Conversation
Two ignore rules to stop Dependabot regenerating PRs that can never be merged as-is. mcp >=2: mcp 2.0 replaced the low-level Server decorator API that create_server() is built on. #22 proposed relaxing the pyproject cap to <3 and failed every test job (79 failed, 28 errors locally on 3.12). That is a code migration, tracked in #18, so the bump should not reappear weekly until the migration is done. actions/checkout + softprops/action-gh-release patch/minor: both are referenced by floating major tag, which already tracks patch and minor releases. A pin PR is therefore churn at best — and #16 showed it can pin backwards, proposing v3.0.1 when @V3 already resolved to v3.0.2. astral-sh/setup-uv is intentionally excluded from the second rule: v8.0.0 stopped publishing floating tags, so it must be pinned to a full version and does need patch/minor PRs to stay current. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VQfx6LNbvunGxhNZcbyoMS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stops Dependabot regenerating two PRs that can never be merged as written. Follow-up to the triage that merged #23 and #15 and closed #22 and #16.
mcp >= 2mcp 2.0 replaced the low-level
Serverdecorator API (@server.list_tools/@server.call_tool) with constructor-based handler registration, soclimax_mcp.create_server()cannot run on 2.x — which is whypyproject.tomlcaps it at<2.#22 proposed relaxing that cap to
<3. I built the branch and ran the suite on Python 3.12: 79 failed, 266 passed, 28 errors, and CI on the PR failed all three of 3.11/3.12/3.13. Getting to 2.x is a migration ofcreate_server(), tracked in #18 — not a version bump — so it shouldn't reappear weekly until that work happens.Remove this entry as part of #18.
actions/checkout+softprops/action-gh-releasepatch/minorBoth are referenced by floating major tag (
@v7,@v3), which already picks up patch and minor releases without any PR. So these bumps are churn — and #16 showed they can be actively harmful: it proposed pinningaction-gh-releasetov3.0.1when@v3already resolved to the same commit asv3.0.2, i.e. a downgrade of what CI runs.Major bumps still open a PR, which is the case that genuinely warrants review.
Why
astral-sh/setup-uvis excludedDeliberately not covered by the second rule. setup-uv v8.0.0 stopped publishing floating tags — there is no
v8orv8.0ref, confirmed viagit ls-remote— so it has to be pinned to a full version, and it does need patch/minor PRs to stay current. A blanketdependency-name: "*"rule here would have silently frozen setup-uv until v9.That exact-pin migration is #17, which is rebasing now.
🤖 Generated with Claude Code
https://claude.ai/code/session_01VQfx6LNbvunGxhNZcbyoMS