Policy · 49 days ago
GitHub and PyPI are adding friction to supply chain poisoning by making old releases harder to reach. The standard playbook of pulling the newest package immediately now waits out the riskiest window, and that default delay can be changed locally.
GitHub is giving Dependabot a three-day cooldown before it opens pull requests for non-security version bumps, so a bad release has less chance to spread through automated updates before anyone notices. PyPI is blocking new files from being added to releases older than 14 days, which makes it harder to quietly alter a version people already trust as stable.
The result is better containment, not perfect prevention. Teams that rely on immediate automation or still backfill older Python releases now have to treat timing and release immutability as part of their own control surface.
2 sources covering this story
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days.
GitHub, PyPI add time-based defenses against supply chain attacks
GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.
Part of the PlainSec briefing for 2026-07-27