build: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails by julian-risch · Pull Request #11170 · deepset-ai/haystack

julian-risch · 2026-04-22T10:36:05Z

Related Issues

Supply chain attacks increasingly target the window between a package being compromised and defenders noticing. A 24-hour age requirement means that even if a dependency is compromised and a malicious version is published, it won't automatically land in a uv lock run or a Dependabot PR within that window.

Changes

Hardens the haystack-ai package against supply chain attacks by introducing three complementary dependency age guardrails.

pyproject.toml — uv exclude-newer guardrail:

Adds exclude-newer = "24 hours" under [tool.uv], which tells uv to ignore any package version published within the last 24 hours during resolution. This prevents a freshly-compromised or typosquatted package version from being picked up at install/lock time.
Adds exclude-newer-package exemptions for first-party packages (haystack-experimental, haystack-pydoc-tools) so freshly-published releases of our own packages are always resolvable.
The duration is evaluated relative to the current clock at uv lock / uv sync time — no manual date updates needed. See uv dependency cooldowns docs for details.

.github/dependabot.yml — Dependabot cooldown:

Adds a pip ecosystem entry so Dependabot tracks Python dependencies.
Adds cooldown.default-days: 1 to both pip and github-actions entries, so Dependabot won't open bump PRs for versions published less than 1 day ago — matching the uv window.

--uploaded-prior-to — pip guardrail:
Add --uploaded-prior-to P1D to all pip install commands in CI workflows (pip 26.1+), so packages uploaded within the last 24 hours are skipped at install time. I had to upgrade pip in CI, otherwise the relative duration won't be picked up correctly because that was only introduced in pip 26.1

How did you test it?

Upgraded uv and hatch and pip locally. Confirmed that the added parameter has the effect that more recent releases are not installed.

No functional code changes. This only affects dependency resolution behavior.

Notes for the reviewer

I added a release note mentioning the changes to pyproject.toml only because that's the only change that directly affects users. Does that sound good to you?

Checklist

I have read the contributors guidelines and the code of conduct.
I have updated the related issue with new insights and changes.
I have added unit tests and updated the docstrings.
I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test: and added ! in case the PR includes breaking changes.
I have documented my code.
I have added a release note file, following the contributors guidelines.
I have run pre-commit hooks and fixed any issue.

🤖 Generated with Claude Code

…uardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vercel · 2026-04-22T10:36:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
haystack-docs	Ignored	Preview	Apr 30, 2026 9:21am

coveralls · 2026-04-22T10:40:43Z

Coverage Report for CI Build 24773716980

Coverage increased (+0.01%) to 92.857%

Details

Coverage increased (+0.01%) from the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	17177
Covered Lines:	15950
Line Coverage:	92.86%
Coverage Strength:	0.93 hits per line

💛 - Coveralls

Extends the supply chain hardening by passing --uploaded-prior-to P1D (pip 26.1 relative duration format) to every pip install <packages> command across CI workflows, so packages published within the last 24 hours are excluded at install time. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

julian-risch · 2026-04-30T06:36:47Z

pip 26.0 introduced --uploaded-prior-to and with pip 26.1 it now accepts a duration in days (relative). https://pip.pypa.io/en/latest/user_guide/#filtering-by-upload-time
I added this in another commit.

pip 26.1 requires the value to be joined with = rather than a space for the relative duration format to be parsed correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

P1D relative duration requires pip>=26.1 (latest as of this commit). CI runners ship with older pip, so each install step now upgrades pip first to ensure the flag is recognised. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-04-30T07:00:38Z

Coverage report

This PR does not seem to contain any modification to coverable code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

anakin87 · 2026-04-30T08:38:14Z

+---
+security:
+  - |
+    Haystack's uv configuration now excludes packages published within the last
+    24 hours when resolving dependencies, reducing exposure to supply chain
+    attacks via freshly compromised packages. If you need to install a dependency
+    that was published less than 24 hours ago, you can override this by running
+    ``uv sync --exclude-newer="0 days"`` or
+    ``uv pip install <package> --exclude-newer="0 days"``.


I'm not sure that this is relevant for users. Or at least, only for those who install from main.
WDYT?

sorry let me check better

I'd say that a user doing pip install haystack-ai would still install the latest version of dependencies. So I'd remove the release note.

