From 8eb73b44d21d10c6bf86b1dace1ebbf1ccd87def Mon Sep 17 00:00:00 2001 From: Kemal Erdem Date: Fri, 29 May 2026 22:21:01 +0200 Subject: [PATCH] chore(security): add 7-day exclude-newer cooldown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Refuse to resolve any PyPI dependency uploaded in the last 7 days (`[tool.uv] exclude-newer = "7 days"`) when this project is locked or installed via uv. Mitigates blast radius of compromised dependencies (typosquatting, account takeovers, dependency confusion). Pins `required-version = ">=0.11.1"` so older uvs fail loudly instead of silently parsing "7 days" as an RFC 3339 date and proceeding *without* the cooldown — see uv#17908. pypiquant has no first-party PrimeIntellect packages in its closure (cffi, torch, numpy), so no `[tool.uv.exclude-newer-package]` exemptions are needed. The comment in pyproject.toml documents when to add one. Part 1 of 3 in a coordinated supply-chain hardening across PI repos. Co-Authored-By: Claude Opus 4.7 (1M context) --- python/pyproject.toml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/python/pyproject.toml b/python/pyproject.toml index 8720d70..a2362a7 100644 --- a/python/pyproject.toml +++ b/python/pyproject.toml @@ -20,6 +20,19 @@ Issues = "https://github.com/PrimeIntellect-ai/pi-quant/issues" [project.optional-dependencies] dev = ["pytest","torch","numpy","pre-commit","ruff", "matplotlib", "twine"] +[tool.uv] +# Enforce a uv version that supports the friendly-duration form +# (`"7 days"`) in the static pyproject parser. Older uvs silently parse +# the value as an RFC 3339 date, emit a TOML parse warning, and proceed +# *without* the cooldown — bypassing this security policy. +required-version = ">=0.11.1" +# Supply-chain cooldown: new PyPI uploads must age 7 days before resolution +# picks them up. Applies whenever this project is locked or installed via uv. +# pypiquant has no first-party PrimeIntellect dependencies in its closure, so +# no exclude-newer-package exemptions are needed yet — add a +# [tool.uv.exclude-newer-package] entry when that changes. +exclude-newer = "7 days" + [tool.ruff] line-length = 120 target-version = "py38"