chore(deps): bump mcp from 1.26.0 to 1.27.2 in /envs/connect4_env

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only dependency resolution change with a minor mcp patch bump; no runtime code changes, though the index URL switch could affect reproducibility in HF-mirror-only environments.

Overview
Updates envs/connect4_env/uv.lock only: lock revision 2 → 3, mcp 1.26.0 → 1.27.2 (transitive via fastmcp / openenv), and rewrites resolved package source entries from the Hugging Face PyPI mirror to https://pypi.org/simple across the lockfile. No application or pyproject.toml changes in this diff.

^{Reviewed by Cursor Bugbot for commit b48dd6a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot lock-only bump of the mcp SDK 1.26.0 → 1.27.2 in envs/connect4_env/uv.lock. mcp is a transitive dep (openenv → fastmcp → mcp); connect4_env's pyproject.toml pins none of it, so a lock-only change (no pyproject.toml edit) is correct. This is a security fix — details below.

Automated Checks

• Lint: PASS (for this PR). .claude/hooks/lint.sh exits 1, but only on ~20 pre-existing envs/** Python files (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env) — none are connect4_env. The only changed file is a uv.lock, which ruff/usort don't lint at all, so this is not attributable to the PR.
• Debug code: CLEAN. check-debug.sh scans src/ only; all its hits are pre-existing src/ files. This diff touches no src/ or .py file.
• uv lock --check --project envs/connect4_env: PASS (119 packages resolved) — lockfile is internally consistent.

Security (positive)

• mcp 1.26.0 is affected by CVE-2026-52870 / GHSA-hvrp-rf83-w775 — "experimental task handlers allow any client to access and cancel other clients' tasks" (introduced 1.23.0, fixed in 1.27.2; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, High).
• Impact is narrow: only servers that call server.experimental.enable_tasks(). grep -rn enable_tasks src/ envs/ is empty, so OpenEnv does not use the feature — practical exposure is nil, but the bump is good hygiene / defense-in-depth. Net positive.

Verification

• Hashes match PyPI live: wheel d6ff516… (220498 B), sdist 8e02db1… (621116 B); not yanked; no open vulns.
• mcp 1.27.2 requires-python >=3.10 and all requires_dist floors are satisfied by the already-locked versions; no dependency added/removed vs 1.26.0.
• Full package set unchanged (117 → 117; only mcp changed version, no adds/removes).

Open RFCs Context

• RFC 003 — MCP Support (In Review, @Darktex / @pankit-eng) is the nearest RFC since this bumps the MCP SDK. It governs the protocol architecture (dual API boundary: WebSocket for infra, MCP for agents), not the pinned mcp package version — a patch bump doesn't touch that design, so no conflict.
• No RFC covers dependency management / PyPI index / lockfiles. Other open RFCs (000/001/002 + Cloud-Sandbox amendment / 005 In Review; 010 Draft) are unrelated.

Tier 1: Fixes Required

• None.

Tier 2: Alignment Discussion

Principle Conflicts

ALIGNMENT FLAG: Index-source flip from the internal HF mirror to public PyPI

• Principle at stake: "Container isolation for reproducibility" (PRINCIPLES.md) — declared provenance / reproducibility.
• The concern: Beyond the named bump, this re-lock rewrites every package's source from https://pypi.registries.huggingface.tech/ → https://pypi.org/simple (126 → 126; 0 mirror refs remain) and bumps the lock revision 2 → 3. Artifact URLs stay on files.pythonhosted.org and hashes are unchanged, so it's almost certainly benign, but it silently changes declared provenance and widens a cross-env split (some env locks are already public, others still on the mirror). Registry choice is a team decision — flag, don't fix.
• Suggested reviewers: @Darktex, @burtenshaw

RFC Conflicts

• None identified (RFC 003 is adjacent, not in conflict — see context above).

Process note (non-blocking)

• .github/dependabot.yml scopes the uv updater to directory: "/" with exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/connect4_env/… PR still edits envs/connect4_env/uv.lock. The exclude-paths key isn't being honored for the uv ecosystem (the codex/dependabot-envs-* aggregate roll-ups are the intended path for env locks). FYI @burtenshaw — process only; doesn't affect this bump's correctness.

Summary

• 0 mechanical issues to fix
• 1 alignment point for human review (index-source flip + revision bump)
• 0 RFC conflicts
• Plus: this is a security fix (CVE-2026-52870) — safe/recommended to merge; and one non-blocking process note (exclude-paths bypass).

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Security fix — the actual bump. mcp 1.26.0 → 1.27.2 resolves CVE-2026-52870 / GHSA-hvrp-rf83-w775 (experimental task handlers let any client access/cancel other clients' tasks; introduced 1.23.0, fixed 1.27.2). Verified against PyPI: wheel d6ff516… (220498 B), sdist 8e02db1… (621116 B), requires-python >=3.10, not yanked, no open vulns.

mcp is transitive (via openenv → fastmcp), so lock-only (no pyproject.toml edit) is correct, and all of 1.27.2's requires_dist floors are satisfied by the already-locked deps (uv lock --check passes). Impact is narrow — only server.experimental.enable_tasks(), which OpenEnv doesn't call — so good hygiene regardless.

[cursor]

Lockfile format revision 2 → 3 — a side effect of the re-lock. Deploy Dockerfiles install with uv sync --frozen, so just confirm the base image's uv is recent enough to read revision-3 lockfiles. Consistent with the other env locks already on revision 3.

[cursor]

Tier 2 (reproducibility) — index-source flip. This re-lock rewrites every package's source from the internal https://pypi.registries.huggingface.tech/ mirror to public https://pypi.org/simple (126 → 126; 0 mirror refs left). Artifact URLs remain files.pythonhosted.org with unchanged hashes, so it's benign for integrity, but it silently changes declared provenance and widens the cross-env mirror/public split. Registry choice is a team call — flagging, not fixing. cc @Darktex @burtenshaw

[burtenshaw]

Aggregated into #921.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.