ci(dependabot): ignore major-version bumps of mcp

[fedorov]

Why

The mcp<2 cap merged in #35 did not hold. Dependabot closed #33 and immediately opened #37,
which rewrites the constraint instead of respecting it:

-    "mcp>=1.28.1,<2",
+    "mcp>=2.0.0,<3",

So #37 fails exactly the way #33 did:

ERROR tests/test_mcp.py
ERROR tests/test_parity.py
E   ModuleNotFoundError: No module named 'mcp.server.fastmcp'

This is dependabot behaving as designed — it treats a version constraint as something it
maintains, not a boundary it stays inside. A cap in pyproject.toml protects resolution
(nobody accidentally installs 2.x); it does not stop dependabot from proposing to raise the cap.

The ruff half of the original diagnosis did hold: lint and format both pass on #37 under
ruff 0.16.0, thanks to #34.

What

An ignore condition for major bumps of mcp. Ignore conditions are evaluated before
grouping, so the weekly python group keeps shipping every other update — it just stops
carrying mcp 2.x.

Also adds a line to the pyproject.toml comment pointing at the ignore rule, so a reader
doesn't assume the cap is self-enforcing, and so the two get changed together.

Lifetime

This is a hold, not a decision. Drop the entry when the SDK 2.0 port (#36, currently draft)
lands — both the commit message and the pyproject comment say so.

After this merges

#37 needs @dependabot recreate (not rebase — the group has to be regenerated for the new
ignore rule to apply). It should come back with duckdb, fastapi and ruff only, and go green.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR prevents Dependabot from proposing MCP SDK major upgrades that break the current MCP adapter (which still targets the 1.x mcp.server.fastmcp API). It does so by adding a Dependabot ignore rule for mcp semver-major updates, while keeping the existing <2 constraint in pyproject.toml, and cross-referencing the two so they’re updated together.

Changes:

• Add a Dependabot ignore rule to skip mcp major-version bumps in the weekly uv dependency group.
• Clarify in pyproject.toml that the <2 cap is enforced operationally by Dependabot ignore rules (not just by resolution constraints).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Adds a comment explaining the cap/Dependabot interaction and linking to the ignore rule.
.github/dependabot.yml	Adds an ignore entry to prevent mcp semver-major updates from being proposed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.