# PyPI 实施新安全限制，拒绝上传超过14天的旧版本文件，以防止发布令牌或工作流被攻陷后投毒旧版本

- 来源：Simon Willison
- 发布时间：2026-07-23 12:50
- AIWatch 分数：53
- AIWatch 标记：未精选
- AIWatch 链接：https://aiwatch.icu/events/evt_01ky6sd65148tv85nnq3yp1bq1
- 原文链接：https://simonwillison.net/2026/Jul/23/seth-larson/#atom-everything

## 精选理由

常规快讯，保留列表

## AI 摘要

PyPI 实施新安全限制，拒绝上传超过14天的旧版本文件，以防止发布令牌或工作流被攻陷后投毒旧版本。

## 正文

23rd July 2026

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.

— Seth Larson, PyPI blog