PYTHON-6151 Define exclude-newer in pyproject.toml

.github/workflows/uv-lock-update.yml

@@ -40,3 +40,6 @@ jobs:
           app_id: ${{ vars.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
           dry_run: ${{ inputs.dry_run || 'false' }}
+          # Unset UV_EXCLUDE_NEWER, so the cutoff comes from exclude-newer in
+          # pyproject.toml instead of the action default.
+          exclude_newer: ""

CONTRIBUTING.md

@@ -639,15 +639,11 @@ and in CI. Continuous integration runs `uv lock --check`, which fails when the l
 no longer matches `pyproject.toml`.
 
 If that check fails on your pull request, regenerate the lock file and commit the result.
-The scheduled workflow's `uv-lock-update` action applies a 7 day cutoff
-(`exclude_newer: 7 days`, passed to uv as `UV_EXCLUDE_NEWER`) so a package version
-yanked shortly after release is less likely to land in the lock file. That cutoff
-lives in the action, not in `pyproject.toml`, so it does not apply automatically
-when you run `uv lock` locally — set `UV_EXCLUDE_NEWER` yourself so a freshly
-published (and possibly still-to-be-yanked) release doesn't end up in the lock file:
+A 7 day cutoff (`exclude-newer` in `pyproject.toml`) applies automatically, so a package
+version yanked shortly after release is less likely to land in the lock file:
 
 ```bash
-UV_EXCLUDE_NEWER="7 days" uv lock
+uv lock
 ```
 
 To resolve a `uv.lock` conflict when rebasing, check out either side and regenerate
@@ -657,6 +653,6 @@ rather than editing the file by hand. Which side you pick does not matter, becau
 
 ```bash
 git checkout --ours uv.lock
-UV_EXCLUDE_NEWER="7 days" uv lock
+uv lock
 git add uv.lock
 ```

pyproject.toml

@@ -53,6 +53,9 @@ Tracker = "https://jira.mongodb.org/projects/PYTHON/issues"
 # install-dependencies.sh installs it in Evergreen. Bump manually when a newer uv
 # is needed.
 required-version = "==0.12.12"
+# Skip dependency releases newer than 7 days. Defining it here keeps every uv
+# invocation on the same cutoff.
+exclude-newer = "7 days"
 # boto3 dropped Python 3.9 support in 1.43, so the universal lock forks at
 # 3.10. Without a floor the pre-3.10 fork back-solves to boto3 1.7.84 (2018),
 # whose vendored six and invalid escape sequences break test collection. No