[blink1073]

PYTHON-6273

Changes in this PR

Dependabot now fully manages uv.lock, following DRIVERS-3727: one grouped weekly pull request with a 7-day cooldown, plus immediate ungrouped security updates. The cooldown replaces exclude-newer, which corrupted Dependabot's pull requests (dependabot-core#14156) and delayed security patches by up to a week.

• Removed the exclude-newer cutoff and the uv version pin, then regenerated uv.lock
• Deleted the weekly uv Lock Update workflow; the Evergreen bootstrap now skips uv setup when any uv is on PATH.

Test Plan

Config and documentation change with no runtime code paths, so no new unit tests:

• uv lock --check passes with uv 0.12.12 and 0.13.x (the static CI job's check).
• pre-commit passes on all changed files, and the dependabot.yml uv entry matches the merged DRIVERS-3727 upstream.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)?
• Is there test coverage?
• Is any followup work tracked in a JIRA ticket? If so, add link(s).

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

[Copilot]

🟢 Approval recommended

The review identifies no active issues blocking the migration to Dependabot-managed Python dependency updates.

No open issues 🎉

What changed in this PR

Moves Python dependency updates entirely to Dependabot, replacing the dedicated lockfile-update workflow and removing the project-wide uv version pin and release cutoff.

Changes:

• Enables grouped weekly Python dependency updates with a seven-day cooldown, while keeping security updates immediate and ungrouped.
• Regenerates uv.lock and lets bootstrap setup accept an existing uv installation when no version pin is configured.
• Updates contributor guidance and fuzzing compatibility notes.

File	Description
uv.lock	Removes the release cutoff, updates the lockfile revision, and adds interpreter-specific Atheris resolution.
pyproject.toml	Removes the uv pin and cutoff; clarifies the Atheris comment.
fuzz/​README.md	Qualifies platform restrictions as applying to the latest Atheris.
CONTRIBUTING.md	Documents Dependabot ownership, cooldown behavior, and unpinned uv setup.
AGENTS.md	Adds dependency-update guidance.
.github/​workflows/​uv-lock-update.yml	Deletes the separate weekly lockfile-update workflow.
.github/​dependabot.yml	Enables grouped weekly updates for direct and transitive Python dependencies.
.evergreen/​scripts/​setup-dev-env.sh	Updates a comment to remove pinned-uv wording.
.evergreen/​scripts/​setup_uv.py	Accepts any uv on PATH when no required version is configured.
.evergreen/​scripts/​install-dependencies.sh	Updates comments describing installation and setup checks.
.evergreen/​scripts/​configure-env.sh	Updates comments about uv precedence and configuration isolation.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The toolchain path rewrite corrupts default platform paths and can fail CI despite an installed interpreter, while the tests lack isolation from checkout configuration and adequate Windows guards.

3 open issues

• Preserve platform toolchain paths without the test override · New
• Apply the Unix-only test guard module-wide · New
• Run the script from an isolated temporary project tree · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because minor findings about uv setup documentation and regression-test invocation were omitted from the published review.

No open issues 🎉

3 resolved since last review

• Preserve platform toolchain paths without the test override
• Run the script from an isolated temporary project tree
• Apply the Unix-only test guard module-wide

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed for an unpublished documentation discrepancy: an existing uv on PATH is reused only when it resolves to the copy in UV_TOOL_BIN_DIR.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Evergreen bootstrap changes bypass uv interpreter discovery and alter Windows executable replacement, but the Unix-stub tests skip Windows, leaving actual uv/toolchain behavior on supported hosts needing human validation.

No open issues 🎉

_{Review effort: Balanced}