精选理由
PyPI 堵了一个安全漏洞：以后你下载的老版本包不会再被偷偷替换成恶意文件了。搞 Python 项目的必须知道。
Python Package Index（PyPI）从即日起拒绝向超过14天的发布版本上传新文件。该限制旨在防止攻击者利用泄露的令牌或工作流对长期稳定的旧版本投毒。PyPI 团队表示目前尚未监测到此类攻击被实际利用，但技术上完全可行。此措施将大幅降低软件供应链中的历史版本被恶意篡改的风险。
原文 · Simon Willison’s Weblog
Quoting Seth Larson
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible. — Seth Larson , PyPI blog Tags: packaging , python , supply-chain , pypi , seth-michael-larson