[aig-hannes]

Why

Part of OP-3650. Renovate waits 5 days before it opens an update PR (minimumReleaseAge), but its weekly lock file maintenance has no release date to check. It can lock a transitive release that is only hours old.

What

• [tool.uv] gets exclude-newer = "5 days". uv then does not lock a PyPI release that is less than 5 days old, and Renovate's uv lock follows the same rule.
• The lock files are relocked with the uv version this repo pins. Only their options header changes; every locked package version stays the same:
• uv.lock

The wording matches the foundry-python template (v2.5.3), so a later template update merges cleanly. To ship a security fix before its 5 days pass, add a dated entry under [tool.uv.exclude-newer-package], as described in the template's docs/foundry/code-quality.md.

No other change.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/op-3650-uv-cooldown → main

View scan in OX Security →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 2 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud