Configure uv package cooldown

[dceoy]

Summary

• configure a one-week dependency cooldown in pyproject.toml
• preserve the Windows required-environment constraint
• exempt only pdmt5 so its latest release can resolve immediately
• keep pyright and all other third-party packages subject to the cooldown
• regenerate uv.lock and update vulnerable click 8.3.1 to 8.4.2

Configuration

[tool.uv]
required-environments = ["platform_system == 'Windows'"]
exclude-newer = "1 week"
exclude-newer-package = { pdmt5 = false }

Validation

• follows uv's documented dependency-cooldown configuration
• uv.lock records the resolved cutoff, P1W span, and pdmt5 = false
• pdmt5 is locked at 1.2.0
• click is locked at 8.4.2, fixing PYSEC-2026-2132
• the PR contains a single commit and changes only pyproject.toml and uv.lock

[greptile-apps]

Greptile Summary

This PR configures a one-week uv dependency cooldown in pyproject.toml and regenerates uv.lock accordingly, also updating click from 8.3.1 to 8.4.2 to address PYSEC-2026-2132.

• Adds exclude-newer = \"1 week\" and exclude-newer-package = { pdmt5 = false } to [tool.uv] so all packages age for a week before the resolver can pick them up, while pdmt5 remains exempt to always resolve to its latest release.
• Updates click to 8.4.2, fixing a known security advisory; pdmt5 is locked at 1.2.0 and metatrader5 stays at 5.0.5735.
• The lock file also silently drops the sys_platform == 'win32' marker from metatrader5's numpy dependency — this is harmless given the Windows-only required-environments constraint, but was not mentioned in the PR description.

Confidence Score: 4/5

Safe to merge — changes are limited to dependency configuration and a lock file regeneration with no runtime code modifications.

The pyproject.toml change is straightforward and uses the correct uv syntax. The click security update is clearly beneficial. The only item worth a second look is the unannounced removal of the sys_platform == 'win32' marker on metatrader5's numpy dependency in the lock file; it appears benign given the Windows-only required-environments setting, but confirming it reflects upstream metadata rather than a resolver quirk would give full confidence.

uv.lock — specifically the metatrader5/numpy marker change at line ~437.

Important Files Changed

Filename	Overview
pyproject.toml	Adds uv exclude-newer = "1 week" cooldown and exempts pdmt5 via exclude-newer-package; preserves the Windows required-environments constraint. Configuration syntax is correct per uv docs.
uv.lock	Regenerated lock file: adds cooldown options block, updates click 8.3.1 → 8.4.2 (security fix PYSEC-2026-2132), and silently drops the sys_platform == win32 marker from metatrader5's numpy dependency.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[uv resolve] --> B{Package released\nwithin last week?}
    B -- Yes --> C{Is package pdmt5?}
    B -- No --> E[Allow version]
    C -- Yes --> E
    C -- No --> D[Exclude version\ncooldown active]
    E --> F[Write to uv.lock]
    F --> G[click 8.4.2\nfixes PYSEC-2026-2132]
    F --> H[pdmt5 1.2.0\nexempt from cooldown]
    F --> I[All other deps\nsubject to 1-week cooldown]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[uv resolve] --> B{Package released\nwithin last week?}
    B -- Yes --> C{Is package pdmt5?}
    B -- No --> E[Allow version]
    C -- Yes --> E
    C -- No --> D[Exclude version\ncooldown active]
    E --> F[Write to uv.lock]
    F --> G[click 8.4.2\nfixes PYSEC-2026-2132]
    F --> H[pdmt5 1.2.0\nexempt from cooldown]
    F --> I[All other deps\nsubject to 1-week cooldown]

Loading

_{Reviews (1): Last reviewed commit: "Configure uv dependency cooldown" | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b75548455

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dceoy]

PR Review Summary

No actionable issues meeting the review’s reporting threshold were identified.

Checked

• pyproject.toml cooldown configuration, preservation of the Windows required-environments constraint, and the pdmt5 exemption
• uv.lock cooldown metadata, click 8.4.2 update, and the metatrader5/numpy marker change
• Current-head CI for 9b755484554523a14a6e807baf8319b658624cc4
• Existing review submissions and unresolved inline discussions to avoid duplicating already-reported concerns

Notes

• The existing unresolved review thread about declaring a minimum uv version for relative cooldown syntax remains applicable and was not duplicated here.
• The existing discussion of the regenerated metatrader5 dependency marker already covers that lockfile change.

Recommended Action

Address or disposition the existing uv-version compatibility thread before merging; no additional automated blocking concerns were identified.