GitHub and PyPI have rolled out new measures to reduce supply chain attacks by slowing the spread of poisoned package releases and blocking tampering with older stable versions. GitHub’s Dependabot now waits three days before opening pull requests for new non-security releases, while PyPI restricts new file uploads to releases older than 14 days to protect against compromise. #GitHub #Dependabot #PyPI #PEP694
Keypoints
- GitHub added a Dependabot cooldown for new releases.
- The cooldown waits at least three days before opening pull requests.
- PyPI blocks new file uploads to releases older than 14 days.
- The PyPI change helps prevent poisoning of long-stable releases.
- Both updates aim to reduce supply chain attack risk and simplify incident cleanup.
Read More: https://www.securityweek.com/new-github-pypi-policies-boost-supply-chain-security/