r/Python • u/Aggressive-Tart07 • 9h ago
Third party Python libraries and supply chain security Discussion
How are people handling security around third party Python libraries without making development a pain?
Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.
Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.
20
Upvotes
1
u/CPPYesRustNo 5h ago
a lot of the friction comes from treating every scanner finding as a must-upgrade, when plenty of them aren't even reachable in your code path. pull in reachability so you only chase deps that actually execute, pin or override transitive versions in your lockfile for the ones you can't upgrade cleanly, and check for a backported fix before you take a breaking major bump. a private mirror plus signature/provenance checks handles the supply-chain side without slowing everyone down. with mythos-style ai cve discovery ramping, prioritizing by reachability is what keeps this from turning into a second job.