GitHub and PyPI are adding friction to supply chain poisoning by making old releases harder to reach. The standard playbook of pulling the newest package immediately now waits out the riskiest window, and that default delay can be changed locally.
GitHub is giving Dependabot a three-day cooldown before it opens pull requests for non-security version bumps, so a bad release has less chance to spread through automated updates before anyone notices. PyPI is blocking new files from being added to releases older than 14 days, which makes it harder to quietly alter a version people already trust as stable.
The result is better containment, not perfect prevention. Teams that rely on immediate automation or still backfill older Python releases now have to treat timing and release immutability as part of their own control surface.