chore(deps): enforce lockfile release age with uv

[eXPerience83]

Summary

Move the 3-day lockfile release-age enforcement to the layer that can actually evaluate transitive package upload times.

• Keep Renovate's existing minimumReleaseAge: "3 days" policy unchanged for direct dependency updates.
• Exempt pep621 lockFileMaintenance updates from Renovate's unsupported minimumReleaseAge check.
• Add exclude-newer = "3 days" to [tool.uv] so uv enforces the same cooldown during lockfile resolution.
• Regenerate uv.lock with the repository-pinned uv 0.12.1 using plain uv lock (no --upgrade).

Lockfile result

The lockfile regeneration changed metadata only; no dependency versions or artifact hashes changed:

[options]
exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
exclude-newer-span = "P3D"

Validation performed before opening this PR

• uv lock completed successfully with the project-pinned uv 0.12.1 on a GitHub-hosted runner.
• renovate-config-validator --strict renovate.json completed successfully.
• Final branch diff contains exactly three files: renovate.json, pyproject.toml, and uv.lock.
• The branch was cleaned to one commit; temporary validation workflows are not part of the PR.

Scope

This is a tooling-only change. It does not modify integration runtime, migration, workflows, documentation, versions, or the pytest / PHACC / Home Assistant compatibility policy. The separate compatibility failures in Renovate PRs #258 and #259 are intentionally out of scope.

Summary by CodeRabbit

• Chores
  • Added a three-day cooldown for newly released packages during dependency resolution.
  • Updated automated dependency maintenance to handle lockfile updates without enforcing a minimum release-age requirement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5fc1e91c-1b06-4f19-b211-f70281546502

📥 Commits

Reviewing files that changed from the base of the PR and between 59b86ab and 1bea94c.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• pyproject.toml
• renovate.json

---

📝 Walkthrough

Walkthrough

The dependency configuration adds a three-day uv package cutoff. Renovate pep621 lock maintenance updates bypass the minimum release-age rule.

Changes

Dependency policy

Layer / File(s)	Summary
Release-age configuration pyproject.toml, renovate.json	uv excludes packages newer than three days. Renovate disables minimum release-age enforcement for pep621 lock maintenance updates.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enforcing dependency release-age controls for the lockfile with uv.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}