--- title: Releases now reject new files after 14 days | daily.dev description: PyPI now rejects new files uploaded to releases older than 14 days. The change was introduced to prevent supply chain attacks where compromised publishing... canonical: https://daily.dev/posts/releases-now-reject-new-files-after-14-days-ffu4ottta twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Releases now reject new files after 14 days | daily.dev og:description: PyPI now rejects new files uploaded to releases older than 14 days. The change was introduced to prevent supply chain attacks where compromised publishing... og:url: https://daily.dev/posts/releases-now-reject-new-files-after-14-days-ffu4ottta og:image: https://api.daily.dev/og/posts/Ffu4OTtTa.png og:image:alt: Releases now reject new files after 14 days og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Releases now reject new files after 14 days **[Lobsters](https://daily.dev/sources/lobsters)** · 3 min read · 0 upvotes · 0 comments ## Summary PyPI now rejects new files uploaded to releases older than 14 days. The change was introduced to prevent supply chain attacks where compromised publishing tokens or workflows could be used to poison stable, long-published releases with malware. The decision followed real-world incidents involving LiteLLM and Telnyx packages, and data analysis showing only 56 of the top 15,000 packages had published new Python 3.14-compatible wheels more than 14 days after a release. Consensus at PyCon US 2026's Packaging Summit supported requiring version bumps for new Python version support instead. Future Upload 2.0 API work will formalize semantics for 'closed' releases. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 2 discussions and 10 comments across lobsters, hackernews (as of 2026-07-28). **TL;DR:** The community broadly supports PyPI's new 14-day upload window as a sensible security measure, though some are surprised it wasn't policy sooner and there's nuanced discussion about the historical reasons releases were mutable in the first place. **Sentiment:** 60% positive · 30% mixed · 10% skeptical **The case for** - The change closes a real supply chain attack vector where compromised tokens could poison stable, long-published releases. - Requiring a version bump for new platform support is seen as the cleaner, more principled approach. **The pushback** - Some packages may face pain around new Python releases if their release process makes cutting a new version burdensome. - Pushing a new version (rather than adding a wheel) invalidates lockfiles for all consumers, which is a non-additive downstream impact. **By community** - lobsters (positive): Commenters are broadly supportive, mostly surprised the restriction didn't exist sooner, with substantive technical discussion about why releases were historically mutable (multi-platform wheel uploads across different build machines and Python versions). - hackernews (mixed): No comments were available to assess sentiment. **Hottest debate:** Whether requiring a new version bump for additional wheel uploads is preferable to extending the upload window, given that version bumps invalidate lockfiles for all downstream consumers. **Open questions** - How will the Upload 2.0 API formalize 'closed' release semantics and improve the multi-platform wheel upload workflow? - What accommodations exist for packages with heavy release processes that need to add platform wheels after 14 days? **Highlights** > There’s a subtlety here: PyPI releases are mutable, but only in an additive sense: you could previously add new distributions (sdists/wheels) to an existing release long after that release was made, but you *couldn’t* modify existing distributions under that release. That additive property is a logical consequence of how Python has evolved: releases were atomic when they just consisted of sdists, but they can now contain many wheel flavors as well. The consequence of that in turn is that uploads now take N requests instead of 1, and nobody (until now) considered it important to limit the timespan under which those requests could take place. (This too will change for the better when the “Upload 2.0” API is finished.) > — [yossarian on lobsters · 2 points, 1 comments](https://lobste.rs/s/53g8f7/pypi_releases_now_reject_new_files_after#c_li4vt0) > That's because in the past before stable ABI it meant that when a new Python release came around you could not install binary distributions of extensions for those versions. So people appended more binary releases for newer Python versions to already existing popular versions of of older libraries. That is less and less necessary today, but I do expect that this will be somewhat painful for some packages around new Python releases. > — [mitsuhiko on lobsters · 10 points, 1 comments](https://lobste.rs/s/53g8f7/pypi_releases_now_reject_new_files_after#c_88jkaq) > There is not a big difference between uploading a new wheel for an existing release or making a new release. The difference is the downstream impact on consumers. If you are pushing a version, you are changing things which invalidates lockfiles for all versions and is non additive. > — [mitsuhiko on lobsters · 2 points](https://lobste.rs/s/53g8f7/pypi_releases_now_reject_new_files_after#c_7afbrl) > Personally, I'm surprised PyPI releases are mutable in the first place... > — [realkc on lobsters · 19 points, 3 comments](https://lobste.rs/s/53g8f7/pypi_releases_now_reject_new_files_after#c_bdlfhc) **Source threads** - [lobsters](https://lobste.rs/s/53g8f7/pypi_releases_now_reject_new_files_after) · 40 points · 10 comments - [hackernews](https://news.ycombinator.com/item?id=49007291) · 13 points · 0 comments ## Similar posts on daily.dev - [Pip 26.1 Ships Dependency Cooldowns and Experimental Lockfile Support to Combat Supply Chain Attacks](https://daily.dev/posts/pip-26-1-ships-dependency-cooldowns-and-experimental-lockfile-support-to-combat-supply-chain-attacks-j2wgrl3af) · InfoQ · 1 upvotes · 0 comments - [A New Python Packaging Council and Other News for May 2026 – Real Python](https://daily.dev/posts/a-new-python-packaging-council-and-other-news-for-may-2026-real-python-j4ikhcce9) · Real Python · 0 upvotes · 0 comments - [Python package security in 2026](https://daily.dev/posts/python-package-security-in-2026-caqcr90if) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/releases-now-reject-new-files-after-14-days-ffu4ottta) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Releases now reject new files after 14 days","url":"https://daily.dev/posts/releases-now-reject-new-files-after-14-days-ffu4ottta","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/releases-now-reject-new-files-after-14-days-ffu4ottta"},"datePublished":"2026-07-23T00:08:36.339Z","dateModified":"2026-07-28T19:15:34.370Z","description":"PyPI now rejects new files uploaded to releases older than 14 days. The change was introduced to prevent supply chain attacks where compromised publishing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef9e06f0cf271962c51df6d6f3d0f920?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef9e06f0cf271962c51df6d6f3d0f920?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/releases-now-reject-new-files-after-14-days-ffu4ottta","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Releases now reject new files after 14 days"}]} ```