GitHub and PyPI Introduce Policies to Reduce Software Supply Chain Risk
Summary
GitHub added a default three-day Dependabot cooldown for non-security updates. PyPI plans to block new file uploads to releases older than 14 days to reduce the risk of package poisoning.
Key points
- GitHub's Dependabot cooldown waits at least three days after a release before opening a pull request for a non-security version update.
- The cooldown can be changed through the dependabot.yml configuration.
- PyPI plans to block new file uploads to releases more than 14 days old, reducing the risk of attackers poisoning long-stable releases after compromising publishing tokens or workflows.
- PyPI says the restriction will take effect after the Upload 2.0 API and Staged Previews are standardized by PEP 694.
- PyPI testing found that 56 of the top 15,000 packages published a 3.14-compatible wheel more than 14 days after a release became available.
Article Details
- Event Type
- Supply-chain security policy changes
- Impact
- GitHub introduced a three-day Dependabot cooldown for non-security dependency updates, giving maintainers and scanners time to detect potentially malicious releases before pull requests are opened. PyPI plans to block new files from being uploaded to releases older than 14 days once the relevant standards are in place, reducing the risk of poisoning long-stable releases and making compromised releases easier to distinguish. PyPI says it is not aware of this restriction addressing any prior abuse.
Vendors
GitHubGitHub and the Python Package Index (PyPI) have introduced new policies meant to boost supply chain security by preventing the fast propagation of poisoned package versions and the poisoning of old and long-stablePyPIGitHub and the Python Package Index (PyPI) have introduced new policies meant to boost supply chain security by preventing the fast propagation of poisoned package versions and the poisoning of old and long-stable
Products
Dependabotof malicious code through the immediate fetching of brand-new releases, GitHub has introduced a Dependabot cooldown, where the automation tool waits for at least three days after a release has been publishedPython Package Index (PyPI)GitHub and the Python Package Index (PyPI) have introduced new policies meant to boost supply chain security by preventing the fast propagation of poisoned package versions and the poisoning of old and long-stable