frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

PyPI Blog: Releases now reject new files after 14 days

https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/
26•miketheman•2d ago

Comments

PhilipRoman•48m ago
There seems to be a severe lack of hash pinning in "modern" software ecosystems. We figured out how to do it 20+ years ago with Git bringing hash addressed storage to the masses. Coming from a different background it was very surprising for me to see things like docker images, packages and github actions being updated at the whim of upstream registry. I much prefer the philosophy where builds are fully offline and predictable, even if not fully reproducible.
woodruffw•42m ago
I’m not sure what this has to do with TFA: Python does have hash-pinning. TFA is not about modifying existing files on the index (PyPI doesn’t allow that), but about adding new files to a pre-existing release. But that doesn’t change the hash of older distributions on that release.
edelbitter•29m ago
Would not count that as 20 years of sticking to that philosophy, though.

We also figured out 20 years ago that SHA1 was not quite as strong as initially estimated, and not quite 10 years ago that generating two colliding documents was merely a matter of some serious computing power. A few projects went ahead and changed the name of their master branch, but SHA256 preference remains elusive.

yladiz•48m ago
I’m a bit surprised this is possible in the first place. I get that you might not be able to upload everything in one go, but it feels like you should “start” and “finish” a release in that case, and once it’s finished you can’t modify it.

I guess the use case is that you might want to build a wheel for an older release for a newer version of Python?

woodruffw•44m ago
The use case of uploading new wheels to an old release was actually (kind of) an accident: PyPI’s current upload API is stateless and originally there was only one file per release (sdists), so there was no need for a start-finish transition for releases.

(This will hopefully change pretty soon, with the “upload 2.0” work.)

edelbitter•44m ago
> To quantify how disruptive this change would be to existing workflows, the PyPI database was queried for projects that have published new files to old releases

While this may quantify how disruptive the change would be to those projects that are able to and do upload additional binaries to PyPI later, it fails to quantify how many projects already completely circumvent this block before it is even introduced.

e.g. If you tell pip to install from source.. the result may already be that you install a binary that PyPI never saw. A common hack for dealing with NVidia internals, which can explode into a large CUDA major version x GPU arch x platform x implementation x python_version cartesian product. The "extras" mechanism is not quite sufficient to model such combinations.

sample code: https://github.com/Dao-AILab/causal-conv1d/blob/4f6ae4e26ae5... https://pypi.org/project/causal-conv1d/

lexicality•19m ago
14 days still seems way too long to me. As a user I thought releases on pypi were immutable!
woodruffw•13m ago
Files are immutable on PyPI, releases are not (because releases are comprised of a set of files, and files are uploaded one by one).

This is unintuitive, but the TL;DR is that files will never change on PyPI, but (previously) a user could upload a new file to a release years after their last upload to that release. This has some legitimate use cases (like allowing people to support new Python versions without bumping a package’s version), but also makes introduces challenges around locking and release security that are elaborated in the thread linked by the blog post.

I agree this could probably be ratcheted down from 14 days over time, though.

firesteelrain•7m ago
This seems like common sense configuration management 101. If I download v1.2 and it’s been published then it should be considered released and not modifiable. With exceptions for ‘dev’ releases of course. I have never published anything on PyPI but I would expect there is a publish button and finalize (?) optional button that if not checked after 14 days makes it final ?

Android May Soon Restrict On-Device ADB

https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/
412•shscs911•6h ago•180 comments

Claude Opus 5

https://www.anthropic.com/news/claude-opus-5
1645•alvis•20h ago•1004 comments

Hannah Fry Wins the Leelavati Prize in 2026 for Mathematics Outreach

https://www.maths.cam.ac.uk/features/professor-hannah-fry-wins-leelavati-prize
340•agnishom•11h ago•56 comments

Building a Tiny 3D Renderer for a Tiny Handheld

https://saffroncr.itch.io/katavatis/devlog/1534514/building-a-tiny-3d-renderer-for-a-tiny-handheld
93•g0xA52A2A•2d ago•5 comments

