Simon Willison
PyPI 实施新安全限制，拒绝上传超过14天的旧版本文件，以防止发布令牌或工作流被攻陷后投毒旧版本
AI 摘要
PyPI 实施新安全限制，拒绝上传超过14天的旧版本文件，以防止发布令牌或工作流被攻陷后投毒旧版本。
推荐理由常规快讯，保留列表
原文
23rd July 2026
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.
— Seth Larson, PyPI blog
53/100
讨论
暂无评论。