build: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails#11170

Merged

julian-risch merged 7 commits intomainfrom

supply-chain-exclude-newer

Apr 30, 2026

Commits on Apr 22, 2026

chore: add uv exclude-newer and Dependabot cooldown as supply chain guardrails

julian-risch
and
claude
committed

Commits on Apr 30, 2026

chore: add pip --uploaded-prior-to P1D cooldown to all CI pip installs

julian-risch
and
claude
committed
fix: use --uploaded-prior-to=P1D syntax for pip cooldown

julian-risch
and
claude
committed
fix: upgrade pip before using --uploaded-prior-to=P1D

julian-risch
and
claude
committed
chore: add release note for uv exclude-newer supply chain hardening

julian-risch
and
claude
committed
revert: undo accidental changes to project.yml

julian-risch
and
claude
committed
chore: remove release note for supply chain hardening

julian-risch
and
claude
committed