Skip to content

Accept All すべて承認

PyPI Blog

20 stories

PyPI BlogLanguagesChecking email reputation, and allowing Outlook again PyPI improves on checks for the reputation of an email address when used to register an account or add to an existing account, and rejects addresses identified as disposable.

PyPI BlogLanguagesIncident Report: File Hosting Errors Executive summary For about two weeks in August 2026, some PyPI users hit intermittent 502 and 503 errors downloading files from files.pythonhosted.org , triggering failures during installation from…

PyPI BlogLanguagesMetadata requests no longer tracked in PyPI download counts On 2026-08-24 I shipped a change to the configuration that emits PyPI's download logs so that only requests for actual distribution artifacts are counted.

PyPI BlogLanguagesHow AWS Powers PyPI and the PSF Working on infrastructure at the Python Software Foundation (PSF) as the Director of Engineering is a broad job with many hats. Python turns up everywhere.

PyPI BlogLanguagesThe HTML representation of the index API is now frozen PyPI has adopted PEP 833 , which "freezes" the HTML representation of the index API , which is also sometimes called the "simple API" or the "simple repository API." New packages and releases will…

PyPI BlogLanguagesReleases now reject new files after 14 days The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days.

PyPI BlogLanguagesPlanned Updates to the PyPI User Interface Over the next few months, we will be rolling out changes to the PyPI user interface, improving how we surface security signals and updating the pages where users view package details.

PyPI BlogLanguagesPyPI has completed its second audit In 2023 PyPI completed its first security audit , and I am proud to announce that we have now completed our second external security audit.

PyPI BlogLanguagesIncident Report: LiteLLM/Telnyx supply-chain attacks, with guidance This post will drill deeper into two recent supply chain exploits, targeting users of popular PyPI packages - litellm & telnyx .

PyPI BlogLanguagesDispatch from PyPI Land: A Year (and a Half!) as the Inaugural PyPI Support Specialist Hello there! I am Maria, the inaugural PyPI Support Specialist. I go by "Thespi-Brain" on GitHub. I wanted to provide a dispatch of how this past year (and a half!) has been regarding my role and…

PyPI BlogLanguagesPyPI in 2025: A Year in Review As 2025 comes to a close, it's time to look back at another busy year for the Python Package Index. This year, we've focused on delivering critical security enhancements, rolling out powerful new…

PyPI BlogLanguagesPyPI and Shai-Hulud: Staying Secure Amid Emerging Threats An attack on the npm ecosystem continues to evolve, exploiting compromised accounts to publish malicious packages.

PyPI BlogLanguagesNew Login Verification for TOTP-based Logins We've implemented a new security feature designed to protect PyPI users from phishing attacks: email verification for TOTP-based logins from new devices. What's Changing?

PyPI BlogLanguagesTrusted Publishing is popular, now for GitLab Self-Managed and Organizations Trusted Publishing has proven popular since its launch in 2023 . Recap: Trusted Publishing enables software build platforms to publish packages to PyPI on your behalf, eliminating the need to manage…

PyPI BlogLanguagesPhishing attacks with new domains likely to continue Unfortunately the string of phishing attacks using domain-confusion and legitimate-looking emails continues.

PyPI BlogLanguagesToken Exfiltration Campaign via GitHub Actions Workflows Summary I recently responded to an attack campaign where malicious actors injected code into GitHub Actions workflows attempting to steal PyPI publishing tokens.

PyPI BlogLanguagesPreventing Domain Resurrection Attacks Summary PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through…

PyPI BlogLanguagesPyPI now serves project status markers in API responses PyPI now serves project status markers in its standard index APIs . This allows downstream consumers (like Python package installers and index mirrors) to retrieve project statuses programmatically…

PyPI BlogLanguagesPreventing ZIP parser confusion attacks on Python package installers The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from confusion attacks arising from ZIP parser implementations.

PyPI BlogLanguagesPyPI Phishing Attack: Incident Report Incident Report: Phishing Attack Over the past few days, a phishing attack targeting PyPI users via email was uncovered.

On the calendar

予定 · Conferences and launch events, this week's stories from each corner of the industry, and what its press is covering — in English

On view

This week, from that corner the newest stories from the corner of the industry you picked

The wire their own posts, translated

How code moves in 2026 from the industry's own reports

Sources

Fetched every six hours, linked to the original

About

The name is the button.

An agent writes the code now, and a human thumb hovers over Accept all a hundred times a day. The honest question of this decade is what, exactly, you just accepted. So I read the diff.

Eight years as a backend engineer in Stockholm, back in Tokyo since 2023, and I still ship something small most nights, usually badly. My one rule: the only real review of a model is the thing you built with it. That is why there is no leaderboard on this site.

Around a hundred and forty sources come through — the labs' own posts, the papers, the tools, the runtimes and languages nobody is watching yet, the chip under the demo, and the newsletters people actually forward. What is moving gets counted so the week reads at a glance, and every few days I explain one mechanism in plain words.

A story here is a headline, a short excerpt, one image and the link to whoever wrote it. We never reproduce the post; the images belong to their authors. A post written in Japanese appears in Japanese, exactly as it was published, and the link goes to the original.

— Yuki Halvorsen, Tokyo