GeezerVison

PyPI's redesigned project pages with clearer security signals are now live

In July, we announced a series of planned updates to the PyPI user interface. Shaped by user research with members of the Python community, the updates aim to improve how we surface security signals and display package details.

We're pleased to share that this work is now complete and live on PyPI.

Higher limits for organization projects

Projects owned by a PyPI organization now get higher limits by default:

PyPI now limits versions to 128 characters

PyPI now rejects new uploads whose version is longer than 128 characters.

This affects almost no one: across the roughly 9.9 million releases on PyPI, only 2 have a version that long. Releases that are already on PyPI stay exactly as they are, and installing them works the same as before.

Checking email reputation, and allowing Outlook again

PyPI improves on checks for the reputation of an email address when used to register an account or add to an existing account, and rejects addresses identified as disposable.

With the new check in place, outlook.com and hotmail.com addresses can once again be used on PyPI.

PyPI's developer documentation has moved to dev.pypi.org

The developer documentation for Warehouse, the codebase that powers PyPI, has moved from warehouse.pypa.io to dev.pypi.org.

Existing links to warehouse.pypa.io will keep working: every page now redirects to the same page on dev.pypi.org.

Incident Report: File Hosting Errors

Executive summary

For about two weeks in August 2026, some PyPI users hit intermittent 502 and 503 errors downloading files from files.pythonhosted.org, triggering failures during installation from PyPI. Thanks to our users filing reports in the support tracker; one report in particular narrowed the problem to a single cache node.

Two separate problems were uncovered. A canary deployment inside Fastly's network had triggered a misconfiguration at one cache node, causing Fastly's routing layer to return 502 responses for traffic reaching the affected cache node. Separately, I found and fixed several bugs in our own Fastly configuration around origin fallback and range request behavior. Those had been there for a while, and only surfaced while digging into these reports.

Both intermittent problems are now fixed, and downloads are back to full function since August 28.

Metadata requests no longer tracked in PyPI download counts

On 2026-08-24 I shipped a change to the configuration that emits PyPI's download logs so that only requests for actual distribution artifacts are counted. A request has to end in .whl, .tar.gz, or .zip to produce a download record.

The counts are more accurate now, and existing systems based on PyPI's BigQuery dataset, like pypistats.org will display a different shape going forward.

How AWS Powers PyPI and the PSF

Working on infrastructure at the Python Software Foundation (PSF) as the Director of Engineering is a broad job with many hats. Python turns up everywhere. It's in healthcare systems and government agencies, in research labs and classrooms, in one-person side projects and in infrastructure at companies with six-figure headcounts. Somebody is using it to analyze a genome right now and somebody else is using it to automate a spreadsheet they hate arranging by hand. That range has always been the interesting part of the PSF's work, and it's only broadened in the last couple of years as AI continues to pull people from many disciplines into writing Python.

The HTML representation of the index API is now frozen

PyPI has adopted PEP 833, which "freezes" the HTML representation of the index API, which is also sometimes called the "simple API" or the "simple repository API."

New packages and releases will continue to appear in the HTML representation, meaning this has no breaking implications for downstream index consumers.

However, future standardization and development efforts will focus on the JSON representation, and downstreams that consume only the HTML representation are strongly encouraged to transition to the JSON representation to ensure access to the latest and greatest index features.

Releases now reject new files after 14 days

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.