feat: codify CVE policy

[mr-cal]

Codifies our policy for handling CVEs in direct and transitive dependencies.

---

• I've followed the contribution guidelines.
• I've signed the CLA.
• I've successfully run make lint && make test.
• I've added or updated any relevant documentation.
• In documents I changed, I added a meta description if one was missing.
• I've updated the relevant release notes.

[Copilot]

Pull request overview

Codifies guidance for handling CVEs via comments in pyproject.toml, clarifying how applications vs libraries should manage vulnerable direct and transitive dependencies when using dependency-groups and uv constraints.

Changes:

• Adds policy guidance for CVEs in [dependency-groups].
• Expands guidance for CVE avoidance in [tool.uv].constraint-dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bepri]

I'm not sure this sufficiently explains the policy. As I understand it, libraries should just do what we've been doing (bump the lockfile and move on with our lives), while applications should also:

• Pin direct dependencies in project.dependencies
• Pin optional dependencies in dependency-groups
• Pin indirect dependencies in uv.tool.constraint-dependencies

[mr-cal]

As I understand it, libraries should just do what we've been doing (bump the lockfile and move on with our lives)

I thought that the agreement was to use constraint-dependencies in libraries to reduce exposure to having vulnerable builds in the CI jobs for that library?

[bepri]

I thought that the agreement was to use constraint-dependencies in libraries to reduce exposure to having vulnerable builds in the CI jobs for that library?

I don't recall that point, I mostly remembered Tiago mentioning that it gives a false sense of security since uv doesn't consider constraint-dependencies of dependencies when building a project. But with that in mind, yeah, I agree with you.

[mr-cal]

I don't recall that point, I mostly remembered Tiago mentioning that it gives a false sense of security since uv doesn't consider constraint-dependencies of dependencies when building a project. But with that in mind, yeah, I agree with you.

I'm going to summon @lengau as well, as I think that was his idea. I think it would only affect the minimum-version CI job.