This commit is contained in:
Tim Haines 2026-09-25 14:00:51 +00:00 • committed by GitHub
commit 2b6bcbbb7d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 28 additions and 9 deletions

View file

@ -422,3 +422,15 @@ known_third_party = ["pydantic", "litellm"]
exclude_dirs = ["docs", "build", "dist", "tests"]
skips = ["B101", "B601", "B404", "B603", "B607"] # Skip assert, shell injection, subprocess import and partial path checks
severity = "medium"
# ============================================================================
# uv — dependency release-age cooldown
# ============================================================================
[tool.uv]
# Don't resolve a version until it's a few days old — a guard against a freshly-
# compromised upstream. One day under the Dependabot cooldown so its bumps still
# resolve here; cryptography is exempt for fast security patches. Needs uv >= 0.9.17.
required-version = ">=0.9.17"
exclude-newer = "6 days"
exclude-newer-package = { cryptography = false }

25
uv.lock generated
View file

@ -9,6 +9,13 @@ resolution-markers = [
"python_full_version < '3.14' and sys_platform != 'win32'",
]
[options]
exclude-newer = "2026-07-18T22:23:51.950091Z"
exclude-newer-span = "P6D"
[options.exclude-newer-package]
cryptography = false
[[package]]
name = "aiohappyeyeballs"
version = "2.6.2"
@ -1113,7 +1120,7 @@ name = "macholib"
version = "1.16.4"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "altgraph" },
{ name = "altgraph", marker = "python_full_version < '3.15' and sys_platform != 'win32'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/10/2f/97589876ea967487978071c9042518d28b958d87b17dceb7cdc1d881f963/macholib-1.16.4.tar.gz", hash = "sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362", size = 59427, upload-time = "2025-11-22T08:28:38.373Z" }
wheels = [
@ -1806,13 +1813,13 @@ name = "pyinstaller"
version = "6.21.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "altgraph" },
{ name = "macholib", marker = "sys_platform == 'darwin'" },
{ name = "packaging" },
{ name = "pefile", marker = "sys_platform == 'win32'" },
{ name = "pyinstaller-hooks-contrib" },
{ name = "pywin32-ctypes", marker = "sys_platform == 'win32'" },
{ name = "setuptools" },
{ name = "altgraph", marker = "python_full_version < '3.15'" },
{ name = "macholib", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
{ name = "packaging", marker = "python_full_version < '3.15'" },
{ name = "pefile", marker = "python_full_version < '3.15' and sys_platform == 'win32'" },
{ name = "pyinstaller-hooks-contrib", marker = "python_full_version < '3.15'" },
{ name = "pywin32-ctypes", marker = "python_full_version < '3.15' and sys_platform == 'win32'" },
{ name = "setuptools", marker = "python_full_version < '3.15'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/d5/4d/ec706c3fcf39e26888c35b39615ff4d5865d184069666c47492cff1fbe50/pyinstaller-6.21.0.tar.gz", hash = "sha256:bb9fab705983e393a2d1cac77d6972513057ad800215fd861dc15ff5272e98fd", size = 4061519, upload-time = "2026-06-13T14:15:06.25Z" }
wheels = [
@ -1834,7 +1841,7 @@ name = "pyinstaller-hooks-contrib"
version = "2026.6"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "packaging" },
{ name = "packaging", marker = "python_full_version < '3.15'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/94/5b/c9fe0db5e83ee1c39b2258fa21d23b15e1a60786b6c5990ee5074ead8bb6/pyinstaller_hooks_contrib-2026.6.tar.gz", hash = "sha256:bef5002c32f4f50bd55b005da12cff64eca8783e7eaf86a06a62410164bab725", size = 173354, upload-time = "2026-06-08T22:37:16.152Z" }
wheels = [