PyPI releases now reject new files after 14 days
27 points by ngoldbaum
27 points by ngoldbaum
Good, but I'm surprised this hasn't been policy for years...
Personally, I'm surprised PyPI releases are mutable in the first place...
That's because in the past before stable ABI it meant that when a new Python release came around you could not install binary distributions of extensions for those versions. So people appended more binary releases for newer Python versions to already existing popular versions of of older libraries. That is less and less necessary today, but I do expect that this will be somewhat painful for some packages around new Python releases.
Indeed, don't know if other package index (python and other languages npm for example) have this strange behavior of mutable release. That can lead to security risk but also instability as 2 consecutive pip install (or whatever package manager...) can lead to 2 package with the same version number but different package...