From 998e0b5046f53d7a7328f9cd3cc8736c216f7d35 Mon Sep 17 00:00:00 2001 From: Nelson Spence Date: Mon, 25 May 2026 11:17:18 -0500 Subject: [PATCH] chore(deps): keep the numpy >=1.20 floor; ignore Dependabot floor bumps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ordvec-python is dep-light + abi3-py39, and rust-numpy 0.27 supports numpy 1.x AND 2.x at runtime, so we keep numpy >=1.20 for broad/legacy accessibility (Python 3.9 + numpy 1.x stacks). Raising the floor to >=2.0.2 (Dependabot #48) would drop those users — numpy 2.1+ also dropped Python 3.9 — for zero gain: ordvec's speed is its Rust SIMD kernels; numpy is only the zero-copy array container. Add an 'ignore' for numpy so Dependabot stops re-proposing the floor bump (maturin + security advisories still flow). Declines #48, closed manually with this rationale. --- .github/dependabot.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bc0d0f94..dacc9274 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -35,7 +35,14 @@ updates: - "minor" - "patch" - # ordvec-python declared Python deps (numpy). Grouped; no-op if nothing parseable. + # ordvec-python's only runtime dep is numpy, and its floor is a DELIBERATE + # broad/legacy-compatibility choice: ordvec is dep-light + abi3-py39, and + # rust-numpy 0.27 supports numpy 1.x AND 2.x at runtime, so we keep numpy + # >=1.20 (usable on Python 3.9 + numpy 1.x legacy stacks). Raising the floor to + # 2.x would drop those users (numpy 2.1+ also dropped Python 3.9) for zero gain + # — ordvec's speed is its Rust kernels; numpy is just the zero-copy array + # container. So `ignore` numpy to stop Dependabot re-proposing the floor bump. + # maturin (build dep) updates and security advisories still flow. - package-ecosystem: "pip" directory: "/ordvec-python" schedule: @@ -48,6 +55,9 @@ updates: update-types: - "minor" - "patch" + ignore: + # Hold the broad numpy floor (see above); do not auto-raise it. + - dependency-name: "numpy" # fuzz/ is a workspace-EXCLUDED standalone crate (own Cargo.lock), nightly-only # cargo-fuzz tooling. Dev-only surface, low priority — group all, tight PR limit.