From ff44890c955559bc98c1c9cdd00e349366843b32 Mon Sep 17 00:00:00 2001 From: Tim Haines Date: Thu, 23 Jul 2026 16:36:08 +1200 Subject: [PATCH] Add a uv resolution cooldown (exclude-newer) matching the Dependabot config Adds [tool.uv] exclude-newer = "6 days" so uv won't resolve to a brand-new release for a few days -- a guard against pulling a just-published, possibly compromised version. Set one day under the companion 7-day Dependabot cooldown so a version Dependabot proposes still resolves cleanly here; cryptography is exempt from the cooldown to mirror the Dependabot cooldown exclude so its security patches aren't delayed. uv sync --frozen is unaffected. These options landed in uv 0.9.17 (Dec 2025); required-version = ">=0.9.17" enforces the floor so an older uv fails with a clear message rather than a confusing parse error. Also commits the regenerated uv.lock. Adding exclude-newer forces a full re-resolution, so uv records the window in the lockfile's [options] block and `uv lock --check` fails until the lock is regenerated. No package versions change -- the only other delta is uv emitting more precise environment markers on the pyinstaller/macholib dependency edges, which is a re-resolution artifact (a plain `uv lock` on the current tree is a no-op diff). Co-Authored-By: Claude Opus 5 (1M context) --- pyproject.toml | 12 ++++++++++++ uv.lock | 25 ++++++++++++++++--------- 2 files changed, 28 insertions(+), 9 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index d389bd67..c5a818d0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -356,3 +356,15 @@ known_third_party = ["pydantic", "litellm"] exclude_dirs = ["docs", "build", "dist"] skips = ["B101", "B601", "B404", "B603", "B607"] # Skip assert, shell injection, subprocess import and partial path checks severity = "medium" + +# ============================================================================ +# uv — dependency release-age cooldown +# ============================================================================ + +[tool.uv] +# Don't resolve a version until it's a few days old — a guard against a freshly- +# compromised upstream. One day under the Dependabot cooldown so its bumps still +# resolve here; cryptography is exempt for fast security patches. Needs uv >= 0.9.17. +required-version = ">=0.9.17" +exclude-newer = "6 days" +exclude-newer-package = { cryptography = false } diff --git a/uv.lock b/uv.lock index 775dc08b..7334f7eb 100644 --- a/uv.lock +++ b/uv.lock @@ -9,6 +9,13 @@ resolution-markers = [ "python_full_version < '3.14' and sys_platform != 'win32'", ] +[options] +exclude-newer = "2026-07-18T22:23:51.950091Z" +exclude-newer-span = "P6D" + +[options.exclude-newer-package] +cryptography = false + [[package]] name = "aiohappyeyeballs" version = "2.6.2" @@ -1117,7 +1124,7 @@ name = "macholib" version = "1.16.4" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "altgraph" }, + { name = "altgraph", marker = "python_full_version < '3.15' and sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/10/2f/97589876ea967487978071c9042518d28b958d87b17dceb7cdc1d881f963/macholib-1.16.4.tar.gz", hash = "sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362", size = 59427, upload-time = "2025-11-22T08:28:38.373Z" } wheels = [ @@ -1831,13 +1838,13 @@ name = "pyinstaller" version = "6.21.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "altgraph" }, - { name = "macholib", marker = "sys_platform == 'darwin'" }, - { name = "packaging" }, - { name = "pefile", marker = "sys_platform == 'win32'" }, - { name = "pyinstaller-hooks-contrib" }, - { name = "pywin32-ctypes", marker = "sys_platform == 'win32'" }, - { name = "setuptools" }, + { name = "altgraph", marker = "python_full_version < '3.15'" }, + { name = "macholib", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" }, + { name = "packaging", marker = "python_full_version < '3.15'" }, + { name = "pefile", marker = "python_full_version < '3.15' and sys_platform == 'win32'" }, + { name = "pyinstaller-hooks-contrib", marker = "python_full_version < '3.15'" }, + { name = "pywin32-ctypes", marker = "python_full_version < '3.15' and sys_platform == 'win32'" }, + { name = "setuptools", marker = "python_full_version < '3.15'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/d5/4d/ec706c3fcf39e26888c35b39615ff4d5865d184069666c47492cff1fbe50/pyinstaller-6.21.0.tar.gz", hash = "sha256:bb9fab705983e393a2d1cac77d6972513057ad800215fd861dc15ff5272e98fd", size = 4061519, upload-time = "2026-06-13T14:15:06.25Z" } wheels = [ @@ -1859,7 +1866,7 @@ name = "pyinstaller-hooks-contrib" version = "2026.6" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "packaging" }, + { name = "packaging", marker = "python_full_version < '3.15'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/94/5b/c9fe0db5e83ee1c39b2258fa21d23b15e1a60786b6c5990ee5074ead8bb6/pyinstaller_hooks_contrib-2026.6.tar.gz", hash = "sha256:bef5002c32f4f50bd55b005da12cff64eca8783e7eaf86a06a62410164bab725", size = 173354, upload-time = "2026-06-08T22:37:16.152Z" } wheels = [