PyPI now blocks new uploads to releases older than 14 days, to curb supply-chain poisoning

PyPI now rejects new file uploads to package releases older than 14 days, closing a door attackers could use to poison long-stable versions with a stolen publishing token.