build: add supply chain hardening via uv exclude-newer and pip uploaded-prior-to by julian-risch · Pull Request #3258 · deepset-ai/haystack-core-integrations

julian-risch · 2026-04-30T09:47:53Z

Related Issues

Similar to Haystack PR build: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails haystack#11170

As recent motivation for this PR, there has been a compromised PyPI release of the mistralai package. Only version 2.4.6 was affected. It was uploaded on May 12, 2026 at 00:05 UTC and has been removed on May 12, 2026 at 03:05 UTC according to Mistral AI. Details here.

Given the short time window, uv exclude-newer and pip uploaded-prior-to seem to be a reasonable supply-chain security improvement.

Proposed Changes:

Add uv.toml with exclude-newer = "24 hours" so all uv pip installs skip packages published within the last day
Add Dependabot cooldown (default-days: 1) for github-actions and pip
Upgrade pip before each pip install step and add --uploaded-prior-to=P1D (pip 26.1 relative duration) to all direct pip install commands in CI
Add UV_NO_CONFIG=1 to the llama_stack "Test Llama Stack Server" step to exempt it from exclude-newer: the PyTorch wheel index omits upload dates for sympy, causing uv to use the cutoff itself as the fallback timestamp — placing those packages exactly at the exclusive boundary and excluding them regardless of the date set

How did you test it?

Ran uv pip install mistralai locally, which seems to also pick up the root uv.toml.

Notes for the reviewer

I am unsure if the changes to root uv.toml are enough or if the setting should be in pyproject.toml of all individual integrations. My understanding is that the uv.toml is enough because this will protect our CI.

I would merge despite failing tests once approved.

Checklist

I have read the contributors guidelines and the code of conduct
I have updated the related issue with new insights and changes
I added unit tests and updated the docstrings
I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test:.

- Add uv.toml with exclude-newer = "24 hours" so all uv pip installs skip packages published within the last day - Add Dependabot cooldown (default-days: 1) for github-actions and pip - Upgrade pip before each pip install step and add --uploaded-prior-to=P1D (pip 26.1 relative duration) to all direct pip install commands in CI Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-05-15T10:24:53Z