scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-09-08 22:21:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add a uv resolution cooldown (exclude-newer) matching the Dependabot config

Browse source 
Adds [tool.uv] exclude-newer = "6 days" so uv won't resolve to a brand-new
release for a few days -- a guard against pulling a just-published, possibly
compromised version. Set one day under the companion 7-day Dependabot cooldown
so a version Dependabot proposes still resolves cleanly here; cryptography is
exempt from the cooldown to mirror the Dependabot cooldown exclude so its
security patches aren't delayed. uv sync --frozen is unaffected.

These options landed in uv 0.9.17 (Dec 2025); required-version = ">=0.9.17"
enforces the floor so an older uv fails with a clear message rather than a
confusing parse error.

Also commits the regenerated uv.lock. Adding exclude-newer forces a full
re-resolution, so uv records the window in the lockfile's [options] block and
`uv lock --check` fails until the lock is regenerated. No package versions
change -- the only other delta is uv emitting more precise environment markers
on the pyinstaller/macholib dependency edges, which is a re-resolution artifact
(a plain `uv lock` on the current tree is a no-op diff).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tim Haines 2026-07-23 16:36:08 +12:00
parent 93af2b94a2
commit ff44890c95
2 changed files with 28 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
pyproject.toml
View file

@ -356,3 +356,15 @@ known_third_party = ["pydantic", "litellm"]
exclude_dirs = ["docs", "build", "dist"]
skips = ["B101", "B601", "B404", "B603", "B607"] # Skip assert, shell injection, subprocess import and partial path checks
severity = "medium"
# ============================================================================
# uv — dependency release-age cooldown
# ============================================================================
[tool.uv]
# Don't resolve a version until it's a few days old — a guard against a freshly-
# compromised upstream. One day under the Dependabot cooldown so its bumps still
# resolve here; cryptography is exempt for fast security patches. Needs uv >= 0.9.17.
required-version = ">=0.9.17"
exclude-newer = "6 days"
exclude-newer-package = { cryptography = false }

25
uv.lock generated
View file

@ -9,6 +9,13 @@ resolution-markers = [
"python_full_version < '3.14' and sys_platform != 'win32'",
]
[options]
exclude-newer = "2026-07-18T22:23:51.950091Z"
exclude-newer-span = "P6D"
[options.exclude-newer-package]
cryptography = false
[[package]]
name = "aiohappyeyeballs"
version = "2.6.2"
@ -1117,7 +1124,7 @@ name = "macholib"
version = "1.16.4"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "altgraph" },
{ name = "altgraph", marker = "python_full_version < '3.15' and sys_platform != 'win32'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/10/2f/97589876ea967487978071c9042518d28b958d87b17dceb7cdc1d881f963/macholib-1.16.4.tar.gz", hash = "sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362", size = 59427, upload-time = "2025-11-22T08:28:38.373Z" }
wheels = [
@ -1831,13 +1838,13 @@ name = "pyinstaller"
version = "6.21.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "altgraph" },
{ name = "macholib", marker = "sys_platform == 'darwin'" },
{ name = "packaging" },
{ name = "pefile", marker = "sys_platform == 'win32'" },
{ name = "pyinstaller-hooks-contrib" },
{ name = "pywin32-ctypes", marker = "sys_platform == 'win32'" },
{ name = "setuptools" },
{ name = "altgraph", marker = "python_full_version < '3.15'" },
{ name = "macholib", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
{ name = "packaging", marker = "python_full_version < '3.15'" },
{ name = "pefile", marker = "python_full_version < '3.15' and sys_platform == 'win32'" },
{ name = "pyinstaller-hooks-contrib", marker = "python_full_version < '3.15'" },
{ name = "pywin32-ctypes", marker = "python_full_version < '3.15' and sys_platform == 'win32'" },
{ name = "setuptools", marker = "python_full_version < '3.15'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/d5/4d/ec706c3fcf39e26888c35b39615ff4d5865d184069666c47492cff1fbe50/pyinstaller-6.21.0.tar.gz", hash = "sha256:bb9fab705983e393a2d1cac77d6972513057ad800215fd861dc15ff5272e98fd", size = 4061519, upload-time = "2026-06-13T14:15:06.25Z" }
wheels = [
@ -1859,7 +1866,7 @@ name = "pyinstaller-hooks-contrib"
version = "2026.6"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "packaging" },
{ name = "packaging", marker = "python_full_version < '3.15'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/94/5b/c9fe0db5e83ee1c39b2258fa21d23b15e1a60786b6c5990ee5074ead8bb6/pyinstaller_hooks_contrib-2026.6.tar.gz", hash = "sha256:bef5002c32f4f50bd55b005da12cff64eca8783e7eaf86a06a62410164bab725", size = 173354, upload-time = "2026-06-08T22:37:16.152Z" }
wheels = [