Releases now reject new files after 14 days
Summary
PyPI now rejects new files for releases older than 14 days to reduce the risk of poisoned releases if publishing tokens or workflows are compromised. The change, merged July 8, 2026, is a security safeguard with semantics to be defined later by the Upload 2.0 API and PEP 694, and it references supply-chain incidents involving LiteLLM and Telnyx.