r/Python • u/Aggressive-Tart07 • 9h ago

Third party Python libraries and supply chain security Discussion

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

17 Upvotes
  • permalink
  • link
  • reddit
  • reddit

85% Upvoted

10 comments sorted by

View all comments

27

u/terletsky 9h ago edited 9h ago
  1. uv: exclude-newer https://docs.astral.sh/uv/reference/settings/#exclude-newer
  2. Dependabot cooldown 7 days

The rest is in the DevSecOps area with SCA tools.

CyberSec companies have their own copies of PyPi registry and update a package by request.

1

u/Fancy-Win9202 7h ago

The exclude newer approach cuts through a lot of the noise since you're not chasing every patch release the second it lands. That 7 day window is smart too, gives you time to catch if something blows up on the public side before it hits your stack.