[Evil0ctal]

What and why

Dependabot opened #33 (httpx >=0.27 → >=0.28.1) and #34 (pydantic >=2.6 → >=2.13.5) for the Python SDK's runtime dependencies. sdk/python/pyproject.toml has no lockfile, so the default strategy (bump_versions, per the Dependabot job log) raises every >= floor to the newest release. For a library that is the wrong direction. A floor is the oldest version the SDK supports, so raising it only stops users from installing versions that still work. For the development pins it changes nothing, because CI installs the newest versions anyway.

versioning-strategy: increase-if-necessary leaves a requirement alone unless a release falls outside it. In dependabot-core (python/.../update_checker/requirements_updater.rb, skip_pyproject_update?), a pyproject requirement that the new version already satisfies is skipped when there is no lockfile and the strategy is not bump_versions. With pure floors, that means no pull request until one is actually needed.

#33 and #34 will be closed with a pointer here. #32 (the pytest-cov development pin) is merged separately, like #21–#23.

How it was verified

• .github/dependabot.yml parses and has 0 errors against the SchemaStore dependabot-2.0 schema
• The SDK's floors still hold. Re-checked for this PR: uv pip install --resolution lowest-direct -e '.[dev]' installs httpx 0.27.0 and pydantic 2.6.0, and pytest -q passes 375 tests on Python 3.10.11 and 3.11.14
• make test / make lint / make web-test / make e2e: not applicable, configuration only

Checklist

• Comments and identifiers are English
• No brand or platform names in code, tests, examples or documentation
• Tests cover the new behaviour: not applicable, Dependabot configuration
• documents/en/ and documents/zh/ both updated: not applicable
• CHANGELOG.md updated if a user can see the change: not user-visible
• Generated code was regenerated with make generate, not edited by hand: no generated code touched