ci(dependabot): block bot bumps against py39 lockfile

Dependabot security updates ignore the `directory:` allowlist in
`.github/dependabot.yml`, so the py39 freeze from cb20cdf only
held against version-update PRs. Two security PRs (#143 urllib3
2.7.0, #144 requests 2.33.0) are currently open against
`lockfiles/py39/`; both upstream releases drop Python 3.9.

Extends `.github/workflows/dependabot-auto-merge.yml` to close
(and delete the branch of) any Dependabot PR whose
`fetch-metadata` `directory` output starts with `/lockfiles/py39`,
before the auto-merge step runs. Catches both version updates and
security PRs.

Tightens the CHANGELOG note on the py39 freeze to cover security
PRs.

Mirrors monitoring-plugins commit cd5b1e066.

Author: markuslf

.github/workflows/dependabot-auto-merge.yml

@@ -17,9 +17,26 @@ jobs:
       - uses: 'dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98' # v3.1.0
         id: 'meta'
 
+      # Block bumps against the py39 lockfile. Python 3.9 has been
+      # dropped by most upstream packages over 2025/2026, and
+      # Dependabot does not honour `Requires-Python` when proposing
+      # versions. Dependabot security updates also ignore the
+      # `directory:` allowlist in `.github/dependabot.yml`, so the
+      # freeze has to be enforced here. The py39 lockfile is
+      # maintained manually via `pip-compile` on a Python 3.9 host.
+      - if: "startsWith(steps.meta.outputs.directory, '/lockfiles/py39')"
+        run: |
+          gh pr close "$PR_URL" \
+            --comment 'Auto-closed: `lockfiles/py39` is frozen because Python 3.9 is dropped by most upstream packages. Lockfile is maintained manually via pip-compile when an actual fix lands that still supports 3.9.' \
+            --delete-branch
+        env:
+          PR_URL: '${{ github.event.pull_request.html_url }}'
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+
       - if: >-
-          steps.meta.outputs.update-type == 'version-update:semver-patch'
-          || steps.meta.outputs.update-type == 'version-update:semver-minor'
+          !startsWith(steps.meta.outputs.directory, '/lockfiles/py39')
+          && (steps.meta.outputs.update-type == 'version-update:semver-patch'
+              || steps.meta.outputs.update-type == 'version-update:semver-minor')
         run: 'gh pr merge --auto --squash "$PR_URL"'
         env:
           PR_URL: '${{ github.event.pull_request.html_url }}'

CHANGELOG.md

@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 * pyproject.toml: declare `pypsrp` and `pywinrm` as direct dependencies. `lib.winrm` imports both at module load time (wrapped in `try/except ImportError` only so a non-WinRM consumer still loads); previously they had to be pinned in every downstream project that consumed `lib.winrm` (e.g. monitoring-plugins for `dhcp-scope-usage` on Windows). Same convention as `psutil`, `smbprotocol` etc., which `lib.psutil` / `lib.smb` import conditionally but which are declared as hard deps because they are part of lib's published surface
-* requirements: one hash-pinned lockfile per supported Python LTS, each in its own `lockfiles/pyXX/` subdirectory (`py39` to `py314`). Replaces the single `requirements.txt`. Dependabot watches each subdirectory separately, except `lockfiles/py39/` which is excluded: most upstream packages dropped Python 3.9 over 2025/2026, so automated bumps would break `pip install --require-hashes` on RHEL 8 / Debian 11. The py39 lockfile is regenerated manually as needed
+* requirements: one hash-pinned lockfile per supported Python LTS, each in its own `lockfiles/pyXX/` subdirectory (`py39` to `py314`). Replaces the single `requirements.txt`. Dependabot watches each subdirectory separately, except `lockfiles/py39/` which is excluded from both version bumps and security PRs: most upstream packages dropped Python 3.9 over 2025/2026, so automated bumps would break `pip install --require-hashes` on RHEL 8 / Debian 11. The py39 lockfile is regenerated manually as needed
 
 
 ### Added