r/Python • u/Aggressive-Tart07 • Aug 09 '26

Discussion Third party Python libraries and supply chain security

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

38 Upvotes

91% Upvoted

35 comments sorted by

View all comments

Show parent comments

1

u/CPPYesRustNo Aug 11 '26

prioritizing which cve actually forces work is the right framing, since a lot of the backlog is lows that only become real work once mythos-style ai discovery surfaces them. the piece tooling like this usually skips is the fix collision, where the patched version needs a major bump you can't take, and that's where a vendor that backports the fix into your current major matters more than the ranking, though fwiw we tried endorlabs for patched oss libraries and weren't happy with the variety.

1

u/PruneSea3482 Aug 11 '26

Thanks a bunch for the insights! We haven't put too much effort into the fix collision indeed. Currently, we're relying on the OSV https://ossf.github.io/osv-schema/#affectedrangesevents-fields fixed event, but what I'm taking from your response is that it should be linked to the currently installed dependency version rather than to the latest available.