From 66dc7e4f14903311d75fdf1b6a11e2b9d675a8a6 Mon Sep 17 00:00:00 2001 From: Rok Benko Date: Mon, 14 Sep 2026 08:15:21 +0200 Subject: [PATCH] chore(deps): dependabot moves the lock, a person moves a floor PR #11 was uv.lock and nothing else. PR #15 also rewrote pyproject.toml, raising four published floors that nothing asked it to raise: openai from >=1.50 to >=3.11.0 across ten lines, narrowing the openai extra, all eight vendor extras and `all` at once, plus mcp, mujoco and onnxruntime. None of those floors had ever been tested. The lock has resolved openai 3.x since the first commit, mcp 2.1.1 throughout, onnxruntime 1.27.0. They are hand-written claims about what a consumer may install against, and they carry comments explaining themselves. A weekly bot should not be editing them. versioning-strategy: lockfile-only is supported on the uv ecosystem (dependabot-core#12162) though the options reference still omits it. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 599718e..2630fd0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,6 +2,12 @@ version: 2 updates: - package-ecosystem: "uv" directory: "/" + # uv.lock is what CI actually tests; the floors in pyproject.toml are hand-written and say + # what a consumer may install against. Without this, a weekly bump raises those floors to + # whatever it just locked -- #15 turned openai>=1.50 into >=3.11.0 across ten lines, and + # narrowed all eight vendor extras for a reason no test ever asked for. Lock-only keeps the + # two apart: dependabot moves the lock, a person moves a floor and says why. + versioning-strategy: "lockfile-only" schedule: interval: "weekly" groups: