{
  "id": 18678,
  "title": "New GitHub, PyPI Policies Hope to Boost Supply Chain Security",
  "url": "https://urgent.news/2026/08/01/new-github-pypi-policies-hope-to-boost-supply-chain-security",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-01T17:00:00.000Z",
  "source": {
    "name": "Slashdot",
    "slug": "slashdot",
    "url": "https://developers.slashdot.org/story/26/08/01/0511237/new-github-pypi-policies-hope-to-boost-supply-chain-security"
  },
  "original_language": "en",
  "account": "GitHub and the Python Package Index (PyPI) have implemented new policies to enhance supply chain security, according to SecurityWeek. The move aims to curb the rapid spread of poisoned package versions and safeguard against the contamination of old and long-stable releases. GitHub has introduced a Dependabot cooldown, which delays the opening of pull requests for non-security version bumps by a minimum of three days. This buffer allows maintainers, security researchers, and automated scanners sufficient time to identify and remediate malicious versions before they reach users' pull requests. The three-day cooldown period is a compromise between safeguarding against attacks and not delaying dependency updates unnecessarily.\n\nOn the other hand, PyPI has enacted a rule that disallows new files from being uploaded to releases older than 14 days. This restriction was introduced to thwart the poisoning of old and long-stable releases in situations where publishing tokens or workflows of PyPI projects might be compromised. The decision to enforce this policy emerged from discussions on PEP 740 (Digital Attestations) that commenced in January 2024. The conversation was reignited in March 2026 following the compromise of popular packages LiteLLM and Telnyx due to a \"mutable reference\" in their usage of the Trivy GitHub Action.\n\nTo assess the potential impact of this change on existing workflows, the PyPI database was queried to determine the number of projects that had published new files to old releases beyond 14 days after their availability. The findings revealed that only 56 out of 15,000 projects had complied with the policy. This data prompted a proposal at the Packaging Summit held at PyCon US 2026, where Mike Fiedler, the PyPI Safety & Security Engineer, shared the results with attendees. The consensus among the participants was that requiring users to upgrade to the next version to support new Python versions was a reasonable approach. Following the summit, Seth Larson, the Python Software Foundation's security developer-in-residence, implemented a patch that rejected new files on old releases, which was subsequently merged on July 8th, 2026.",
  "summary": "\"GitHub and the Python Package Index (PyPI) have introduced new policies meant to boost supply chain security,\" reports SecurityWeek, \"by preventing the fast propagation of poisoned package versions and the poisoning of old and long-stable releases.\" To prevent the fast delivery of malicious code through the immediate fetching of brand-new releases, GitHub has introduced a Dependabot cooldown,…",
  "key_points": [
    "GitHub introduces Dependabot cooldown for non-security version bumps",
    "PyPI enforces rule against new files on old releases >14 days",
    "56 of 15,000 projects complied with PyPI policy at PyCon US 2026"
  ],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/18678.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}