Merge pull request #690 from headmin/dev_2.0

Add python cooldown

Author: robertgendler

pyproject.toml

@@ -54,6 +54,18 @@ Source = "https://github.com/usnistgov/macos_security"
 [project.scripts]
 mscp = "mscp.__main__:main"
 
+[tool.uv]
+# Dependency cooldown: the resolver ignores any release published less than a
+# week ago, so `uv lock` / `uv add` / `uv sync` won't adopt a brand-new (and
+# possibly compromised) version. Mirrors the 7-day cooldown in .renovaterc.json5.
+# Accepts a friendly duration ("1 week"), ISO 8601 ("P7D"), or an RFC 3339 date.
+# NOTE: this also delays security fixes — pair with an independent scanner.
+exclude-newer = "1 week"
+# Escape hatch: opt a single package OUT of the cooldown when you need a fix
+# immediately, e.g.  exclude-newer-package = { some-package = false }
+# Remove the override once the cooldown is acceptable for that package again.
+# exclude-newer-package = {}
+
 [tool.hatch.version]
 path = "src/mscp/__init__.py"