chore(deps)!: 7-day dependency cooldown (uv exclude-newer + CI assert)

pyproject.toml

@@ -174,3 +174,27 @@ exclude = [
     "src/benchflow/rewards/rubric_config.py",
     "src/benchflow/experimental/mcp/reviewer_server.py",
 ]
+
+[tool.uv]
+# Dependency cooldown (hard rule): never resolve to a release younger than ~7
+# days. `exclude-newer` caps every `uv lock` at this timestamp; bump it to a date
+# >= 7 days in the past when intentionally taking updates. The CI check
+# `tests/test_dep_cooldown.py` fails if this date is ever within the last 7 days.
+#
+# Security exception: a freshly-published CVE fix (younger than the cap) is
+# allowed via a per-package override in `exclude-newer-package` below, with a
+# comment recording why. Remove the override once the package is >= 7 days old.
+exclude-newer = "2026-06-08T00:00:00Z"
+
+[tool.uv.exclude-newer-package]
+# Grandfathered exceptions for packages the repo already depends on that are
+# still younger than the cooldown. Each entry should age out (be removed) once
+# the package crosses 7 days old.
+#
+# litellm[proxy]==1.89.0 (2026-06-13) is an exact pin newer than the cap, so
+# resolution can't proceed without allowing it through.
+litellm = "2026-06-14T00:00:00Z"
+# starlette 1.3.1 (2026-06-12) fixes CVE-2026-54282/54283 but is < 7 days old;
+# allow it through so the cooldown doesn't roll back to the vulnerable 1.2.1.
+# (aiohttp 3.14.1 / python-multipart 0.0.32 are already >= 7 days old.)
+starlette = "2026-06-13T00:00:00Z"

tests/test_dep_cooldown.py

@@ -0,0 +1,37 @@
+"""Hard rule: the dependency cooldown — never resolve to a release younger than
+a 7-day window.
+
+`[tool.uv] exclude-newer` in pyproject caps every `uv lock` at a fixed timestamp.
+This test fails if that timestamp is ever within the last 7 days, so the lock can
+never include a brand-new (and thus less-vetted) release. When you intentionally
+take dependency updates, advance `exclude-newer` to a date still >= 7 days in the
+past. A genuinely urgent (e.g. security) fix younger than the cap is allowed only
+via an explicit, commented `[tool.uv.exclude-newer-package]` override.
+"""
+
+from __future__ import annotations
+
+import datetime
+import tomllib
+from pathlib import Path
+
+COOLDOWN_DAYS = 7
+_PYPROJECT = Path(__file__).resolve().parents[1] / "pyproject.toml"
+
+
+def test_uv_exclude_newer_enforces_dependency_cooldown() -> None:
+    cfg = tomllib.loads(_PYPROJECT.read_text(encoding="utf-8"))
+    raw = cfg.get("tool", {}).get("uv", {}).get("exclude-newer")
+    assert raw, (
+        "[tool.uv] exclude-newer is missing from pyproject.toml — it enforces the "
+        f"{COOLDOWN_DAYS}-day dependency cooldown and must be set."
+    )
+    cutoff = datetime.datetime.fromisoformat(str(raw).replace("Z", "+00:00"))
+    if cutoff.tzinfo is None:
+        cutoff = cutoff.replace(tzinfo=datetime.UTC)
+    age = datetime.datetime.now(datetime.UTC) - cutoff
+    assert age >= datetime.timedelta(days=COOLDOWN_DAYS), (
+        f"[tool.uv] exclude-newer ({raw}) is only {age.days}d old; the dependency "
+        f"cooldown requires it to be >= {COOLDOWN_DAYS} days in the past. Bump it "
+        f"to an older date (>= {COOLDOWN_DAYS}d ago) when taking dependency updates."
+    )