[chris-colinsky]

Dependabot covered GitHub Actions only, so nothing kept uv.lock current and advisories against it went unaddressed. The lock pins only this repository's development, docs and CI environment; installs of the package never read it. The package's own dependency ranges do not change, and none of them excludes a patched version. Four commits.

Add uv to the Dependabot config. A uv entry: monthly, one python-packages group, a 7-day cooldown, and the same commit prefix as the Actions entry. The cooldown holds back version updates only, never security updates. SchemaStore's dependabot.yml schema lists uv outside its beta ecosystems, and the file validates against it.

Drop the unused mkdocs-material imaging extra. [imaging] installs Pillow and CairoSVG, which only Material's social and optimize plugins use, and mkdocs.yml enables neither. Dropping it removes nine packages from the lock and most of its advisories.

Upgrade locked packages with open advisories. uv lock --upgrade-package for the other eight alerted packages (anyio, black, certifi, filelock, mkdocs-material, opentelemetry-api, urllib3 and virtualenv) and what they pull along. The OpenTelemetry API, SDK and exporters move together to 1.45.1, and the instrumentation and semantic-conventions packages to 0.66b1. That adds opentelemetry-exporter-http-transport and opentelemetry-exporter-otlp-common to the lock and drops importlib-metadata and zipp. The rest of the lock stays where it was on purpose, so the new entry's first run has something to open.

Expect the SDK log handler's deprecation in tests. The OpenTelemetry SDK deprecates its own LoggingHandler, and install_log_bridge already uses the replacement from opentelemetry-instrumentation-logging. Five log-bridge tests attach the SDK's handler on purpose, since the bridge has to detect a handler that an application attached itself, and each printed the deprecation warning. They now mark that warning as expected. test_install_log_bridge_is_idempotent still runs the bridge's own path with warnings as errors.

Testing:

• Full suite on the final lock: 2346 passed, 481 skipped, 19 deselected. Pyright, ruff, format, the manifest check and the repeated-import check are clean.
• With the SDK deprecation turned into an error, the unit suite fails in the five tests without their marker and passes with it.
• The docs build is byte-identical with and without [imaging]. On mkdocs-material 9.8.0 it differs from main's build only in lines Material generates itself: its version tag, asset links and runtime config.
• Every OpenTelemetry import in src/ and in the HyperDX integration test resolves against the new lock.
• The pre-commit uv-lock hook leaves the lock unchanged.
• The config validates against SchemaStore's dependabot-2.0.json, and a misspelt key under cooldown fails the same check.

Not testable before merge: whether Dependabot opens PRs from the new entry. Its first run after merge is that check.

[Copilot]

🟢 Approval recommended

The scoped dependency and configuration changes have no identified blocking defects, and the reported validation covers compatibility, documentation builds, and warning handling.

No open issues 🎉

What changed in this PR

This PR updates OpenArmature’s locked development, documentation, and CI dependencies and adds ongoing Dependabot maintenance without changing the package’s runtime dependency ranges.

Changes:

• Adds monthly grouped uv updates with a seven-day cooldown for version updates.
• Removes the unused Material imaging extra and upgrades advisory-affected packages, including the OpenTelemetry stack.
• Filters the SDK handler’s deprecation warning in five tests that intentionally use it.

File	Description
uv.lock	Updates targeted dependencies and removes unused imaging dependencies.
tests/​unit/​test_observability_otel.py	Adds narrowly scoped deprecation-warning filters.
pyproject.toml	Removes the unused mkdocs-material imaging extra.
.github/​dependabot.yml	Adds grouped monthly uv dependency updates.

_{Review effort: Balanced}