Tip: Use pip's New Dependency Cooldowns to Defend Agent Environments Against Supply Chain Attacks

Richard Si·medium signalXBlueskyLinkedInCopy link

pip 26.1's '--uploaded-prior-to' flag lets you specify a cooldown period (e.g., 'P7D' for 7 days) so pip won't install packages uploaded within that window. For AI agent environments that auto-install dependencies, this is a direct defense against supply chain poisoning — a malicious package uploaded today won't be pulled until the cooldown expires, giving the community time to flag it. Combine with pylock.toml lockfiles for reproducible, tamper-resistant agent deployments. Syntax: 'pip install --uploaded-prior-to P3D -r requirements.txt'.