chore(deps): stop Dependabot ratcheting uv dependency floors

[claude]

Product Description

No user-facing change. Repo hygiene for how Dependabot maintains Python dependency constraints.

Technical Description

Follow-up to #4067 (review comment).

Dependabot's default versioning strategy raises the pyproject.toml floor to whatever version it just resolved, whether or not the code needs it. #4067 is the example: it moved the floor to packaging>=26.2, but OCS uses only Version and InvalidVersion — stable since well before packaging 20.0.

A mechanically-raised floor costs resolver headroom for nothing: it makes the project unresolvable alongside any future co-installed package that caps the dependency, without buying any capability the code actually uses.

Two changes:

1. .github/dependabot.yml — set versioning-strategy: "increase-if-necessary" on the uv ecosystem. Dependabot now updates uv.lock alone and edits pyproject.toml only when the new version genuinely falls outside the declared constraint.

   increase-if-necessary rather than lockfile-only deliberately: lockfile-only never touches the manifest, which would freeze the intentionally pinned/capped deps (pyTelegramBotAPI==4.12.0, Django<6, django-oauth-toolkit>=3.2.0,<4.0.0) out of updates entirely, since their new versions fall outside the declared range by construction.

   The npm, github-actions and pre-commit ecosystems are left alone — out of scope for this follow-up.

2. pyproject.toml / uv.lock — restore the packaging floor to >=23.2, its value before chore(deps): bump packaging from 23.2 to 26.2 #4067. The resolved version in uv.lock stays 26.2; only the root requires-dist specifier changes. This stands on its own regardless of whether the config change lands.

Migrations

• The migrations are backwards compatible

No migrations — dependency metadata only.

Demo

The whole diff is three lines of substance:

   - package-ecosystem: "uv"
     directory: "/"
     open-pull-requests-limit: 5
     schedule:
       interval: "monthly"
+    versioning-strategy: "increase-if-necessary"

-    "packaging>=26.2",
+    "packaging>=23.2",

-    { name = "packaging", specifier = ">=26.2" },
+    { name = "packaging", specifier = ">=23.2" },

Docs and Changelog

• This PR requires docs/changelog update

---

Verification notes — please read before merging

• I edited the requires-dist specifier in uv.lock by hand rather than running uv lock, because uv commands were not permitted in my sandbox. The edit is what a re-lock produces for a floor loosening that does not change resolution (26.2 satisfies >=23.2, and nothing else in the tree constrains packaging), but CI's check-uv-lock job is the authority — if it fails, running uv lock locally will fix it.
• I could not reach the web to re-confirm from the Dependabot options reference that versioning-strategy is honoured for the uv ecosystem specifically. It is supported for the Python ecosystems generally and uv support was built on that code path, but worth a glance at Insights → Dependency graph → Dependabot after merge: an unsupported key surfaces there as a config error, and the next monthly uv PR is the real confirmation.
• Not run: pytest, uv lock --check, pre-commit — no uv/python execution available in this sandbox. Nothing changed here is importable code, so CI's check-yaml / check-toml / check-uv-lock cover it.

Generated with Claude Code