Preventing Uv From Installing Packages Which Are Too New

uv can prevent packages newer than a fixed date. This is to prevent installation of malicious packages; a few days buffer should be enough for the PyPI admins to remove any offending packages from the registry.

How to prevent new packages on a project basis

In the pyproject.toml, add

[tool.uv]
exclude-newer = "5 days"

# less useful
exclude-newer = "2006-12-02T02:07:43Z"

How to prevent new packages globally

To set it up globally, use an environmental variable. Add this to whatever file your CLI loads up when it boots up. For example, ~/.bash_profile

export UV_EXCLUDE_NEWER="7 days"

How to override the setting

There is another setting which allows you to set a different date for specific packages, or turn them off completely. This is exclude-newer-package; unlike exclude-newer, this is a dictionary where you can set criteria for individual package

[tool.uv]
exclude-newer = "5 days"
exclude-newer-package = { tqdm = "2022-04-04T00:00:00Z", markupsafe = false }