Support quarantine #10646
Description
Issue Kind
Brand new capability
Description
Hello,
Thank you for your great work with poetry
An effective security method is to defer the use of dependencies: give it some time between the release time and the application in your project (depending on the environment etc)
poetry could implement that feature, perhaps through a dedicated new command line argument (and/or a default configuration in pyproject.toml)
The current behavior would be kept by default
The argument would be a number of days (strictly > 0)
poetry would exclude all packages whose upload-time is lower than now - timedelta(days=number_of_days)
Dependencies resolution would then process as usual
(this is a bit like the processing of the "yanked" package status)
Best regards,
Impact
This would help people increase the security of their project (optionally)
Workarounds
None known