PyPI closes a supply chain gap, but the real problem is upstream

PyPI announced that releases will now reject new files added to a release after 14 days. The stated goal is to close a supply chain attack vector where a legitimate old release could be quietly updated with malicious files long after users stopped watching it. The PyPI team queried their database to assess how disruptive this would be before shipping it.

Commenters were broadly supportive but pointed at the deeper problem: hash pinning. The argument is that modern software ecosystems have regressed on something the community figured out twenty years ago, and that mutable releases are a symptom of that regression. The 'start and finish' release model one commenter proposed is essentially what locked lockfiles enforce at the consumer side.

The thread also surfaced a related supply chain security project, npm-scan, which is doing similar hygiene work for the npm ecosystem. The pattern across both ecosystems is the same: default trust in package contents is eroding, and maintainers are scrambling to add guardrails after the fact.