GitHub, PyPI tighten package supply-chain rules

GitHub and the Python Package Index introduced new policies to limit how quickly package updates and file changes can propagate through software supply chains.

GitHub added a three-day cooldown to Dependabot for non-security version bumps. The automation will wait at least three days after a release is published before opening pull requests, giving maintainers, security researchers and automated scanners time to review new versions. The rule applies only to non-security bumps and can be adjusted in a project’s dependabot.yml configuration. GitHub explained: “Waiting a few days before adopting a new release gives maintainers, security researchers, and automated scanners time to spot a malicious version and get it pulled before it ever reaches your pull requests,” and added that three days was chosen to balance risk and update speed.

PyPI will block uploads of new files to releases older than 14 days once the Upload 2.0 API and Staged Previews are standardized under PEP 694. The registry said the restriction is meant to prevent attackers from appending files to long-stable releases if publishing tokens or automation workflows are compromised. PyPI noted it has not observed abuse of the pattern so far and tied enforcement to the completion of the PEP 694 technical work to avoid breaking existing publishing workflows.

Testing by the registry showed the change will affect a small share of projects: 56 of the top 15,000 packages had published a Python 3.14-compatible wheel more than 14 days after the corresponding release. PyPI expects the restriction to mainly affect projects that routinely add files to older release entries.

Both policies address supply-chain techniques that rely on quickly pushing poisoned package versions or attaching malicious files to older releases. GitHub and PyPI provided configuration and timing details so maintainers can adapt workflows before enforcement begins.