New GitHub, PyPI Policies Boost Supply Chain Security

GitHub and PyPI have introduced new policies to enhance supply chain security by reducing the risk of malicious code propagation through package releases. GitHub's Dependabot now enforces a default three-day cooldown before opening pull requests for non-security version bumps, allowing time for detection of malicious versions. PyPI restricts uploading new files to releases older than 14 days to prevent poisoning of stable releases in case of compromised publishing credentials. These measures aim to reduce the risk of supply chain attacks without significantly impacting development workflows.

• securityweek.com/new-github-pypi-policies-boost-supply-chain-security/ (opens in a new tab)