chore(deps): exclude uv packages published in the last 2 days - #56
chore(deps): exclude uv packages published in the last 2 days#56imranq2 wants to merge 1 commit into
Conversation
Aikido Endpoint Protection blocks/flags packages published very recently as a supply-chain-risk heuristic, which shows up as installs failing or hanging for brand-new package versions even though the same install works fine a few days later or in CI. uv's exclude-newer setting keeps the resolver from selecting anything published after the cutoff. Re-locked via `make update-fast`. See internal doc: https://icanbwell.atlassian.net/wiki/x/RgAnhQE
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward dependency-lock config change.
Extended reasoning...
Overview
This PR only touches pyproject.toml (adds a [tool.uv] exclude-newer = "2 days" setting) and uv.lock (regenerated via uv lock --upgrade, bumping numerous transitive dependency versions within that 2-day cutoff window). No application source code (oidcauthlib package) is modified.
Security risks
None identified. The change is purely a build/dependency-resolution configuration tweak intended to avoid installing packages published in the last 2 days (mitigating a supply-chain false-positive from Aikido Endpoint Protection on brand-new releases). If anything, this setting reduces exposure to just-published (potentially compromised) packages by requiring a 2-day cooldown before uv will resolve to them.
Level of scrutiny
Low. This is a mechanical, well-scoped chore: a one-line config addition plus an automated lockfile regeneration. The lockfile diff is large but entirely mechanical (version/hash/URL bumps for existing dependencies), consistent with running uv lock --upgrade. No new dependencies with unusual provenance were introduced, and the resolved exclude-newer/exclude-newer-span values in uv.lock correctly reflect the "2 days" setting in pyproject.toml.
Other factors
No bugs were found by the bug-hunting system, consistent with the change being config/lockfile only. CI running the test suite against the updated dependency versions is the primary safety net here, per the PR's stated test plan.
1 participant
Summary
exclude-newersetting so the resolver skips package versions published in the last 2 days, avoiding installs failing/hanging when Aikido Endpoint Protection flags brand-new releases as a supply-chain risk.make update-fast(uv lock --upgrade), so besides applying the new cutoff, other dependencies were also refreshed to their latest versions within that window.Background: https://icanbwell.atlassian.net/wiki/x/RgAnhQE
Test plan