chore(deps): bump mcp from 1.26.0 to 1.27.2 in /envs/snake_env - #974
chore(deps): bump mcp from 1.26.0 to 1.27.2 in /envs/snake_env#974dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.26.0 to 1.27.2. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.26.0...v1.27.2) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.27.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Native Dependabot uv env-lock bump: mcp 1.26.0 → 1.27.2 in envs/snake_env. Only envs/snake_env/uv.lock changes (140 +/-); pyproject.toml is untouched, which is correct because mcp is a transitive dep here (pulled via openenv → fastmcp), not a declared pin.
Automated Checks
- Lint: PASS (N/A for PR scope) — no
.pyfiles change (TOML/lock aren't linted).lint.shstill exits 1, but every flagged file is one of the ~20 pre-existingenvs/reformat candidates (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env) — none aresnake_env, so not attributable to this PR. - Debug code: CLEAN —
check-debug.shhits are all pre-existingsrc/files (auto/*,cli/*,test_local_docker_provider.py); 0 in changed files.
Verification (all green)
- Package set unchanged: 125 packages both sides — 0 added, 0 removed, only
mcpchanged version.mcp's transitive dependency list is unchanged between 1.26.0 and 1.27.2. uv lock --checkPASSES at HEAD (and also at base — no requires-dist drift to repair this time). Lock is internally consistent.- Hashes are real & match PyPI: sdist
mcp-1.27.2.tar.gzsha256:8e02db10…bdfef(621116 B); wheelmcp-1.27.2-py3-none-any.whlsha256:d6ff5160…4de5(220498 B).yanked: false,requires_python >=3.10(satisfied by snake_env'srequires-python = ">=3.10"). All of mcp'srequires_distfloors are met by the locked deps. - Security fix (positive): mcp 1.26.0 carries advisory GHSA-hvrp-rf83-w775,
fixed_in: 1.27.2; 1.27.2 has no known advisories. This bump remediates it.
Open RFCs Context
000/001/002/003/005 = In Review, 010 = Draft, 004 = no status header (RFC 002 also has a pending "cloud sandbox providers" amendment). None cover dependency management, the PyPI index, or packaging → no RFC surface here.
Tier 1: Fixes Required
- None.
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: Lockfile-wide index-source flip (HF mirror → public PyPI)
- Principle at stake: "Container isolation for reproducibility and security" (
PRINCIPLES.mdL15) - The concern: Beyond the named bump, Dependabot rewrote all 136
source = { registry = "https://pypi.registries.huggingface.tech/" }refs tohttps://pypi.org/simple(and bumpedrevision = 2 → 3). Artifact URLs stay onfiles.pythonhosted.organd every hash is unchanged, so it's almost certainly benign — but it silently changes the declared provenance of every dependency and widens a cross-env split (some env locks still point at the HF mirror). This is a team/policy decision, so flagging rather than "fixing" (reverting the flip in a Dependabot-generated lock would fight the tooling). - Suggested reviewers: @Darktex (authored the reproducibility principle line), @burtenshaw (owns dependency/CI config)
RFC Conflicts
None identified.
Process Note (not in this diff — .github/dependabot.yml)
The uv updater is configured with directory: "/" + exclude-paths: ["envs/**"] (L8-9), yet this native dependabot/uv/envs/snake_env/... PR modifies envs/snake_env/uv.lock. exclude-paths is a valid, supported key but the uv ecosystem doesn't appear to be honoring it. The codex/dependabot-envs-* aggregate roll-ups are the intended path for env-lock updates. Non-blocking; cc @burtenshaw. (Close-vs-merge is a maintainer call — hence COMMENT, not request-changes.)
Summary
- 0 mechanical issues to fix (Tier 1)
- 2 alignment points for human review: the index-source flip (reproducibility) + the
exclude-pathsprocess mismatch - 0 RFC conflicts
- Net: a clean, single-package, security-fixing bump; the only discussion items are the recurring index-flip + exclude-paths bypass, both team decisions.
Sent by Cursor Automation: Pre-review
| name = "mcp" | ||
| version = "1.26.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "1.27.2" |
There was a problem hiding this comment.
The actual bump — mcp 1.26.0 → 1.27.2 (transitive via openenv/fastmcp; no pyproject.toml pin, so lock-only is correct).
Verified against PyPI: sdist sha256:8e02db10…bdfef (621116 B) and wheel sha256:d6ff5160…4de5 (220498 B) match this lock; yanked: false, requires_python >=3.10. mcp's dependency list is unchanged vs 1.26.0 (0 packages added/removed across the whole lock).
Positive: this remediates advisory GHSA-hvrp-rf83-w775 (present in 1.26.0, fixed_in: 1.27.2).
| name = "aiofile" | ||
| version = "3.9.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| source = { registry = "https://pypi.org/simple" } |
There was a problem hiding this comment.
ALIGNMENT FLAG (Tier 2 — reproducibility, PRINCIPLES.md L15). This is the first of 136 source lines flipped from the internal HF mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple) by this re-lock — a side effect beyond the mcp bump. Artifact URLs (files.pythonhosted.org) and all hashes are unchanged, so it's benign, but it changes the declared provenance of every dependency. Registry choice is a team decision → flag, don't fix. cc @Darktex, @burtenshaw
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lockfile-format revision bumped 2 → 3 (a side effect of the re-lock). The deploy Dockerfile installs via uv sync --frozen, so the base image's uv must understand revision 3 — current uv (0.11.x) does. Non-blocking, just noting it travels with the index-flip.
|
Superseded by #979. |
1 participant
Bumps mcp from 1.26.0 to 1.27.2.
Release notes
Sourced from mcp's releases.
Commits
6213787[v1.x] Scope experimental tasks to the session that created them (#2720)ce267b6[v1.x] Bind transport sessions to the authenticated principal (#2719)1abcca2[v1.x] Add subject and claims to AccessToken (#2690)9773a3f[v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact (...77431eb[v1.x] refactor: import SSEError from httpx_sse public API (#2561)2034cae[v1.x] build: restrict httpx to <1.0.0 (#2559)73d458b[v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthCli...8d4c2f5[v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2...6524782[v1.x] fix: handle ClosedResourceError when transport closes mid-request (#2334)2e9897e[v1.x] fix: handle non-UTF-8 bytes in stdio server stdin (#2303)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only dependency bump with no application code changes; main operational note is the registry URL shift for installs.
Overview
Updates
envs/snake_env/uv.lockto pullmcp1.27.2 (from 1.26.0) as a transitive dependency ofopenenv→fastmcp. Nopyproject.tomlor snake env source changes.The lock refresh also switches every locked package from the Hugging Face PyPI registry (
pypi.registries.huggingface.tech) tohttps://pypi.org/simple, and bumps the lock revision from 2 to 3.The
mcprelease line adds auth/session hardening (binding transport sessions to the authenticated principal, scoping experimental tasks to the creating session, richerAccessTokenclaims) plus transport/OAuth fixes from 1.27.0–1.27.1.Reviewed by Cursor Bugbot for commit ce9e890. Bugbot is set up for automated code reviews on this repo. Configure here.