Invalid exclude-newer in pyproject.toml breaks uv add and makes local ruff disagree with CI #993

Refactoring Proposal

pyproject.toml sets an exclude-newer that uv cannot parse:

[tool.uv]
exclude-newer="1 week"

exclude-newer takes a date or an RFC 3339 timestamp, not a relative duration. Every uv invocation in the repo already says so:

warning: Failed to parse `pyproject.toml` during settings discovery:
  TOML parse error at line 81, column 15
     |
  81 | exclude-newer="1 week"
     |               ^^^^^^^^
  failed to parse year in date "1 week": failed to parse "1 we" as year

Describe the design issue(s) you have identified in the code

The warning is easy to scroll past, but it has three consequences that are not:

1. uv add fails outright. Adding any dependency through the normal command does not work.
2. uv lock re-resolves the entire tree. With the setting unreadable, nothing pins the resolution date, so adding one package rewrites the lockfile wholesale. Measured while scoping Documentation: Missing API Documentation #895: adding drf-spectacular brought in the 8 packages it needs plus 100 unrelated version bumps — exactly the churn the Dependabot PRs exist to deliver one at a time and reviewably.
3. Local ruff disagrees with CI. With the file unparseable, ruff falls back to its own defaults instead of the project's configuration, so ruff check on a developer's machine reports findings CI never shows — and, worse, can stay quiet about ones it does. A contributor who trusts the local run gets a red pipeline. This is what made Store sound uploads under a generated name (#699) #982's first CI run fail.

So the one-line typo is quietly blocking dependency work and making the local lint signal untrustworthy.

Which source files are affected to this issue(s)?

1. pyproject.toml (the [tool.uv] section);
2. uv.lock, indirectly — it is what churns.

Describe refactoring alternatives to redesign the code

The intent behind "1 week" cannot be expressed: uv has no relative form, so it needs a decision rather than a mechanical fix.

1. Pin a concrete date — exclude-newer = "2026-09-01T00:00:00Z" — and bump it deliberately when you want to take newer releases. Keeps the original intent of not silently absorbing brand-new versions, at the cost of a periodic manual bump.
2. Drop the line. Dependabot already gates upgrades one PR at a time with CI on each, which is arguably the control this setting was reaching for.
3. Either way, verify afterwards that uv add <pkg> succeeds and that uv lock touches only the new package, and that ruff check locally matches CI.

Whichever route, it is a one-line change — the reason this is an issue rather than a PR is that picking between them is a maintainer call.

Generated by Claude Code