chore(deps): keep the numpy >=1.20 floor (decline the 2.x bump)

[Fieldnote-Echo]

Declines Dependabot #48 (numpy >=1.20 → >=2.0.2) and stops it re-proposing the floor bump.

Why keep the broad floor:

• No perf gain. ordvec speed is its Rust SIMD kernels; numpy is only the zero-copy array container (rust-numpy hands ordvec a borrowed &[f32]). numpy 2.0 improvements are to numpy own ops, which ordvec does not use.
• Not required. rust-numpy 0.27 supports numpy 1.x and 2.x at runtime — the wheel runs on either.
• Costs real users. ordvec is abi3-py39; numpy 2.1+ dropped Python 3.9, so a >=2.0.2 floor would block the 3.9 + numpy-1.26 legacy long-tail for zero benefit. Broad accessibility on legacy systems is a deliberate virtue of a dep-light crate.

Change: an ignore for numpy in the pip ecosystem of dependabot.yml (rationale inline). maturin (build dep) bumps and security advisories still flow.

[qodo-code-review]

Review Summary by Qodo

Configure Dependabot to ignore numpy floor version bumps

✨ Enhancement

Walkthroughs

Description

• Add Dependabot ignore rule for numpy to maintain >=1.20 floor
• Preserve broad legacy compatibility for Python 3.9 + numpy 1.x stacks
• Expand rationale comments explaining deliberate floor choice
• Allow maturin and security updates to continue flowing

Diagram

flowchart LR
  A["Dependabot pip config"] -->|add ignore rule| B["numpy dependency ignored"]
  B -->|preserves floor| C["numpy >=1.20"]
  C -->|maintains support| D["Python 3.9 + numpy 1.x"]
  A -->|allows updates| E["maturin & security advisories"]

Loading

File Changes

1. .github/dependabot.yml ⚙️ Configuration changes +11/-1

Add numpy ignore rule with extended rationale

• Expanded comment block explaining numpy floor rationale (dep-light, abi3-py39, rust-numpy 1.x/2.x
 support)
• Added ignore section under pip ecosystem with numpy dependency to prevent auto-floor bumps
• Clarified that maturin build dependencies and security advisories continue to flow
• Documented deliberate broad/legacy compatibility choice for Python 3.9 + numpy 1.x stacks

.github/dependabot.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[gemini-code-assist]

Code Review

This pull request updates the Dependabot configuration to ignore updates for the numpy dependency in the ordvec-python package. This change is intended to maintain a broad compatibility floor for legacy environments, specifically Python 3.9 and numpy 1.x, while leveraging the dual-version support of rust-numpy 0.27. I have no feedback to provide.