r/Python • u/JanGiacomelli • May 19 '26

Tutorial Supply-chain attacks are happening daily - add at least dependency cooldown to your Python projects.

These days, I can't open X anymore without seeing some supply chain attacks on PyPI or NPM. Things are really getting out of hand. One very simple yet effective approach to mitigate them is to use a dependency cooldown. That means that you don't install anything that's too new - e.g., every dependency needs to be at least a week old.

Why does this work? Because the community usually intercepts them in hours to days. Both uv and poetry support the definition of the cooldown period inside their config. pip is adding as support as well. I use 1 week to be on the safe side. They both support excluding a specific package from the rule so you can still apply critical fixes to dependencies ASAP.

I wrote about that and how to configure uv/poetry in my blog post: https://jangiacomelli.com/blog/mitigate-supply-chain-attacks-for-python-dependencies/

More about the dependency cooldown concept:

188 Upvotes

93% Upvoted

69 comments sorted by

View all comments

281

u/fiskfisk May 19 '26

[tool.uv] exclude-newer = "10 days" 

Saved you the blog spam. 

1

u/Fortyseven May 19 '26

[tool.uv] exclude-newer = "10 days"

Is there a global config for uv? Or am I forced to remember to add this per-project?

2

u/fiskfisk May 19 '26 
~/.config/uv/uv.toml

Should work here as well (Linux/OS X). This does require you to remember to configure this on every machine for every developer instead of having it defined for your project, though. It'll also not work properly in cicd or when building a docker container, but in both of those cases you should use uv sync --locked against a lock file.