fix(deps): prevent incompatible XGBoost Renovate upgrades

[mldangelo-oai]

Summary

• Stop Renovate from proposing XGBoost 3.3+ for the Python 3.10-3.13 project: those releases require Python 3.12+ and make every XGBoost extra impossible to resolve on supported older runtimes.
• Add a regression covering the supported Python range, all three XGBoost extras, and the narrowly scoped Renovate compatibility rule.
• Fix the recurring failure seen in fix(deps): update dependency xgboost to >=3.3,<3.4 #1701 and fix(deps): update dependency xgboost to >=3.4,<3.5 #1805, where the incompatible upgrade broke 22 Python CI jobs before tests could run.

Validation

• Regression failed before the Renovate rule (assert 0 == 1) and passed afterward.
• PROMPTFOO_DISABLE_TELEMETRY=1 python -m pytest tests/test_nightly_prerequisites.py tests/test_dependency_lock.py tests/test_perf_workflow.py tests/scanners/test_xgboost_scanner.py -k 'not test_docs_workflow_rejects_invalid_utf8_and_invalid_revisions' -q — 241 passed, 2 skipped, 1 deselected.
• Repository-wide ruff check and ruff format --check passed; scoped mypy tests/test_dependency_lock.py, python -m json.tool renovate.json, and prettier --check renovate.json passed.
• Full fast smoke reached 3,326 passes before pre-existing Darwin cache failures. The deterministic compressed-cache failure reproduces on clean main and is already addressed by fix(cache): preserve macOS entries during ancestor churn #1800.
• Full local mypy reports the same 14 pre-existing errors in six unchanged baseline files; the modified test passes scoped mypy.
• One unrelated workflow test requires an invalid-UTF-8 filename, which the macOS filesystem rejects on both this branch and clean main.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: e39aba28b2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: e39aba28b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T00:49:28.676056Z	1dc526a	New commits
🔒 Security Review	✅ Completed 2026-08-31T00:50:49.671397Z	1dc526a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 926ecfc425

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 926ecfc425

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.