DEV TOOLS Signal 107
New GitHub, PyPI Policies Hope to Boost Supply Chain Security
↗
These policies shift the balance of speed versus security, forcing a delay in dependency updates and ending the practice of appending new wheels to old releases. Engineers relying on Dependabot will see slower rollouts of non-critical updates, and Python maintainers must now issue new version bumps for compatibility changes like Python 3.14 support rather than patching old releases.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
GitHub's Dependabot now defaults to waiting three days before opening pull requests for non-security version bumps to let security researchers catch malicious versions.
PyPI now rejects file uploads to releases older than 14 days to prevent the poisoning of stable releases if a project's publishing tokens or workflows are compromised.
Package maintainers must release new versions to support new Python versions like 3.14, as patching older releases is no longer permitted.
THE CLUSTER