ARC-AGI Leaderboard

https://arcprize.org/leaderboard
117•rzk•6h ago•92 comments

NYC Apartment Aquaponics

https://erinmurphy.dev/projects/project-2/
92•mm1119•4d ago•32 comments

Charles Ross spent 50 yrs building Star Axis naked-eye observatory in New Mexico

https://www.nytimes.com/2026/07/22/arts/design/charles-ross-star-axis-land-art.html
40•ChrisArchitect•2d ago•6 comments

Kyber (YC W23) Is Hiring a Head of Engineering

https://www.ycombinator.com/companies/kyber/jobs/FGmI8mx-head-of-engineering
1•asontha•1h ago

GC and Exceptions in Wasmtime

https://bytecodealliance.org/articles/wasmtime-gc
120•phickey•4d ago•15 comments

UK AISI / Caisi Preliminary Assessment of Kimi K3's Cyber Capabilities

https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber...
86•walrus01•8h ago•23 comments

Extinct Media Museum Tokyo

https://extinct-media-museum.blog.jp/otemachi/
62•sohkamyung•7h ago•12 comments

Postgres LISTEN/NOTIFY actually scales

https://www.dbos.dev/blog/postgres-listen-notify-scalability
334•KraftyOne•18h ago•63 comments

Opus 5 is currently #1 on Artificial Analysis Intelligence Leaderboard

https://artificialanalysis.ai/models
322•aarondong•17h ago•188 comments

My Images Are Dithered

https://dead.garden/blog/how-my-images-are-dithered.html
10•surprisetalk•3d ago•1 comments

India's first privately-developed rocket reaches orbit on debut launch

https://arstechnica.com/space/2026/07/indias-first-privately-developed-rocket-reaches-orbit-on-dr...
632•sohkamyung•5d ago•180 comments

PyPI Blog: Releases now reject new files after 14 days

https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/
26•miketheman•2d ago•9 comments

My security camera shipped a GitHub admin token in its login page

https://hhh.hn/hanwha-github-token/
609•hhh•1d ago•204 comments

The Fedora 45 Sausage Factory

https://supakeen.com/weblog/the-fedora-45-sausage-factory/
8•6581•2h ago•1 comments

MouthPad: A Tongue-Controlled Touchpad

https://www.augmental.tech/
36•ZaninAndrea•5h ago•9 comments

An old patent inspired the new "Y-zipper", a three-sided fastener

https://news.mit.edu/2026/three-sided-y-zipper-design-0504
231•crescit_eundo•2d ago•44 comments

Firefox Containers Preview

https://blog.mozilla.org/en/firefox/firefox-containers-preview/
389•twapi•3d ago•111 comments

Book Corners: Community map of neighborhood book exchange spots

https://www.bookcorners.org
38•NaOH•2d ago•24 comments

Show HN: I simulated closing the Strait of Hormuz on real oil trade data

https://globaloilnetwork.staffinganalytics.io/
208•eliotho•2d ago•95 comments

Sperm Whales blow bubbles to achieve restful, vertical sleep

https://news.st-andrews.ac.uk/archive/sperm-whales-blow-bubbles-to-achieve-restful-vertical-sleep/
106•hhs•13h ago•24 comments

Kimi K3 exploited the latest Redis server

https://twitter.com/fried_rice/status/2080059356322918777
241•Alifatisk•1d ago•72 comments

Designing an Ethernet Switch ASIC

https://essenceia.github.io/projects/ethernet_switch_asic/
198•random__duck•4d ago•47 comments

Half-Life 2 running natively on HaikuOS

https://discuss.haiku-os.org/t/haiku-nvidia-porting-nvidia-driver-for-turing-gpus/16520?page=18
317•m0do1•1d ago•64 comments

Future euro banknote design proposals

https://www.ecb.europa.eu/euro/banknotes/future_banknotes/html/all-design-proposals.en.html
232•robin_reala•1d ago•239 comments

IRGC claims it destroyed Amazon's Bahrain data center

https://houseofsaud.com/irgc-claims-destroyed-amazon-bahrain-data-center/
313•thisislife2•1d ago•392 comments

PartialString – A finite-difference time-domain physical modelling synthesiser

https://differentinstruments.com/
29•shmeano•3d ago•4 comments