GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks

GitHub and PyPI are implementing time-based security controls to slow down software supply chain attacks. This involves delaying dependency updates and locking older releases against new file uploads. The goal is to give developers and security teams more time to detect and respond to potential threats. This approach aims to reduce the effectiveness of rapid-fire attacks. Developers should be aware of these changes and adjust their workflows accordingly.