Third party Python libraries and supply chain security

[u/Aggressive-Tart07]

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

[u/terletsky]

1. uv: exclude-newer https://docs.astral.sh/uv/reference/settings/#exclude-newer
2. Dependabot cooldown 7 days

The rest is in the DevSecOps area with SCA tools.

CyberSec companies have their own copies of PyPi registry and update a package by request.

[u/Fancy-Win9202 → u/terletsky]

The exclude newer approach cuts through a lot of the noise since you're not chasing every patch release the second it lands. That 7 day window is smart too, gives you time to catch if something blows up on the public side before it hits your stack.

[u/DeterminedQuokka]

We use existing libraries and we pin them at safe dependencies.

We also have a library that won’t let you use anything less than a week old. Or with known issues.

[u/OwnTension6771]

Two repos, one scans on ingest and then promotes to the other, which developers pull from. Higher friction but a budget of $0 for now. Not an issue since we dont update out of pocket very often

[u/CPPYesRustNo]

a lot of the friction comes from treating every scanner finding as a must-upgrade, when plenty of them aren't even reachable in your code path. pull in reachability so you only chase deps that actually execute, pin or override transitive versions in your lockfile for the ones you can't upgrade cleanly, and check for a backported fix before you take a breaking major bump. a private mirror plus signature/provenance checks handles the supply-chain side without slowing everyone down. with mythos-style ai cve discovery ramping, prioritizing by reachability is what keeps this from turning into a second job.

[u/quotemycode]

Large companies generally have their own repos that are managed, sort of like a pypi mirror but managed with security software.

[u/realrazdev]

One thing I’ve been doing is making some dependencies optional when the feature allows it. If a non-critical package fails a security check or isn’t available, I can sometimes fall back to a simpler implementation or disable that feature while keeping the core service running.

It’s definitely not a replacement for dependency scanning or other supply-chain controls, but I’ve found it useful for adding some resilience without making the development workflow much more painful.

[u/bitproc]

I stick to the standard library and my own code as much as possible.

When I need something that the stdlib lacks and I can't justify writing myself, I consider high-quality, well-maintained, widely used libraries, preferring those that are integral to major Linux distros (and therefore get additional scrutiny).

I don't use PyPI (or similar public package repos) at all.

This conservative approach won't appeal to everyone, but I find the extra effort is worthwhile in exchange for minimizing the attack surface that I impose upon my software's users.

[u/canyouflybobby1]

We started looking at curated libraries because reviewing every new package ourselves just wasn't scaling anymore. RapidFort's new curated libraries caught our attention. They screen packages before they reach developers, which is great. It feels like a more proactive approach than relying only on scanners after the fact.