PyPI Now Refuses New Files on Releases Older Than 14 Days
PyPI now rejects new file uploads to any release older than 14 days, to stop old and long-stable releases from being poisoned if a project's publishing tokens or workflows are later compromised.
What it is
A policy change on the Python Package Index, described by security engineer Seth Larson and quoted via Simon Willison, implemented through a Warehouse pull request.
What it does
Blocks any new file upload to a release once it is more than 14 days old, closing off a supply-chain attack where a compromised publishing token or CI workflow could quietly add a malicious file to an already-trusted, long-stable release.
Why it matters
PyPI says this specific abuse hasn't been observed yet, only that nothing technical was stopping it; closing the hole before it gets exploited is exactly the kind of preventative move that rarely makes headlines until it works.
How to use it
If you maintain packages on PyPI, treat releases as effectively frozen after 14 days: plan point releases for fixes instead of relying on late file additions to an existing release.
The ROI Math on Reverse-Engineering Your Smart Home Just Flipped
Simon Willison observes that coding agents have lowered the cost of reverse-engineering and automating undocumented home devices enough to change the underlying ROI calculation.
A Claude Code Team Fireside Chat, Full Transcript and Video
Simon Willison published video and an annotated transcript of a fireside chat with Anthropic's Cat Wu and Thariq Shihipar covering Claude Code security, evals, and tool design.
Claude Fable 5 Goes Permanent for Max and Team Plans on July 20
Anthropic will make Claude Fable 5 a permanent part of Max and Team Premium plans starting July 20, 2026, at 50% of usage limits, with Pro and Team Standard users getting a one-time $100 credit.