Changelog
What shipped
Product and API changes, newest first. Breaking changes are announced at least 90 days ahead and listed here twice.
1 August 2026 · security
PEP 740 attestation verification
PyPI publish attestations are now verified on fetch, matching what we already did for npm.
18 July 2026 · ecosystem
apt repositories
Proxy and private repositories for Debian and Ubuntu, with signature verification.
30 June 2026 · feature
Policy as code
Apply the whole policy document from CI; every resolution records the policy version that produced it.
11 June 2026 · fix
Go module zip determinism
Re-serving a cached module could produce a zip with different timestamps. Bytes are now stored and served verbatim.