Geplante Wartung, Änderungen und Nachrichten der Anbieter. Unter „Demnächst“ steht nur, was die Quelle mit Datum meldet; ein Anbieter ohne Feed hat hier keinen Eintrag, das heißt nicht, dass nichts ansteht.
Nichts mit Datum angekündigt.
PyPI improves on checks for the reputation of an email address when used to register an account or add to an existing account, and rejects addresses identified as disposable. With the new check in place, outlook.com and hotmail.com address…
gemeldet 16. Okt. 2026
Executive summary For about two weeks in August 2026, some PyPI users hit intermittent 502 and 503 errors downloading files from files.pythonhosted.org , triggering failures during installation from PyPI. Thanks to our users filing reports…
gemeldet 8. Sept. 2026
On 2026-08-24 I shipped a change to the configuration that emits PyPI's download logs so that only requests for actual distribution artifacts are counted. A request has to end in .whl , .tar.gz , or .zip to produce a download record. The c…
gemeldet 31. Aug. 2026
Working on infrastructure at the Python Software Foundation (PSF) as the Director of Engineering is a broad job with many hats. Python turns up everywhere. It's in healthcare systems and government agencies, in research labs and classrooms…
gemeldet 14. Aug. 2026
PyPI has adopted PEP 833 , which "freezes" the HTML representation of the index API , which is also sometimes called the "simple API" or the "simple repository API." New packages and releases will continue to appear in the HTML representat…
gemeldet 11. Aug. 2026
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workfl…
gemeldet 22. Juli 2026
Over the next few months, we will be rolling out changes to the PyPI user interface, improving how we surface security signals and updating the pages where users view package details. Updates will be staged to TestPyPI and deployed to prod…
gemeldet 22. Juli 2026
In 2023 PyPI completed its first security audit , and I am proud to announce that we have now completed our second external security audit. This work was funded by the Sovereign Tech Agency , a supporter of Open Source security-related imp…
gemeldet 16. April 2026
This post will drill deeper into two recent supply chain exploits, targeting users of popular PyPI packages - litellm & telnyx . We also provide Python developers and maintainers with guidance on what they can do to prepare and protect the…
gemeldet 2. April 2026
Hello there! I am Maria, the inaugural PyPI Support Specialist. I go by "Thespi-Brain" on GitHub. I wanted to provide a dispatch of how this past year (and a half!) has been regarding my role and PyPI. PyPI has now reached over a million u…
gemeldet 26. Jan. 2026
As 2025 comes to a close, it's time to look back at another busy year for the Python Package Index. This year, we've focused on delivering critical security enhancements, rolling out powerful new features for organizations, improving the o…
gemeldet 31. Dez. 2025
An attack on the npm ecosystem continues to evolve, exploiting compromised accounts to publish malicious packages. This campaign, dubbed Shai-Hulud , has targeted large volumes of packages in the JavaScript ecosystem, exfiltrating credenti…
gemeldet 26. Nov. 2025
We've implemented a new security feature designed to protect PyPI users from phishing attacks: email verification for TOTP-based logins from new devices. What's Changing? Previously, when logging in with a Time-based One-Time Password (TOT…
gemeldet 14. Nov. 2025
Trusted Publishing has proven popular since its launch in 2023 . Recap: Trusted Publishing enables software build platforms to publish packages to PyPI on your behalf, eliminating the need to manage long-lived authentication tokens. After …
gemeldet 10. Nov. 2025
Unfortunately the string of phishing attacks using domain-confusion and legitimate-looking emails continues. This is the same attack PyPI saw a few months ago and targeting many other open source repositories but with a different domain na…
gemeldet 23. Sept. 2025
Summary I recently responded to an attack campaign where malicious actors injected code into GitHub Actions workflows attempting to steal PyPI publishing tokens. PyPI was not compromised, and no PyPI packages were published by the attacker…
gemeldet 16. Sept. 2025
Summary PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets. These changes improve Py…
gemeldet 18. Aug. 2025
PyPI now serves project status markers in its standard index APIs . This allows downstream consumers (like Python package installers and index mirrors) to retrieve project statuses programmatically and use them to inform users when a proje…
gemeldet 14. Aug. 2025
The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from confusion attacks arising from ZIP parser implementations. This has been done in response to the discovery that the popular i…
gemeldet 7. Aug. 2025
Incident Report: Phishing Attack Over the past few days, a phishing attack targeting PyPI users via email was uncovered. Our initial report was posted to raise awareness of the attack, and to provide some initial details on the attack vect…
gemeldet 31. Juli 2025