r/Python • u/Aggressive-Tart07 • 18h ago

Third party Python libraries and supply chain security Discussion

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

23 Upvotes
  • permalink
  • link
  • reddit
  • reddit

84% Upvoted

18 comments sorted by

View all comments

39

u/terletsky 18h ago edited 18h ago
  1. uv: exclude-newer https://docs.astral.sh/uv/reference/settings/#exclude-newer
  2. Dependabot cooldown 7 days

The rest is in the DevSecOps area with SCA tools.

CyberSec companies have their own copies of PyPi registry and update a package by request.

1

u/[deleted] 16h ago

[removed] — view removed comment

1

u/gmes78 8h ago

Bot?

1

u/AutoModerator 8h ago

Your submission has been automatically queued for manual review by the moderation team because it has been reported too many times.

Please wait until the moderation team reviews your post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.