supply chain attacks can follow incidents like this on daily.dev."}}]} ```