PyPI stops accepting late file uploads to releases older than 14 days
PyPI now rejects new file uploads against any release older than 14 days, closing off a small but useful window that a compromised publishing token…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
- игры
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Dependabot's Three-Day Cooldown Needs an Explicit Exception Policy
GitHub announced on July 14, 2026 that Dependabot now waits until a release has been available on its registry for at least three days before openin…
Dependabot learns to wait: version-update PRs now sit for three days by default
Every time your bot merges a two-hour-old release into main, you are trusting a stranger's freshly published tarball to be the same one everyone els…
Innersource security advisories go GA: a private channel for private vulns
Your platform team ships an internal package. Half the org pulls it. Someone finds a bug that in the wrong hands is a full RCE. What do you do next:…
Dependabot can finally pull from private GitHub Packages without a PAT
The first time I wired Dependabot up to a private package registry, it took three meetings and a calendar reminder set six months ahead. The reminde…