build: pin uv resolver with exclude-newer

[hasansezertasan]

Description

Adds a [tool.uv] section pinning the resolver with exclude-newer = "1 week", so uv ignores any distribution published within the last week during resolution. This improves reproducibility and provides a small supply-chain safety buffer against freshly-published (potentially compromised or broken) releases.

uv accepts a friendly duration for this setting and resolves it relative to the current time on each run, so "1 week" is a native rolling window — no scheduled job to bump a static date. This is recorded in the lockfile as:

[options]
exclude-newer-span = "P1W"

Notes

• uv.lock was regenerated. There are no version downgrades — the diff is limited to uv simplifying environment markers plus the new [options] block.
• Tests pass: uv run --group test pytest -q → 1 passed.

Pull Request Checklist

• Pre-Commit Checks were ran and passed
• Tests were ran and passed
• (If applicable) The prose documentation has been updated
• (If applicable) The reference documentation has been updated

Close Issue(s)

• Closes build: pin uv resolver with exclude-newer #19

Summary by Sourcery

Configure uv to ignore distributions published within the last week to improve dependency resolution reproducibility and supply-chain safety.

Build:

• Add a [tool.uv] configuration section in pyproject.toml that pins the resolver with exclude-newer = "1 week".
• Regenerate uv.lock to capture the new exclude-newer setting and updated resolution metadata.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Configure uv’s resolver to ignore distributions published within the last week, enforce a minimum uv version that understands the new settings, and regenerate the lockfile to capture the new resolution metadata.

File-Level Changes

Change	Details	Files
Configure uv resolver behavior via a new [tool.uv] section to add an exclude-newer rolling window and first-party package opt-outs.	Add a [tool.uv] configuration table specifying resolver-related settings. Require uv version >= 0.9.25 so exclude-newer-package behavior is supported and older uv installs fail fast. Set exclude-newer = "1 week" so uv ignores distributions published within the last week during dependency resolution. Configure exclude-newer-package overrides so first-party packages (litestar, advanced-alchemy, polyfactory) are exempt from the cooldown.	pyproject.toml
Update uv.lock to reflect the new resolver configuration and regenerated dependency resolution metadata.	Regenerate the uv lockfile so it records the exclude-newer span option and associated resolution settings. Accept uv’s simplification of environment markers and addition of the new [options] block without changing locked versions.	uv.lock

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#19	Add a [tool.uv] configuration with exclude-newer to pyproject.toml to make dependency resolution reproducible.	✅
#19	Implement a rolling cutoff policy for dependency resolution using uv’s exclude-newer setting.	✅
#19	Document the exclude-newer dependency resolution policy in CONTRIBUTING.	❌	The diff only shows changes to pyproject.toml and uv.lock; no updates to CONTRIBUTING or other documentation files are present.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[hasansezertasan]

CI failure is unrelated to this PR's changes. All test matrix jobs (3.8–3.11), validate, and codeql pass. The only failing job is sonar:

ERROR Failed to query JRE metadata: .
Please check the property sonar.token or the environment variable SONAR_TOKEN.

This is a SonarCloud auth problem — SONAR_TOKEN appears to be empty/expired/invalid. Since the sonar job's fork guard passed, secrets are being injected, so the token itself needs to be renewed by a repo/org admin. Not a code issue in this diff.

Note: sonarsource/sonarcloud-github-action@master now resolves to scanner 7.x (which requires the token up-front for its JRE download) and is deprecated in favor of sonarqube-scan-action — worth pinning/migrating in a separate infra PR.

[hasansezertasan]

Addressed the allow-list request in 28a9f2b.

uv supports per-package overrides via exclude-newer-package (docs). I've opted the first-party litestar-org packages out of the cooldown while keeping the 1-week guard on all third-party deps:

[tool.uv]
exclude-newer = "1 week"
exclude-newer-package = { litestar = false, advanced-alchemy = false, polyfactory = false }

Notes:

• = false means "no cutoff" for those packages, so their newest releases are always resolvable — supply-chain cooldown still applies to everything else.
• = false requires uv >= 0.9.25 (CI + local are well past this).
• Only litestar is an actual dependency today; advanced-alchemy/polyfactory are included as sensible ecosystem defaults for projects generated from this template — harmless until pulled in. Happy to trim to just litestar if preferred.
• uv.lock regenerated; uv lock --check passes.

[hasansezertasan]

Is this allow-list enough for now?