From 77cfa040ceb228b7afaa4ed6e50f83b9a5cfc99c Mon Sep 17 00:00:00 2001
From: Cemil ILIK <cemililik@outlook.com>
Date: Sun, 18 Oct 2026 11:58:56 +0300
Subject: [PATCH 1/2] fix(ci): make dependabot.yml parse by dropping
 versioning-strategy widen for pip

GitHub's Dependabot check on every pull request that touched the file reported:
  The property '#/updates/0/versioning-strategy' value "widen" did not match one of the following values:
  lockfile-only, auto, increase, increase-if-necessary
so the whole configuration was rejected and Dependabot opened nothing. 'widen' is valid for npm and Composer, not for pip. The key is
removed (the default is auto), the header comment says why, and a test pins the values the pip ecosystem accepts (it fails against the old
file).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml  | 13 +++++++------
 CHANGELOG.md            |  3 +++
 tests/test_packaging.py | 23 +++++++++++++++++++++++
 3 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cacb425c..69d81387 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,11 +5,13 @@
 # `tools/check_pip_audit.py` and the nightly CVE job catch known advisories, and
 # these pull requests make a fix reachable.
 #
-# `versioning-strategy: widen` matters here. ForgeLM declares bounded ranges
-# (`>=floor,<next-major`) with no lockfile and no pins, so Dependabot's default
-# `increase` strategy would try to raise a floor the ceiling already covers — a
-# no-op — instead of admitting a new major. `widen` keeps the declared floor and
-# raises the ceiling, which is the change the ranges actually need.
+# No `versioning-strategy` is set for `pip`. The `pip` ecosystem accepts only `auto`,
+# `increase`, `increase-if-necessary` and `lockfile-only`; a previous `widen` is not
+# among them, GitHub rejected the whole file ("did not match one of the following
+# values"), and while it did not parse Dependabot opened nothing. ForgeLM declares
+# bounded ranges (`>=floor,<next-major`) with no lockfile, so the default (`auto`) may
+# raise a floor the ceiling already covers instead of admitting a new major; look at the
+# first pull requests and tighten this then.
 #
 # `ruff`, `mypy` and `bandit` are ignored on purpose. They are blocking CI gates
 # and `tests/test_packaging.py` requires their `[dev]` range to equal the one
@@ -25,7 +27,6 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
-    versioning-strategy: "widen"
     labels:
       - "dependencies"
       - "area: packaging-ci"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c86b509b..be8360e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -74,6 +74,9 @@ All notable changes to ForgeLM are documented here.
 
 ### Fixed
 
+- Make `.github/dependabot.yml` parse. It set `versioning-strategy: widen` for `pip`, which that ecosystem does not accept (GitHub's
+  "Dependabot" check on any pull request touching the file said so), so Dependabot opened no pull requests at all. The setting is removed, the
+  header comment says why, and a test pins the accepted values.
 - Correct claims in the roadmap and strategy documents: `forgelm chat` does not screen for safety and reads no YAML
   config (#91), the live risk rows no longer name a past "August 2026" deadline (#75), and
   `docs/product_strategy.md` (English and Turkish) names the real `evaluation.auto_revert` field instead of a
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index ab8c562e..283bce69 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -244,6 +244,29 @@ def test_setuptools_security_floor_meets_pysec_2026_3447() -> None:
     )
 
 
+def test_dependabot_config_uses_only_values_the_pip_ecosystem_accepts() -> None:
+    """GitHub rejects the whole ``dependabot.yml`` for one bad value, and Dependabot then opens nothing.
+
+    ``versioning-strategy: widen`` is valid for npm and Composer but not for ``pip``; the file shipped with it and
+    the "Dependabot" check on every pull request that touched the file said so while the weekly run silently never
+    happened.  The accepted values are listed in GitHub's error message.
+    """
+    import yaml
+
+    config = yaml.safe_load(
+        (Path(__file__).resolve().parents[1] / ".github" / "dependabot.yml").read_text(encoding="utf-8")
+    )
+    accepted = {"auto", "increase", "increase-if-necessary", "lockfile-only"}
+    for update in config["updates"]:
+        if update["package-ecosystem"] != "pip":
+            continue
+        strategy = update.get("versioning-strategy")
+        assert strategy is None or strategy in accepted, (
+            f"versioning-strategy {strategy!r} is not accepted for the pip ecosystem ({sorted(accepted)})"
+        )
+    assert any(u["package-ecosystem"] == "pip" for u in config["updates"]), "the pip update block is gone"
+
+
 def _lint_job_pins() -> dict[str, Requirement]:
     """Requirements the ci.yml lint job installs directly.
 

From de9438b81b9b6149a4caa7c60ad11c189f2e5ed9 Mon Sep 17 00:00:00 2001
From: Cemil ILIK <cemililik@outlook.com>
Date: Sun, 18 Oct 2026 12:21:50 +0300
Subject: [PATCH 2/2] docs(changelog): keep the Dependabot entry user-facing

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba0701b5..1e2a4e12 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -89,7 +89,7 @@ All notable changes to ForgeLM are documented here.
 
 - Make `.github/dependabot.yml` parse. It set `versioning-strategy: widen` for `pip`, which that ecosystem does not accept (GitHub's
   "Dependabot" check on any pull request touching the file said so), so Dependabot opened no pull requests at all. The setting is removed, the
-  header comment says why, and a test pins the accepted values.
+  header comment explains the restriction.
 - `training.rope_scaling` works on transformers 5 again. The setting was passed to `from_pretrained(rope_scaling=...)`,
   which no longer works: the documented `{type: linear, factor: 4}` raised `KeyError: 'rope_type'` while the model was
   built, and `{rope_type: ..., factor: ...}` replaced the whole parameter dict so `rope_theta` was lost (`TypeError`).