Summary

Python dependencies in this repository are pinned by a single uv.lock. Two writers maintain it: the weekly uv Lock Update workflow runs uv lock --upgrade, while Dependabot only opens security-update pull requests. Dependabot resolves with the repository's exclude-newer setting, and that combination corrupts its pull requests (dependabot-core#14156); a pull request can claim an update while actually removing or downgrading packages. Let Dependabot manage uv.lock fully, with its cooldown option replacing exclude-newer.

Motivation

Who is the affected end user?

Maintainers of this repository. Driver teams that consume these tools are unaffected; their CI keeps working either way.

How does this affect the end user?

Python dependency updates come from two pipelines that resolve with different uv versions and different settings. An urgent security patch can wait up to a week behind exclude-newer, and while that setting is present a Dependabot security pull request can silently corrupt uv.lock.

How likely is it that this problem or use case will occur?

Main path. Every Dependabot security update resolves against the exclude-newer cutoff, and every routine update waits out the cutoff window.

If the problem does occur, what are the consequences and how severe are they?

A malformed Dependabot pull request that is merged unreviewed removes or downgrades packages in uv.lock. Security patches are delayed by up to a week.

Is this issue urgent?

No fixed timeline. It should land before a required-version pin is added; that alternative is tracked in DRIVERS-3711.

Is this ticket required by a downstream team?

No.

Is this ticket only for tests?

No. It changes how dependencies are updated for this repository.

Acceptance Criteria

• Dependabot opens one grouped weekly pull request that updates uv.lock for all Python dependencies, direct and transitive, with a 7-day cooldown.
• Security updates are not delayed by the cooldown.
• exclude-newer is removed from pyproject.toml and from the recorded options in uv.lock.
• The weekly uv Lock Update workflow is deleted.
• [tool.uv] required-version stays unset unless a needed uv feature requires it; any such pin stays satisfiable by the uv version Dependabot ships.
• The dependency-update process is documented in CONTRIBUTING.md and AGENTS.md.