Re:PyPI Blog: Releases now reject new files after 14 days
by etbebl on Saturday July 25, 2026 @02:35PM
(#49050296)
I'm learning here, but for option 2, besides the security risk, doesn't this create the possibility that users could get a broken/unfinished package any time they're updating to a recently "published" release? The property of releases being atomic seems very important.
[ Parent
| on HN ]
Re:PyPI Blog: Releases now reject new files after 14 days
by akerl_ on Saturday July 25, 2026 @02:40PM
(#49050349)
Generally each artifact in the release is atomic, as is (and was) the case here.
You’ll never get served a partially uploaded wheel for amd64 Linux, but somebody could come back a year later and add a 2nd wheel to that release for a different architecture.