chore(deps): enforce seven-day third-party release-age policy

.agents/skills/custom-codereview-guide.md

@@ -117,11 +117,27 @@ window.
 
 ### Dependencies and supply chain
 
-Apply the general seven-day release-recency guard to the exact dependency version,
-regardless of the package's age or popularity. Validate installation with the
-package manager and runtime used by the extension. Temporary git pins and
-unreleased package APIs are blockers for merge unless the PR is an explicit,
-coordinated stack that will replace them before release.
+Validate installation with the package manager and runtime used by the extension.
+Temporary git pins and unreleased package APIs are blockers for merge unless the
+PR is an explicit, coordinated stack that will replace them before release.
+
+For dependency additions or updates, inspect every changed third-party npm or
+PyPI version, including transitive lockfile changes. Require at least seven days
+since publication of that exact version. Use registry publication/upload metadata
+or the relevant artifact's `uv.lock` `upload-time`; a weekly bot schedule, an old
+package name, or a passing install is not age evidence.
+
+For an under-seven-day artifact, leave a COMMENT naming the package, version,
+publication time, and source, and defer approval until it ages out or a maintainer
+explicitly approves a narrowly documented exception. If publication time is
+unavailable, ask for that evidence. Existing named first-party exemptions apply
+only to those packages, not their third-party dependencies or blanket approval
+of the lockfile. Apply this check before any dependency-bump fast path.
+
+Flag removal or weakening of seven-day uv/Dependabot guards or new broad
+exemptions. Dependabot security updates bypass cooldown, so review them under
+the explicit maintainer-exception rule in `AGENTS.md`; agents cannot approve
+their own bypass.
 
 ### Design context for deep changes
 

.github/dependabot.yml

@@ -10,6 +10,8 @@ updates:
 
   - package-ecosystem: npm
     directory: /
+    cooldown:
+      default-days: 7
     schedule:
       interval: weekly
     commit-message:
@@ -18,6 +20,8 @@ updates:
 
   - package-ecosystem: pip
     directory: /
+    cooldown:
+      default-days: 7
     schedule:
       interval: weekly
     commit-message:

AGENTS.md

@@ -209,3 +209,36 @@ Important notes:
 
 - Prefer the official OpenHands docs on skills: https://docs.openhands.dev/overview/skills
 - Prefer the SDK skill guide: https://docs.openhands.dev/sdk/guides/skill
+
+## Dependency release-age policy
+
+- Wait at least seven days after publication before adding or updating a
+  third-party npm or PyPI version, including transitive lockfile changes.
+  A weekly update schedule alone does not enforce this minimum age.
+- Keep Dependabot `cooldown.default-days: 7` for npm and Python version
+  updates, and preserve `tool.uv.exclude-newer = "7 days"` where configured.
+  Existing named first-party exceptions do not exempt their third-party
+  dependencies. Do not add broad exemptions or disable the cutoff to make a
+  resolver succeed.
+- Verify the exact version's publication/upload time from npm or PyPI metadata
+  (or artifact `upload-time` in `uv.lock`), not the package's creation date.
+  If age cannot be established, report the missing evidence rather than guess.
+- Security updates can bypass Dependabot cooldown. An urgent exception needs
+  explicit maintainer approval recorded in the PR with the package, version,
+  advisory/reason, and publication time. Agents must not grant themselves an
+  exception. Keep overrides narrow and remove temporary exceptions afterward.
+- Use the committed lock for reproducible installs; review newly resolved
+  artifacts before committing a lock update.
+
+For manual npm dependency resolution, use npm >= 11.10 with
+`npm install --min-release-age=7` (days), or verify registry timestamps before
+committing the result. Older npm versions do not enforce this option. `npm ci`
+replays the lock and is not proof that newly locked versions meet the age rule.
+
+Use uv >= 0.9.25 for this policy. Older versions cannot parse the boolean
+first-party exemptions and can discard the entire `[tool.uv]` table, including
+`required-version`. Check `uv --version` before running `uv sync`, `uv lock`,
+or `uv run`; this repository does not commit a lockfile to reject old parsers.
+The named exemptions cover the released SDK, tools, workspace, and agent-server
+packages used by the documented import checks; their third-party dependencies
+still have the seven-day cutoff.

pyproject.toml

@@ -30,3 +30,10 @@ test = [
 [tool.pytest.ini_options]
 pythonpath = ["python", "skills/github/scripts"]
 testpaths = ["tests"]
+
+[tool.uv]
+required-version = ">=0.9.25"
+exclude-newer = "7 days"
+
+# Only first-party artifacts bypass the wait, not their dependencies.
+exclude-newer-package = { openhands-sdk = false, openhands-tools = false, openhands-workspace = false, openhands-agent-server = false }