chore(deps): exclude uv packages published in the last 2 days#56
chore(deps): exclude uv packages published in the last 2 days#56imranq2 wants to merge 1 commit into
Conversation
Aikido Endpoint Protection blocks/flags packages published very recently as a supply-chain-risk heuristic, which shows up as installs failing or hanging for brand-new package versions even though the same install works fine a few days later or in CI. uv's exclude-newer setting keeps the resolver from selecting anything published after the cutoff. Re-locked via `make update-fast`. See internal doc: https://icanbwell.atlassian.net/wiki/x/RgAnhQE
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward dependency-lock config change.
Extended reasoning...
Overview
This PR adds exclude-newer = "2 days" to the [tool.uv] section of pyproject.toml and re-locks uv.lock via uv lock --upgrade. The intent is to have uv's resolver skip packages published in the last 2 days so that very-recently-published releases (which an internal security tool flags as a supply-chain risk) aren't picked up immediately. The bulk of the diff is the auto-generated uv.lock reflecting the new [options] block (exclude-newer/exclude-newer-span) and routine version bumps for many transitive dependencies within the allowed window.
Security risks
No new security risk is introduced by this PR itself — if anything it's a defensive supply-chain measure (delaying adoption of brand-new package releases). The lock file changes are standard version bumps to already-trusted packages/indexes; no new dependencies, indexes, or credentials are introduced.
Level of scrutiny
This is a build/dependency-management config change, not application logic, and doesn't touch tenant isolation, PHI/PII, auth, FHIR modeling, or public contracts. A low level of scrutiny is appropriate. The bug-hunting pass already reviewed the exclude-newer duration syntax and commit-message policy concerns and found them not to be real issues.
Other factors
No prior reviews or outstanding comments exist on this PR. The change is minimal in intent (one new TOML key plus a routine re-lock) and self-contained to dependency management, which fits the criteria for auto-approval.
1 participant
Summary
exclude-newersetting so the resolver skips package versions published in the last 2 days, avoiding installs failing/hanging when Aikido Endpoint Protection flags brand-new releases as a supply-chain risk.make update-fast(uv lock --upgrade), so besides applying the new cutoff, other dependencies were also refreshed to their latest versions within that window.Background: https://icanbwell.atlassian.net/wiki/x/RgAnhQE
Test plan