Upgrade minimum uv version to 0.9.17 and add supply-chain defense

[tsvikas]

Summary

This PR upgrades the minimum required uv version from 0.7.3 to 0.9.17 across the project and adds a supply-chain defense mechanism by excluding package versions released within the last 24 hours.

Key Changes

• Updated minimum uv version requirement to 0.9.17 in:

  • pyproject.toml
  • project_name/pyproject.toml.jinja
  • README.md
  • .github/workflows/uv-tests.yml (test matrix)

• Added supply-chain defense configuration via exclude-newer = "24 hours" in:

  • pyproject.toml
  • project_name/pyproject.toml.jinja
  • Includes explanatory comment about the lightweight defense against just-published malicious releases

• Simplified CI workflow by removing the Python version compatibility workaround for older uv versions (the sed command that was only needed for uv 0.7.3)

Implementation Details

The exclude-newer setting is a uv feature that prevents dependency resolution from considering package versions released within the specified time window, providing protection against supply-chain attacks while maintaining reasonable package freshness. This is now enforced as a best practice in the template.

https://claude.ai/code/session_01GvHcqWhhUrpn8qd3JuHxnx

[sourcery-ai]

Hey - I've left some high level feedback:

• The new exclude-newer = "24 hours" default is quite opinionated; consider exposing it as a template variable in project_name/pyproject.toml.jinja so consumers can easily opt out or adjust the window without editing generated files.
• You now have the uv minimum version defined in three places (root pyproject.toml, template pyproject.toml.jinja, and README); consider centralizing this as a single source of truth for easier bumps (e.g., using a Copier variable rendered into both the template and README).

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The new `exclude-newer = "24 hours"` default is quite opinionated; consider exposing it as a template variable in `project_name/pyproject.toml.jinja` so consumers can easily opt out or adjust the window without editing generated files.
- You now have the `uv` minimum version defined in three places (root `pyproject.toml`, template `pyproject.toml.jinja`, and README); consider centralizing this as a single source of truth for easier bumps (e.g., using a Copier variable rendered into both the template and README).

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}