GitHub, PyPI Policies Boost Supply Chain Security

GitHub's Dependabot now waits three days before opening pull requests for non-security version bumps, while PyPI rejects new files uploaded to releases older than 14 days. The PyPI change follows compromises of LiteLLM and Telnyx and was merged July 8th, 2026.