[jeffdupont]

Summary

Dependabot's first run raised the minimum versions in the published packages' pyproject.toml files, which would force every user of those packages to upgrade:

• chore(deps): bump ai from 0.7.0 to 0.8.0 #266: ai>=0.7,<0.8 → ai>=0.8.0,<0.9 (vercel-agents, vercel-messages)
• chore(deps): bump openai-agents from 0.17.7 to 0.24.0 #267: openai-agents>=0.17,<0.25 → openai-agents>=0.24.0,<0.25
• chore(deps-dev): bump langchain-openai from 1.3.3 to 1.7.2 #265: langchain-openai>=1.3 → >=1.7.2 (langchain-agents, langchain-messages), and the root langchain-openai>=0.3 → >=1.7.2
• chore(deps-dev): bump langchain-anthropic from 1.4.8 to 1.7.6 #263: langchain-anthropic>=1.4.8 → >=1.7.6, and the anthropic extras >=1.4 → >=1.7.6

This sets versioning-strategy: 'lockfile-only' on the uv entry, so Dependabot updates uv.lock and never edits a package's version requirements. The GitHub Actions entry is unchanged.

The other values uv accepts were considered and not used:

• increase raises the floor; auto (the default) raised it in this repo's first run, as above.
• increase-if-necessary keeps a requirement that already allows the release, but still raises the floor when the release falls outside the range (^1.0.0 becomes ^2.0.0 in GitHub's docs).
• widen is not accepted for uv; Dependabot's config check rejects it.

Trade-off: with lockfile-only, Dependabot opens no PR for a release outside a package's range, such as ai 0.8 against ai>=0.7,<0.8. Moving a range stays a manual decision.

After this merges, comment @dependabot recreate on #263, #265 and #267 so they are rebuilt as lock-file updates. #266 will likely close, since ai 0.8 is outside the range.

Not in scope: #263, #265 and #267 also fail the parameter-forwarding tests because the new provider releases accept new keys. Those need classifying in each handler and are a separate change.

🤖 Generated with Claude Code

---

Note

Overview
Dependabot’s uv workspace entry now uses versioning-strategy: lockfile-only, with comments that published packages should only get uv.lock bumps—not edits to pyproject.toml version floors.

This reverses behavior where the first Dependabot run raised minimum requirements (e.g. ai, openai-agents, langchain-*), which would have forced downstream users to upgrade. GitHub Actions Dependabot settings are unchanged.

Trade-off: releases outside an existing semver range won’t get automatic PRs; widening or bumping published ranges stays manual.

^{Reviewed by Cursor Bugbot for commit 045190e. Bugbot is set up for automated code reviews on this repo. Configure here.}