Keep Dependabot off pydantic and let it read the tomli pin

Under the uv ecosystem Dependabot skips any requirement whose marker
contains `<`, so it never read the python_version < "3.13" pydantic line
or the tomli pin. On the pydantic lines it does read, it rewrites each
`!=X.Y.*` exclusion as `!=X.Y.0.dev`, as it did in #130. Ignore pydantic
for every update type, since its floors and exclusions are kept by hand,
and write the tomli marker as == "3.10", which is the same under
requires-python and has no `<`. uv.lock is unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QoCAyNyBAmzgSkofgvKjEg

Author: zeevmoney

.github/dependabot.yml

@@ -7,7 +7,8 @@ updates:
   # so a Dependabot PR here raises the *floor* consumers are allowed to install
   # on, not just the version CI happens to resolve. That is the whole point:
   # the floor is the exposure, and the audit gate in security.yml scans it
-  # explicitly.
+  # explicitly. pydantic's floors are the exception: they are kept by hand
+  # (see `ignore` below).
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
@@ -37,15 +38,26 @@ updates:
       minor-and-patch:
         update-types: ["minor", "patch"]
     ignore:
-      # pydantic is dual-supported on purpose: permit/utils/pydantic_version.py
-      # branches on PYDANTIC_VERSION and every model imports from either
-      # `pydantic` (v1) or `pydantic.v1` (v2 compat shim). A Dependabot major
-      # bump cannot reason about that and would silently propose dropping v1
-      # support, so majors are handled by hand. Minor/patch still flow through.
+      # pydantic is updated by hand, for every update type. The SDK supports
+      # both majors on purpose (permit/utils/pydantic_version.py), and
+      # [project].dependencies has one pydantic line per Python range, with
+      # floors and `!=` exclusions whose reasons are in the comments there.
+      # Dependabot cannot keep those lines correct:
+      # - it skips a requirement whose marker contains `<`, so the
+      #   python_version < "3.13" line would never be updated;
+      # - on the lines it does update, it rewrites each `!=X.Y.*` exclusion as
+      #   `!=X.Y.0.dev`, which lets the X.Y releases back in (as PR #130 did to
+      #   the old requirements.txt);
+      # - a major bump would drop pydantic 1 support.
+      # An ignore with no update-types also stops Dependabot security updates
+      # for pydantic. The audit gate in security.yml scans the newest pydantic
+      # and its pydantic 1 and pydantic 2 floors (resolved for Python 3.10), and
+      # fails on a fixable advisory. The pydantic versions in uv.lock move with
+      # `uv lock --upgrade-package pydantic`.
       #
-      # Removal gate: drop this entry once the SDK stops supporting pydantic v1.
+      # Removal gate: drop this entry once pydantic is one requirement with no
+      # `!=` exclusions and no `<` marker.
       - dependency-name: "pydantic"
-        update-types: ["version-update:semver-major"]
     commit-message:
       prefix: "deps"
       prefix-development: "deps-dev"

pyproject.toml

@@ -30,7 +30,8 @@ dependencies = [
     # 0.7.3 is the first loguru release that imports without a DeprecationWarning on
     # Python 3.14: earlier ones call asyncio.iscoroutinefunction, which 3.16 removes.
     "loguru>=0.7.3,<1",
-    # pydantic has one line per Python range. Why each version is excluded:
+    # pydantic has one line per Python range, updated by hand: Dependabot ignores
+    # pydantic (see .github/dependabot.yml). Why each version is excluded:
     # - CVE-2024-3772 (ReDoS in email validation) affects pydantic 1.x before
     #   1.10.13. Under pydantic 2, permit validates emails with the pydantic.v1 copy
     #   that pydantic 2 bundles, and only 2.4.2 and later bundle the fixed 1.10.13:
@@ -94,7 +95,9 @@ dev = [
     "ruff==0.6.9",
     # The offline tests and the migration skill's tests read [project].dependencies
     # from this file, and tomllib is in the standard library only from Python 3.11.
-    'tomli==2.4.1; python_version < "3.11"',
+    # The marker says == "3.10" rather than < "3.11", which is the same under
+    # requires-python, because Dependabot skips a requirement whose marker has `<`.
+    'tomli==2.4.1; python_version == "3.10"',
     # Imported directly by the offline tests (Request/Response are used to assert
     # on what the SDK actually put on the wire), as well as backing
     # pytest-httpserver. Keep it at 3.1.6 or later, the highest fixed version