We're looking for strategies to improve dependency security in our Python projects, specifically for pip and uv.
We're trying to implement an "age gate" similar to how npm has npmMinimalAgeGate – basically, preventing the installation of very new packages that might be risky.
The challenge: pip and uv don't seem to have a direct, built-in way to enforce this "minimum upload age" directly in their config. pip has --uploaded-prior-to, but it's a command-line flag, not a persistent config.
Seeking advice on:
Age Gates for Python: How do you prevent installing brand new, potentially untrusted packages with pip or uv?
Dependency Security Strategies: What are your best practices for managing and upgrading dependencies securely across Python projects?
Tools/Workarounds: Any tools, scripts, or clever config tricks for pip/uv that achieve a similar "age gate" effect?
Any tips or insights would be super helpful! Thanks! 🙏