Skip to main content

New GitHub, PyPI Policies Hope to Boost Supply Chain Security

3 weeks 4 days ago
"GitHub and the Python Package Index (PyPI) have introduced new policies meant to boost supply chain security," reports SecurityWeek, "by preventing the fast propagation of poisoned package versions and the poisoning of old and long-stable releases." To prevent the fast delivery of malicious code through the immediate fetching of brand-new releases, GitHub has introduced a Dependabot cooldown, where the automation tool waits for at least three days after a release has been published before opening a pull request. "Waiting a few days before adopting a new release gives maintainers, security researchers, and automated scanners time to spot a malicious version and get it pulled before it ever reaches your pull requests," GitHub explains. The three-day cooldown only applies to non-security version bumps, and the behavior can be modified through the configuration option in the dependabot.yml. "Three days as the default balances two goals: it pushes you past the window where most of these attacks live, and it doesn't hold your dependencies back longer than necessary," GitHub notes. And the Python Package Index (PyPI) "now rejects new files being uploaded to releases that are older than 14 days," according to a recernt blog post from the Python Software Foundation's security developer-in-residence Seth Larson: This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised... The discussion of this behavior began during PEP 740 (Digital Attestations) back in January 2024. The discussion was restarted in March 2026 after the popular packages LiteLLM and Telnyx were compromised. These packages were compromised due to a "mutable reference" in these projects' usage of the Trivy GitHub Action... To quantify how disruptive this change would be to existing workflows, the PyPI database was queried for projects that have published new files to old releases... [O]nly 56 projects of 15,000 had published a [Python] 3.14-compatible wheel more than 14 days after a release was available. This topic was brought to the Packaging Summit at PyCon US 2026 by PyPI Safety & Security Engineer, Mike Fiedler. The rough consensus of the discussion was that the summit attendees thought it was "acceptable to require users to bump to the next version" to support new Python versions. With the data and consensus in hand, Seth moved forward with a patch to reject new files on old releases which was merged July 8th, 2026.

Read more of this story at Slashdot.

EditorDavid

Used EV Prices are Now Going Up in America

3 weeks 4 days ago
Electric vehicles have historically been "notorious" for losing their resale value, reports CNBC. But this year prices for used EVs in the U.S. "are up 5.1% from January to June 2026, according to a Recurrent analysis published this month." The trend continued into the second half of the year: Prices are up 7% year to date through mid-July, it said. Recurrent compared EVs according to the same make and model year across 108 combinations and weighted price growth according to inventory volume. "Used EVs are appreciating, which almost never happens," according to an e-mailed Recurrent statement about the analysis. Other auto analysts found a similar trend... Price growth for used EVs has been broad-based, said Stephanie Valdez Streaty, the director of industry insights at Cox Automotive, a market research firm. Twenty-one of the 25 used EV models with the highest sales volume increased in price between January and June this year, she said... [T]he price growth for used EVs this year has been all the more surprising because it has happened despite a high supply of used EVs hitting the market — which, all else being equal, would generally cause prices to fall, experts said... There are several factors juicing consumer demand for used EVs, experts said. Among them are high gasoline prices due to the Iran war, which have pushed more consumers to consider fuel-efficient options, experts said... Overall affordability is another big factor, against a backdrop of inflation that has remained above policymakers' target of 2% for five or so years, auto experts said. The dynamic has pushed more consumers toward the used car market more broadly. Two interesting statistics from the article: "Used EV sales were up 20% in June versus a year earlier, while sales of new EVs were down about 28%, according to Cox Automotive data." New EVs accounted for 5.4% of total new-vehicle sales in June, while the market share for used EVs was just 2.4%, according to Cox Automotive data.

Read more of this story at Slashdot.

EditorDavid