Is my interpretation correct?

pip install haystack-ai would still install the latest version of dependencies, correct. I am fine with removing the release note. 👍

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

claude · 2026-04-30T09:11:57Z

Code review

Issue: Supply chain gap — pip upgrade is not subject to the cooling-off window

Every job modified in this PR upgrades pip before the --uploaded-prior-to=P1D guard is active:

# .github/workflows/tests.yml (and 12 other workflow files)
python -m pip install --upgrade pip          # ← unguarded
pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D

If an attacker publishes a malicious pip release within the last 24 hours, the compromised pip is installed by the first line — and then handles all subsequent pip install calls, including those with --uploaded-prior-to. This undermines the exact threat model the PR is designed to address, and is most consequential in the release workflows (pypi_release.yml, nightly_testpypi_release.yml, release.yml, github_release.yml) where pip runs in the same job that publishes haystack-ai to PyPI.

See:

haystack/.github/workflows/tests.yml

Lines 79 to 82 in 15e7a99

    
                 - name: Install Hatch 
        
                   run: | 
        
                     python -m pip install --upgrade pip

Suggested fix: Add --uploaded-prior-to=P1D to the upgrade step itself. The pip bundled with actions/setup-python on current GitHub-hosted runners supports this flag:

python -m pip install --upgrade pip --uploaded-prior-to=P1D
pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D

This pattern should be applied consistently across all 13 modified workflow files.

Checked for bugs and CLAUDE.md compliance. No other issues found.

julian-risch · 2026-04-30T09:13:38Z

Code review

Issue: Supply chain gap — pip upgrade is not subject to the cooling-off window

I considered this even before this automated code review. However, most recent pip version is required BEFORE we use the uploaded-prior-to parameter. That's why I won't change anything to address this comment.

anakin87

I'd remove the release note.

Then feel free to merge.

Thank you!

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: add uv exclude-newer and Dependabot cooldown as supply chain g…

7e49095

…uardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot added topic:build/distribution topic:CI labels Apr 22, 2026

anakin87 reviewed Apr 22, 2026

View reviewed changes

Comment thread pyproject.toml

julian-risch mentioned this pull request Apr 23, 2026

chore: migrate CI from Hatch to uv native (uv sync / uv run) #11176

Draft

julian-risch and others added 2 commits April 30, 2026 08:51

fix: use --uploaded-prior-to=P1D syntax for pip cooldown

908c009

pip 26.1 requires the value to be joined with = rather than a space for the relative duration format to be parsed correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

julian-risch changed the title ~~chore: add uv exclude-newer and Dependabot cooldown as supply chain guardrails~~ chore: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails Apr 30, 2026

chore: add release note for uv exclude-newer supply chain hardening

542039b

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

julian-risch changed the title ~~chore: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails~~ build: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails Apr 30, 2026

julian-risch marked this pull request as ready for review April 30, 2026 07:10

julian-risch requested a review from a team as a code owner April 30, 2026 07:10

julian-risch requested review from anakin87 and bogdankostic and removed request for a team and bogdankostic April 30, 2026 07:10

anakin87 reviewed Apr 30, 2026

View reviewed changes

revert: undo accidental changes to project.yml

15e7a99

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

anakin87 approved these changes Apr 30, 2026

View reviewed changes

chore: remove release note for supply chain hardening

7f332b6

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

julian-risch enabled auto-merge (squash) April 30, 2026 09:22

julian-risch added the ignore-for-release-notes PRs with this flag won't be included in the release notes. label Apr 30, 2026

julian-risch merged commit 8887691 into main Apr 30, 2026
30 of 31 checks passed

julian-risch deleted the supply-chain-exclude-newer branch April 30, 2026 11:22

Conversation

julian-risch commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issues

Changes

How did you test it?

Notes for the reviewer

Checklist

Uh oh!

vercel Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

coveralls commented Apr 22, 2026

Coverage Report for CI Build 24773716980

Coverage increased (+0.01%) to 92.857%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

julian-risch commented Apr 30, 2026

Uh oh!

github-actions Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage report

Uh oh!

anakin87 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

anakin87 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

anakin87 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

julian-risch Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claude Bot commented Apr 30, 2026

Code review

Uh oh!

julian-risch commented Apr 30, 2026

Code review

Uh oh!

anakin87 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

julian-risch commented Apr 22, 2026 •

edited

Loading

vercel Bot commented Apr 22, 2026 •

edited

Loading

github-actions Bot commented Apr 30, 2026 •

edited

Loading