Repository navigation
Expand file tree
/
Copy pathuv.toml
More file actions
32 lines (30 loc) · 2.1 KB
/
Copy pathuv.toml
File metadata and controls
32 lines (30 loc) · 2.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
# Fail loudly on a uv too old to honor the cooldown below: relative
# `exclude-newer` durations parse from 0.11, and the lockfile sentinel
# handling that keeps `uv sync --locked` stable landed in 0.11.8.
required-version = ">=0.11.8"
# Dependency cooldown: never resolve a distribution uploaded within the
# last 7 days, so a compromised or yanked release has a window to surface
# before it gets pinned. uv records the relative span in uv.lock (as
# `exclude-newer-span`) rather than a fixed date, so the pinned versions
# stay reproducible and `uv sync --locked` keeps passing; the cooldown is
# only re-applied when a resolution actually runs (`uv lock`, `--upgrade`,
# `--refresh`, or a dependency change).
exclude-newer = "P7D"
# Per-package cooldown exemptions (each scoped to one package, a fixed date
# just past its publish time, so the global P7D supply-chain cooldown still
# guards every other dependency):
# - cwsandbox: first-party CoreWeave SDK pinned to an exact, tested version
# (the `cwsandbox` extra), published 2026-06-11. Drop once aged past P7D.
# - google-antigravity: the SDK the `antigravity` harness drives (the
# `antigravity` extra in pyproject), published 2026-06-11. Drop once aged
# past P7D.
# - nimble-python: the verified Agent API V2 1.2 contract release, required by
# nimble_research for typed run fields. Drop once it has aged past P7D.
# - mlflow / mlflow-skinny / mlflow-tracing: the mlflow release train cross-pins
# all three to the same version (mlflow==X depends on mlflow-skinny==X and
# mlflow-tracing==X), so all three must be exempted together. 3.16.0
# (published 2026-09-04) relaxes the transitive cryptography cap from <50 to
# <51, which unblocks cryptography 50.0.0 (CVE-2026-69247); 3.16.0 is also
# above the mlflow AI Gateway SSRF range <=3.15.2 (CVE-2026-71211). Drop once
# aged past P7D (2026-09-11).
exclude-newer-package = { cwsandbox = "2026-06-12T00:00:00Z", google-antigravity = "2026-06-12T00:00:00Z", nimble-python = "2026-07-29T00:00:00Z", mlflow = "2026-09-05T00:00:00Z", mlflow-skinny = "2026-09-05T00:00:00Z", mlflow-tracing = "2026-09-05T00:00:00Z" }