build: use pip's dependency cooldown feature

[behnazh-w]

Summary

Use pip's --uploaded-prior-to option to avoid installing packages that have very recently been published to PyPI. By doing so, this allows for human operators like security researchers and PyPI admins a chance to respond to reports of malware. See: https://blog.pypi.org/posts/2026-04-02-incident-report-litellm-telnyx-supply-chain-attack/

[jenstroeger]

This is great and very useful to avoid immediate CI breakage with new packages!

[jenstroeger]

Might not apply here, but the default macOS date command will fail:

jens@pooh ~ > which date  # GNU date command.
/opt/local/libexec/gnubin/date
jens@pooh ~ > date -d '2days' -Idate
2026-04-12
jens@pooh ~ > /bin/date -d '2days' -Idate  # macOS default date command
/bin/date: illegal option -- d
usage: date [-jnRu] [-I[date|hours|minutes|seconds]] [-f input_fmt]
            [-r filename|seconds] [-v[+|-]val[y|m|w|d|H|M|S]]
            [[[[mm]dd]HH]MM[[cc]yy][.SS] | new_date] [+output_fmt]

[jenstroeger]

I keep looking for the documentation of this notation 🤔 PYPI_UPLOAD_DELAY_DAYS=1 after the target is a variable passed to make?

If I use

PYPI_UPLOAD_DELAY_DAYS=1 make setup

then PYPI_UPLOAD_DELAY_DAYS is an environment variable passed to make (discussion) so it’s available in the Makefile (docs).

But I can’t find the above notation documented?