ReleaseGitHub Dependabot
GitHub Adds a Default Dependabot Cooldown as PyPI Locks Releases After 14 Days
GitHub now makes Dependabot wait three days before opening a version update pull request, and PyPI now rejects new files uploaded to releases older than 14 days. Both changes use time as a supply chain control.