Add supply-chain cooldown for package updates#475
Open
darren-dooley wants to merge 1 commit into
Open
Conversation
Set Poetry solver.min-release-age=7 (requires Poetry >=2.4.0) and add a Dependabot cooldown of 10 days on the github-actions and pip ecosystems. Dependabot's window is longer than Poetry's floor so it never proposes a version the solver would reject as too young.
darren-dooley
requested review from
avishaiamiel and
omerr-cycode
as code owners
|
|
||
| [tool.poetry] | ||
| requires-poetry = ">=2.0" | ||
| requires-poetry = ">=2.4.0" |
Collaborator
There was a problem hiding this comment.
In version 2.4+ Poetry dropped support for Python 3.9.
While Python 3.9 reached EOL, it is still shipped as default for most operating systems and so we need to maintain backward compatibility
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Freshly published package versions are the highest-risk window for supply-chain attacks (compromised releases are often yanked within days of publication). Adding a cooldown means new releases must age before they can be adopted, giving the ecosystem time to catch and pull bad versions.
What
poetry.toml(new): setssolver.min-release-age = 7, so Poetry's solver ignores any release younger than 7 days when resolving the lock. This is project-local config, applied for everyone resolving in this repo. Requires Poetry >= 2.4.0 (the version the key was introduced in).pyproject.toml: bumpedrequires-poetryfrom>=2.0to>=2.4.0so the cooldown key is guaranteed to be honored..github/dependabot.yml: addedcooldown.default-days: 10to both thegithub-actionsandpipecosystems. Dependabot's window is intentionally longer than Poetry's 7-day floor so any version Dependabot proposes is already old enough for the solver to accept, avoiding PRs the lockfile resolution would reject as too young.Test case ran locally: