🔧 Dependabot: back to the default strategy, with the review rule written down

.github/dependabot.yml

@@ -21,26 +21,22 @@ updates:
       prefix: ⬆️
     schedule:
       interval: monthly
-    # `increase-if-necessary`, because the default (`auto`, which is `increase` for a project
-    # that has a lockfile) EDITS MANIFESTS EVEN WHEN NOTHING REQUIRES IT, and every specifier
-    # in this workspace's manifests is a decision: floors are series (`ty~=0.0.80`,
-    # `types-docutils~=0.20.0`), caps carry their reason as a comment, and the
-    # intra-workspace floors are moved by `propagate_floors.py` at release time. Measured on
-    # the 2026-09 batch (#1940): `auto` raised sphinx-needs' `matplotlib>=3.3.0` -- the floor
-    # of a user-facing extra, which already allowed the new release -- to `>=3.11.2`, the
-    # newest release; an earlier batch rewrote `~=0.20.0` as `>=0.20,<0.24`.
-    #
-    # With this, a requirement that already allows the new release is left alone and only
-    # the lock moves. A release OUTSIDE a range (44 of the 97 external specifiers here carry
-    # a cap or a series) still produces a pull request that widens the range -- and that is
-    # wanted: it is the one signal that a new major exists, and the review of that pull
-    # request is where a stale reason comment or a widened series gets re-expressed by hand.
-    # `lockfile-only` was considered and rejected for exactly that reason: it never edits a
-    # manifest, but it also never proposes such a release, so the workspace would sit on an
-    # old series until a user noticed. The `ignore` rules below are unaffected: they stop
-    # the lock-only updates the manifests WOULD allow but the test matrix and the typing
-    # floor do not want.
-    versioning-strategy: increase-if-necessary
+    # NO `versioning-strategy`, deliberately, after measuring both alternatives (#1942, #1944).
+    # The default (`auto`, which is `increase` for a project with a lockfile) EDITS MANIFESTS
+    # even when nothing requires it: the 2026-09 batch (#1940) raised sphinx-needs'
+    # `matplotlib>=3.3.0` -- the floor of a user-facing extra that already allowed the new
+    # release -- to `>=3.11.2`, widened sphinx-codelinks' `click < 8.2` past the comment that
+    # explained the cap, and an earlier batch rewrote `~=0.20.0` as `>=0.20,<0.24`. Those
+    # rewrites are reviewed and undone BY HAND on the pull request; the root AGENTS.md says
+    # how. `increase-if-necessary` would stop the gratuitous rewrites, but it is not usable
+    # here: every strategy except lockfile-only UNLOCKS a requirement before asking uv for the
+    # newest resolvable version, and for the `typing` group's `docutils~=0.20.0` that asks uv
+    # to resolve docutils 0.23 beside `sphinx~=7.4`, which forbids it -- and under that
+    # strategy the failure is fatal to the WHOLE job ("Dependabot can't resolve your Python
+    # dependency files"), so no update of any kind arrives. `lockfile-only` never unlocks and
+    # never edits, but it also never proposes a release outside a range, and 44 of the 97
+    # external specifiers here carry a cap or a series -- the widening pull request is the one
+    # signal that a new major of one of them exists. So: the default, plus review.
     ignore:
       # the `sphinx-7`, `sphinx-8` and `sphinx-9` dependency groups pin one series each,
       # on purpose: they are the test matrix, and which three series are tested is a

AGENTS.md

@@ -418,6 +418,18 @@ move's pull request.
 4. **Changelog**: update `packages/sphinx-needs/docs/changelog.rst`
 5. **Code quality**: `uv run poe lint` and `uv run poe typecheck` pass
 
+**Reviewing a dependabot pull request for the uv ecosystem: read the `pyproject.toml` hunks,
+not only the lock.** Dependabot's default strategy rewrites manifest specifiers alongside the
+lock, and every specifier in this workspace is a decision: it raises a floor to the new release
+even when the floor already allowed it (`matplotlib>=3.3.0` became `>=3.11.2` in #1940, on a
+user-facing extra), widens a cap past the comment that explains the cap (`click < 8.2` became
+`click<8.6`, breaking taplo's alignment, which is how Lint caught it), and turns a `~=` series
+into a `>=,<` pair. Keep the lock update, restore the specifier lines by hand on the dependabot
+branch, and relock; a cap or a series that really should move gets its own pull request with
+the reason re-checked (#1943 is the shape). `versioning-strategy` cannot fix this here: both
+alternatives were measured in #1942 and #1944, and `.github/dependabot.yml` says why the
+default stays.
+
 ## Issues and labels
 
 Every issue and pull request carries one or more `pkg:` labels naming what it concerns: