From 016399a297f1407aa11437568197d6ff6a3f1d13 Mon Sep 17 00:00:00 2001 From: Denis Drobyshev Date: Thu, 27 Aug 2026 13:39:29 +0300 Subject: [PATCH] Stop proposing dependency floors this project cannot install The dev-tooling group raised the mypy floor to 2.3.1, which requires Python >=3.11. CI tests 3.9 through 3.13, so that leg failed at install in 41 seconds while the other four passed in about three minutes each. Not a flake, and a re-run does not fix it: the floor cannot move until 3.9 is dropped, and that is a decision about the support matrix rather than about a linter. update-types does not help, for the reason already written into lemma's configuration: for a `>=` constraint Dependabot files a "requirement update", which that filter does not match. So the ignore is unconditional. tqdm, onnx and onnxruntime are ignored for the other reason. Their lower bounds describe what a user may already have installed, not what CI resolves - pip takes the newest match either way. Raising them locks people out and changes nothing that gets tested, so they should move when the code needs a newer API, not on a schedule. --- .github/dependabot.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4c4da8a..9dd050f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -37,6 +37,24 @@ updates: update-types: ["version-update:semver-major"] - dependency-name: gymnasium update-types: ["version-update:semver-major"] + + # Dev tools that have dropped the oldest Python this project supports. + # mypy 2.3.1 requires >=3.11; CI tests 3.9, so raising the floor to it + # fails at install on that leg before a test runs. The floor cannot move + # until 3.9 is dropped, and that is a decision about the support matrix + # rather than about a linter. + # + # `update-types` does not help here: for a `>=` constraint Dependabot + # files a "requirement update", which that filter does not match. + - dependency-name: mypy + + # Lower bounds on these describe what a user may already have installed, + # not what CI resolves - pip takes the newest match either way. Raising + # them locks people out and changes nothing that gets tested, so they + # move when the code needs a newer API, not on a schedule. + - dependency-name: tqdm + - dependency-name: onnx + - dependency-name: onnxruntime open-pull-requests-limit: 5 - package-ecosystem: docker