GitHub, PyPI add time-based defenses against supply chain attacks

2026-07-27

GitHub and PyPI have introduced time-based defenses against supply-chain attacks. Dependabot now applies a default three-day cooldown before dependency update pull requests, while PyPI rejects new files added to releases older than 14 days. The changes follow recent high-profile package attacks and aim to shrink the window for adopting or poisoning malicious packages.