Context

Python dependencies are pinned by a single uv.lock, maintained by two writers: the weekly uv Lock Update workflow and Dependabot (security updates only). Dependabot resolves with the repository's exclude-newer setting, which corrupts its pull requests (dependabot-core#14156). S pull request can claim an update while removing or downgrading packages. and delays urgent security patches by up to a week. The exact required-version pin also forces every developer to keep that exact uv installed, since uv fails fast on any mismatch.

Follow the approach taken in DRIVERS-3727: let Dependabot manage uv.lock fully, with its cooldown option replacing exclude-newer.

Definition of done

• Dependabot opens one grouped weekly PR updating uv.lock (direct and transitive dependencies) with a 7-day cooldown; security updates are not delayed by the cooldown.
• exclude-newer is removed from pyproject.toml and the recorded options in uv.lock.
• The weekly uv Lock Update workflow is deleted.
• [tool.uv] required-version stays unset unless a needed uv feature requires it; GitHub Actions, Evergreen, and local dev use the latest uv otherwise.
• The process is documented in CONTRIBUTING.md and AGENTS.md.

Pitfalls

• Never set exclude-newer under [tool.uv] — Dependabot resolving with it corrupts PRs (dependabot-core#14156).
• Dependabot ships its own uv; a pin its uv cannot satisfy blocks lockfile updates entirely.
• The Evergreen bootstrap keys off required-version; the no-pin case needs a working fast path.