Skip to content

How can I reduce risk of supply chain attacks? Dependency Cooldown in python #1218

@wwarriner

Description

@wwarriner

What would you like to see added?

Pixi and pip now both support "dependency cooldown" configuration. What is dependency cooldown? It's a feature that, when configured, allows software maintainers to exclude any releases made within a certain timeframe relative to now.

In the case of pip, you can exclude versions released in the past week by adding the following to ~/.config/pip/pip.conf

uploaded-prior-to = P7D  # Past 7 Days

https://sethmlarson.dev/pip-relative-dependency-cooldowns

In Pixi, this feature comes from exclude-newer. https://pixi.prefix.dev/latest/reference/pixi_manifest/#exclude-newer-optional

And uv: https://docs.astral.sh/uv/reference/settings/#exclude-newer

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions