Managing Package Risks with Astral's Exclude-Newer Option

Do you trust a package released two hours ago in production? Installing updated package versions is essential to benefit from new features and bug fixes. However, freshly released versions can introduce bugs or incompatibilities before the community has time to catch them. uv from Astral's exclude-newer option lets you set a cooldown period to skip packages released within a specified timeframe. To use it, add exclude-newer = "7 days" to pyproject.toml and customize the duration as needed. 📬 Want more production-ready data science tips? Subscribe to my newsletter at https://bit.ly/49sglaM #uv #Python #DevOps #PackageManagement

  • No alternative text description for this image

If everyone does this, who will find the issues? We'll all just have to gradually keep increasing from 7 days to 14 to... Joking but also thinking. 🤔

My recommendation is usually to pin the version or until the minor, then you know breaking changes will not be introduced in your app and you still get new features and bug fix. Use locks (uv.lock) and above all of that unit tests will make sure your code is not breaking for something trivial like a library update

That’s why we have isolated development environments. There’s absolutely no reason to deploy a latest release of any software package without determining how it will effect your production environment.

Always define the correct version. Future updates might break your system.

For similar reasons, I am currently sticking with Python v3.11 on my macOS and Linux development machines. I am building and deploying to both OS environments and have found oddities and incompatibilities with some of the AI/ML libraries with newer Python versions.

I think I trust it if my tests (including regression) pass fine. It makes more sense to me to be developing effective tests around expected use cases and then stay up to date on CVEs

Like
Reply

Khuyen Tran , great post! Have you run into any issues with uv when dealing with multi-platform builds (e.g., developing on M1/M3 Mac but deploying to Linux)? Does the lockfile hold up as strictly as Poetry's?"

See more comments

To view or add a comment, sign in

Explore content categories