Build(deps): Add uv exclude-newer cooldown - #102
Merged
zxiiro merged 1 commit intoJun 11, 2026
Conversation
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
June 11, 2026 06:07
View session
There was a problem hiding this comment.
Pull request overview
Adds an exclude-newer “cooldown” to uv’s resolver configuration so that dependency resolution avoids packages published in the last 7 days, and refreshes the generated uv.lock metadata to reflect this setting (including the relative-span encoding used by newer uv versions).
Changes:
- Add
[tool.uv] exclude-newer = "7 days"to enforce a 7-day supply-chain cooldown during dependency resolution. - Refresh
uv.lockto include the corresponding recorded lock options (exclude-newer-span = "P7D", plus the compatibility placeholder).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
pyproject.toml |
Introduces the uv resolver cooldown configuration via [tool.uv] exclude-newer = "7 days". |
uv.lock |
Records the cooldown in lock metadata (exclude-newer-span = "P7D") and includes a compatibility placeholder field. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add a [tool.uv] exclude-newer = "7 days" resolver cooldown so uv does not lock any dependency published within the last 7 days, giving the community time to catch a compromised release before it enters the lockfile. This complements the existing Dependabot uv cooldown, which only gates update PRs rather than fresh resolutions. uv records the cooldown as a relative span (exclude-newer-span = P7D). Re-locking may roll a recently published dependency back to the newest release older than the window; it returns once that version ages past the cooldown. Needs uv 0.9.17 or newer. Co-authored-by: Claude <claude@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
force-pushed
the
ci/uv-exclude-newer
branch
from
June 11, 2026 07:04
55e285c to
bcef27e
Compare
zxiiro
approved these changes
Jun 11, 2026
zxiiro
left a comment
zxiiro
left a comment
Contributor
There was a problem hiding this comment.
🤖 Dependamerge
Approved this pull request ✅
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
[tool.uv] exclude-newer = "7 days"resolver cooldown and refreshesuv.lock.Why: uv refuses to lock any dependency published within the last 7 days, giving the community time to catch a compromised release before it enters the lockfile. Complements the existing Dependabot
uvcooldown (which only gates update PRs, not local or agentuv lockresolutions).Notes:
uv.lockdiff); it returns on a later lock once it ages past the window.exclude-newer-span = "P7D"); the lockfile carries a backwards-compatible no-op placeholder so older uv in CI still reads it.