Python

We're looking for strategies to improve dependency security in our Python projects, specifically for pip and uv. We're trying to implement an "age gate" similar to how npm has npmMinimalAgeGate – basically, preventing the installation of very new packages that might be risky. The challenge: pip and uv don't seem to have a direct, built-in way to enforce this "minimum upload age" directly in their config. pip has --uploaded-prior-to, but it's a command-line flag, not a persistent config. Seeking advice on: Age Gates for Python: How do you prevent installing brand new, potentially untrusted packages with pip or uv? Dependency Security Strategies: What are your best practices for managing and upgrading dependencies securely across Python projects? Tools/Workarounds: Any tools, scripts, or clever config tricks for pip/uv that achieve a similar "age gate" effect? Any tips or insights would be super helpful! Thanks! 🙏

For those using uv, you can at least partially protect yourself against such attacks by adding this to your pyproject.toml: [tool.uv] exclude-newer = "7 days " or this to your ~/.config/uv/uv.toml: exclude-newer = "7 days " This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you install it. From https://news.ycombinator.com/item?id=47547140 Here is the official uv docs https://docs.astral.sh/uv/concepts/indexes/#configuring-exclude-newer-for-an-index

awesome, thanks. This may push me to using uv instead of pip. Do you use uv?

yes, that's fine but it's not enforcable in config

It is As with all pip options, it does support env variables and global configs https://pip.pypa.io/en/stable/topics/configuration/

looks like you need an offtopic group, please delete the off-topic message(s) and continue this conversation at @pythonofftopic

I'm stuck on a topic to finish my thesis, and that is that the article code uses the mlp method, but I use the drl method. Now I want to bring the criteria to see which one has better performance or not and whether the accuracy of the work is higher than the article or not, because I have to show it to the referee, what should I do?

Write code to compare these methods

How can i make bots in python?

You can use the Telegram Bot API and read its documentation. You can also use the requests library to call the API directly. If you prefer not to work with raw requests, you can use frameworks like telebot or aiogram. Alternatively, if you want lower-level access, you can use MTProto via libraries such as Telethon or Pyrogram.

do u know that programming language?

Or we tell him to learn Python 🤷‍♂

What is python?

Maybe he is a learner so I answer him on the size of his question

Almost always who asks for telegram bots doesn't know the programming languange he want to use

Oh, we have the same intent. But if one knows python, then there's no need to ask that kind of question. First step is to learn python then.

don't feel bad bro 👍🏻