PyPI now blocks adding new files to releases older than 14 days — a supply-chain hardening move

The Python Package Index announced on July 22 that a release more than 14 days old no longer accepts new file uploads. The change limits the damage when a maintainer's publishing token or CI pipeline is compromised: attackers can no longer quietly slip a malicious file into an old, trusted release. An audit of the top 15,000 packages found only 56 legitimate late uploads would have been affected.

What it means Python teams with slow multi-platform build pipelines should confirm all their wheels publish within 14 days; everyone else just got a safer dependency chain.