Security: add minimum package release age gate against supply chain attacks (#746)

wiggzz · web-flow · commit d52c041ab687 · 2026-05-04T09:41:20.000-05:00
diff --git a/.changes/unreleased/Security-20260501-124250.yaml b/.changes/unreleased/Security-20260501-124250.yaml
@@ -0,0 +1,3 @@
+kind: Security
+body: Add 7-day minimum package release age gate to prevent supply chain attacks via freshly-published malicious packages
+time: 2026-05-01T12:42:50.530604-05:00
diff --git a/.tool-versions b/.tool-versions
@@ -1,5 +1,5 @@
 nodejs 20.17.0
-uv 0.8.19
+uv 0.11.8
 task 3.43.2
 pnpm 10.15.1
 shellcheck 0.11.0
diff --git a/pyproject.toml b/pyproject.toml
@@ -45,6 +45,10 @@ dependencies = [
   "filelock~=3.20.3",
   "starlette~=0.50.0",
 ]
+[tool.uv]
+exclude-newer = "7 days"
+exclude-newer-package = { dbt-protos = false, dbt-sl-sdk = false, dbtlabs-vortex = false }
+
 [dependency-groups]
 dev = [
   "ruff>=0.11.2",
diff --git a/uv.lock b/uv.lock

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+kind: Security`
	`2`	`+body: Add 7-day minimum package release age gate to prevent supply chain attacks via freshly-published malicious packages`
	`3`	`+time: 2026-05-01T12:42:50.530604-05:00`