From 765dd8edf3365e0fa66d1b4c8ff9b7bb912cce8a Mon Sep 17 00:00:00 2001 From: Jeff Dupont Date: Mon, 2 Nov 2026 13:20:10 -0800 Subject: [PATCH 1/3] chore(ci): keep published version floors in Dependabot updates Dependabot raised the minimum versions in the packages' pyproject.toml (for example ai>=0.7,<0.8 to ai>=0.8.0,<0.9), which forces every user to upgrade. increase-if-necessary leaves a requirement alone when it already allows the new release, and otherwise widens it. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 24f13d0f..bc96491d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,6 +3,9 @@ updates: - package-ecosystem: 'uv' # uv workspace root: one uv.lock covers every packages/* member. directory: '/' + # These are published libraries: keep each package's minimum version and + # only widen a range when a new release falls outside it. + versioning-strategy: 'increase-if-necessary' schedule: interval: 'daily' cooldown: From 405786890ead3054e55430a61f2731bb7761f746 Mon Sep 17 00:00:00 2001 From: Jeff Dupont Date: Mon, 2 Nov 2026 13:21:13 -0800 Subject: [PATCH 2/3] chore(ci): widen ranges instead of raising floors increase-if-necessary still raises the floor when a release falls outside the range (^1.0.0 becomes ^2.0.0). widen keeps the old minimum. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bc96491d..8414c0cb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,8 +4,8 @@ updates: # uv workspace root: one uv.lock covers every packages/* member. directory: '/' # These are published libraries: keep each package's minimum version and - # only widen a range when a new release falls outside it. - versioning-strategy: 'increase-if-necessary' + # widen the range to take a new release instead of raising the floor. + versioning-strategy: 'widen' schedule: interval: 'daily' cooldown: From 045190ea39ad10954d116c5741a8a10a21d9bc95 Mon Sep 17 00:00:00 2001 From: Jeff Dupont Date: Mon, 2 Nov 2026 13:22:14 -0800 Subject: [PATCH 3/3] chore(ci): update only uv.lock in Dependabot updates uv does not accept widen, and increase-if-necessary still raises the floor when a release falls outside the range. lockfile-only never edits the packages' requirements. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8414c0cb..6ceeaa25 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,9 +3,9 @@ updates: - package-ecosystem: 'uv' # uv workspace root: one uv.lock covers every packages/* member. directory: '/' - # These are published libraries: keep each package's minimum version and - # widen the range to take a new release instead of raising the floor. - versioning-strategy: 'widen' + # These are published libraries: never change their version requirements, + # only uv.lock. A release outside a range is a manual decision. + versioning-strategy: 'lockfile-only' schedule: interval: 'daily' cooldown: