[stevewithey]

Why

Every Dependabot uv security update in this repo is failing, including urllib3 → 2.8.0 for alert #28 (high). The error is:

Python version incompatibility: The Python request from .python-version resolved to Python 3.10.22, which is incompatible with the project's Python requirement: >=3.13, <4.0 (from workspace member tools's project.requires-python).

Dependabot's uv updater doesn't read our .python-version (3.13). It takes the root requires-python (>=3.9) and picks the lowest Python it has installed, which is 3.10.22. It then runs pyenv local 3.10.22 and uv lock. The examples/tools workspace member requires >=3.13, so the lock can never resolve. uv python pin can't fix this because Dependabot overwrites the pin.

What

• examples/tools/pyproject.toml: requires-python changes from >=3.13 to >=3.10. The example uses no 3.11+ features.
• uv.lock: relocked. The lock now targets >=3.10, matching what Dependabot runs. The only additions are the 3.10 backports pytest needs (exceptiongroup, tomli) and the cp310–312 wheels. No pinned versions change.

Verification

• I reproduced Dependabot's steps locally: pinned 3.10, then ran uv lock --upgrade-package urllib3==2.8.0. It now succeeds.
• On 3.12 (the CI version), ruff format --check, ruff check and pytest all pass (28 tests).

Once this merges, Dependabot should open the urllib3 PR itself.

Not in scope

• tests/test_webhook.py uses datetime.UTC, which needs Python 3.11+. The test suite fails on 3.10 before and after this change. CI uses 3.12, so this isn't a blocker.
• The root package still declares >=3.9, but pytest>=9.0.3 and requests>=2.33.0 already need 3.10+. Worth bumping the published floor to >=3.10 separately.

🤖 Generated with Claude Code