From aa1e0e3977039ce20b3ca4ab77546a3e662a8b9e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 2 Jul 2026 13:02:26 +0000 Subject: [PATCH 1/3] chore(deps): add uv exclude-newer = "7 days" cooldown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sets [tool.uv].exclude-newer = "7 days" so every uv dependency resolution excludes package releases published in the last 7 days, rolling forward day to day. Dependabot's cooldown setting only protects Dependabot-authored PRs. It does nothing for the other paths that resolve dependencies: manual `uv add`, ad hoc `uv lock` regenerations, `uvx` bootstraps, and CI re-resolves triggered by a widened version range. exclude-newer covers all of those uniformly by giving newly published releases a quarantine window to be pulled or patched before uv will select them, without needing an allowlist of trusted publish times. Per the uv docs, exclude-newer accepts RFC 3339 timestamps or friendly durations like "7 days" and is evaluated relative to the current time at resolution, so the window rolls automatically. Reference: Canonical Security "How-To: Secure a repo" — Minimum release age. --- pyproject.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pyproject.toml b/pyproject.toml index 5e3dede..b7d8ae0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -50,6 +50,9 @@ version = {attr = "jubilant.__version__"} [tool.setuptools] license-files = [] +[tool.uv] +exclude-newer = "7 days" + # Linting tools configuration [tool.ruff] line-length = 99 From d5667fbdc5cbd7c322f3e39486d20f2444346d5f Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 2 Jul 2026 13:02:40 +0000 Subject: [PATCH 2/3] chore(deps): reject source-only distributions via [tool.uv].no-build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sets [tool.uv].no-build = true so uv refuses to install any package from a source distribution (sdist) and only accepts prebuilt wheels. Installing an sdist (via `pip install ` or `uv sync` resolving to one) runs that package's setup.py / PEP 517 build hooks at install time — arbitrary code execution controlled by the package author, not reviewed as part of this repo's dependency review. Wheels are prebuilt archives and do not execute install-time scripts, so restricting to wheel-only installs closes this vector fleet-wide. Verified 2026-07-02 that 0 of 571 dependencies across the fleet's uv.lock files are sdist-only, so this is a zero-cost change today. If a future dependency is only published as an sdist, the escape hatch is [tool.uv].no-build-package = ["specific-pkg"] to exempt just that package rather than disabling the protection globally. Reference: Canonical Security "How-To: Secure a repo" — Install scripts. --- pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/pyproject.toml b/pyproject.toml index b7d8ae0..4b8e58e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -52,6 +52,7 @@ license-files = [] [tool.uv] exclude-newer = "7 days" +no-build = true # Linting tools configuration [tool.ruff] From a2a2b10928f8e2708a1b0bf828651d509257664a Mon Sep 17 00:00:00 2001 From: Tony Meyer Date: Sat, 4 Jul 2026 14:21:03 +1200 Subject: [PATCH 3/3] chore(deps): align exclude-newer block with fleet exemplar Replace the bare `[tool.uv]` block with the canonical fleet comment (rolling quarantine rationale) and drop `no-build = true`. See canonical/pytest-jubilant#98 for the exemplar PR and canonical/charm-tech#22 (references/decisions.md) for the recorded deferral of `no-build` and `--locked`: uv has no allow-list to exempt the workspace project from `no-build`, and rolling `exclude-newer` is fundamentally incompatible with `--locked`. Rolling `exclude-newer` is the surviving pattern. --- pyproject.toml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 4b8e58e..d06fd58 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -51,8 +51,12 @@ version = {attr = "jubilant.__version__"} license-files = [] [tool.uv] +# Rolling quarantine: never resolve against packages published in the last 7 +# days, so a compromised release has a window to be caught/yanked upstream +# before it can reach this project via a manual `uv add`, a `uv lock` regen, +# a uvx bootstrap, or a CI re-resolve. Complements (doesn't replace) the +# Dependabot cooldown, which only protects Dependabot-authored PRs. exclude-newer = "7 days" -no-build = true # Linting tools configuration [tool.ruff]