New GitHub, PyPI Policies Boost Supply Chain Security

Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days. The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek .

The article reports that GitHub’s Dependabot now enforces a default three-day cooldown before opening routine version‑update pull requests, and PyPI will reject new file uploads to a release after 14 days, both aimed at reducing software supply chain attacks by slowing adoption of potentially malicious or compromised releases.[1][2][3][4] These measures are facts from vendor announcements and industry coverage, and they specifically target dependency management behavior in common ecosystems.[1][2][4] From a RealGround perspective, these changes highlight the need for AI teams to treat dependency update policies and package‑registry constraints as part of their AI supply chain risk posture: organizations should ensure AI agents, pipelines, and model‑serving stacks respect cooldowns, track dependency age in SBOMs, and integrate registry policies into their security readiness and update workflows to avoid both supply chain compromise and unexpected deployment friction.