You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by "slbotbm (via GitHub)" <gi...@apache.org> on 2026/05/13 05:40:13 UTC

[I] [python sdk] implement protections against python supply chain attacks with uv [iggy]

slbotbm opened a new issue, #3246:
URL: https://github.com/apache/iggy/issues/3246

   ### Description
   
   Due to the increase in supply chain attacks in recent months, I'd like to add dependency cooldown to pyproject.toml
   
   ### Component
   
   None
   
   ### Proposed solution
   
   In pyproject.toml, add:
   ```toml
   [tool.uv]
   exclude-newer = "7 days"
   ```
   
   ### Alternatives considered
   
   None


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [python sdk] implement protections against python supply chain attacks with uv [iggy]

Posted by "raushanprabhakar1 (via GitHub)" <gi...@apache.org>.
raushanprabhakar1 commented on issue #3246:
URL: https://github.com/apache/iggy/issues/3246#issuecomment-4450511324

   Hi @slbotbm , requesting you to review. Thanks


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [python sdk] implement protections against python supply chain attacks with uv [iggy]

Posted by "slbotbm (via GitHub)" <gi...@apache.org>.
slbotbm commented on issue #3246:
URL: https://github.com/apache/iggy/issues/3246#issuecomment-4437833189

   We should also consider adding `uv audit` to the pre-commit hooks. Running it does not show any vulnerabilities, currently.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [python sdk] implement protections against python supply chain attacks with uv [iggy]

Posted by "slbotbm (via GitHub)" <gi...@apache.org>.
slbotbm commented on issue #3246:
URL: https://github.com/apache/iggy/issues/3246#issuecomment-4526119798

   Let's have two PR's: 
   - one for wiring pyrefly into pyproject.toml and the ci
   - one for the 7 day delay. Let's add uv audit to the ci only currently.
   
   I'll work on this in a few days if nobody picks this up.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [python sdk] implement protections against python supply chain attacks with uv [iggy]

Posted by "slbotbm (via GitHub)" <gi...@apache.org>.
slbotbm commented on issue #3246:
URL: https://github.com/apache/iggy/issues/3246#issuecomment-4438374302

   Also add type checking using pyrefly. which reached version 1.0


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [python sdk] implement protections against python supply chain attacks with uv [iggy]

Posted by "hubcio (via GitHub)" <gi...@apache.org>.
hubcio closed issue #3246: [python sdk] implement protections against python supply chain attacks with uv
URL: https://github.com/apache/iggy/issues/3246


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org