Summary

The python/uv-lock-update workflow regenerates uv.lock with one uv version, while Dependabot's security updates for uv run with the different uv baked into dependabot-core's updater image. When Dependabot's uv stops satisfying the consumer's [tool.uv] required-version pin, Dependabot's security updates fail without opening a pull request or failing a check — the only trace is in Dependabot's own logs. The action should keep the pin aligned with Dependabot's uv as part of its weekly run.

Motivation

Who is the affected end user?

Maintainers of repositories that consume python/uv-lock-update and pin a uv version, which currently is only the Python driver, but we identified this gap for drivers-evergreen-tools in DRIVERS-3564.

How does this affect the end user?

Dependabot security updates for Python dependencies stop arriving, and no check turns red.

How likely is it that this problem or use case will occur?

Main path: Dependabot's updater image moved its uv roughly monthly in 2026 (0.11.8 through 0.13.5), so any pin diverges within weeks.

If the problem does occur, what are the consequences and how severe are they?

Vulnerability patches reach uv.lock only through the weekly bulk upgrade, silently delayed about a week.

Is this issue urgent?

No fixed timeline, but it should land before repositories adopt required-version pins.

Is this ticket required by a downstream team?

Yes — the drivers-evergreen-tools workspace migration (DRIVERS-3564) plans to consume this behavior, as well as the Python driver.

Is this ticket only for tests?

No. It changes the action's behavior for consumers.

Acceptance Criteria

• When opted in, the action keeps required-version compatible with the uv version Dependabot's latest updater image ships, and the aligned pin ships as a reviewed change in its pull request.
• The weekly lock update still completes in the same run.
• Consumers who do not opt in see no behavior change.
• A Dependabot image bump costs at most one weekly cycle without Dependabot pull requests, followed by a visible alignment.