Is there an existing issue for this?

• I have searched the existing issues

Feature description

Allow versioning-strategy: widen to be specified explicitly in dependabot.yml for the uv and pip ecosystems.

Current behavior

The dependabot.yml schema validation rejects widen for uv and pip:

The property '#/updates/N/versioning-strategy' value "widen" did not match one of the following values:
lockfile-only, auto, increase, increase-if-necessary

widen IS already exposed for other ecosystems (e.g. bundler, npm, composer), so the inconsistency is specific to uv and pip.

Internal implementation already exists

The widen_ranges strategy is implemented in dependabot-core for both ecosystems:

• uv/lib/dependabot/uv/update_checker/requirements_updater.rb (covered by widen_ranges specs)
• python/lib/dependabot/python/update_checker/requirements_updater.rb (same)

It is reachable today only through versioning-strategy: auto, which resolves to widen_ranges when the project is detected as a library. Users have no way to opt into widen behavior explicitly.

Why explicit widen matters

1. Parity with other ecosystems. widen is part of the documented strategy set; users reasonably expect it to be available across ecosystems where the underlying strategy is implemented.
2. Explicit configuration over heuristic detection. auto relies on library? to decide between widen_ranges and bump_versions. Library detection (library? in uv/lib/dependabot/uv/update_checker.rb and the equivalent in python/lib/dependabot/python/update_checker.rb) compares the local package name and description against PyPI. This works for most public packages, but is opaque, can misclassify, and fails entirely when:
   • The package is not published to PyPI (private / internal libraries, monorepo SDKs).
   • PyPI is temporarily unreachable.
   • Local and PyPI summary metadata diverge.
3. Predictability for library authors. A maintainer of a library wants widen regardless of whether auto's heuristics happen to classify the project correctly. Explicit configuration removes that fragility.

Proposed change

Add widen to the list of accepted versioning-strategy values for uv and pip in the dependabot.yml schema validation (the schema enforced by dependabot-api.githubapp.com).

No change to the underlying widen_ranges implementation is required.

Related

• PR Fix python library detection for projects not published on PyPI #14709 / Issue Default versioning-strategy has changed #14702 — show that widen_ranges is the intended behavior for python libraries via auto, but is gated on PyPI-based library detection.
• Issue Dependabot does not propose to widen range on a library #12538 — closed as a duplicate, but the original symptom (widen not applied) matches this gap.

Thank you for considering this.