The PyPI (Python Package Index) repository has implemented a new rule prohibiting the uploading of new files to releases that have been published for over 14 days. This decision was made in an effort to prevent any malicious changes from being made to already published releases in case access tokens are leaked or the package publishing processes are compromised in PyPI.
Originally, this restriction was proposed to be enforced in January 2024, but it was not approved due to concerns raised by some projects. These projects argued that they needed the flexibility to add support for new versions of Python to already published releases. According to data, out of the 15 thousand most popular packages, changes were typically made 14 days after the release by only 56 projects.
After facing resistance, the proposal was brought up for discussion for the second time in March of this year. This decision came after the replacement of releases for the LiteLLM and Telnyx libraries, which had a combined total of 95 million and 756 thousand downloads per month. The implementation of this ban on uploading new files is aimed at ensuring the integrity and security of Python packages on the PyPI repository.