chore(deps): bump mcp from 1.26.0 to 1.27.2 in /envs/qed_math_env - #978
chore(deps): bump mcp from 1.26.0 to 1.27.2 in /envs/qed_math_env#978dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.26.0 to 1.27.2. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.26.0...v1.27.2) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.27.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Minimal, correct, security-motivated transitive lockfile bump. No mechanical issues, no principle/RFC conflicts. One recurring non-blocking process note.
Automated Checks
- Lint: PASS (relative to this PR).
.claude/hooks/lint.shflags ~20 pre-existingenvs/**files needing formatting (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env×8, repl_env, terminus_env, textarena_env) — none isqed_math_env, anduv.lockis not linted by ruff/usort. No PR-introduced lint issues. - Debug code: CLEAN (relative to this PR).
.claude/hooks/check-debug.shhits are all pre-existingsrc/files (auto_action.py, _discovery.py, uv_provider.py, cli/main.py, serve.py). This PR only touchesenvs/qed_math_env/uv.lock.
Open RFCs Context
No RFC governs packaging / dependency management / PyPI index selection. RFCs 000–005 (In Review) and 010 (Draft) are unrelated to a transitive lockfile bump. No RFC conflicts.
Tier 1: Fixes Required
None. Verified:
mcp1.26.0 → 1.27.2 is transitive (viaopenenv→fastmcp→mcp;qed_math_env/pyproject.tomlhas nomcppin) ⇒ lock-only is correct, no pyproject floor edit expected.- Package set unchanged: 142 → 142 packages, 0 added, 0 removed, only
mcpversion changed. - Hashes are real and match PyPI: sdist
8e02db1…(621116 B) + wheeld6ff516…(220498 B);yanked: false,requires_python >=3.10. uv lock --check --project envs/qed_math_envpasses (143 packages resolved); mcp's declared dependency list is unchanged and all floors remain satisfied.
Tier 2: Alignment Discussion
Principle Conflicts
None. Unlike some sibling env-lock bumps, this env's lock is born clean — no HF-mirror→PyPI index flip (0 registries.huggingface.tech refs and 149 pypi.org/simple at both base and head) and no revision bump (already revision = 3). So the usual reproducibility/provenance flag does not apply here.
RFC Conflicts
None identified.
ALIGNMENT FLAG (process, non-blocking): Native dependabot uv PR bypasses exclude-paths
- Config/policy at stake:
.github/dependabot.yml(not a PRINCIPLES / INVARIANTS / RFC item) - The concern: The
uvupdater is configured withdirectory: "/"+exclude-paths: ["envs/**"], yet this nativedependabot/uv/envs/qed_math_env/mcp-1.27.2PR still modifiesenvs/qed_math_env/uv.lock.exclude-pathsis a valid Dependabot key, but theuvecosystem doesn't appear to honor it for these env locks. This is a recurring config/tooling mismatch, not a defect in this diff — the change itself is correct. - Suggested reviewer: @burtenshaw (authored
exclude-paths, commit5f499da9/ #566 "chore: stop dependabot in envs")
Positive Callouts
-
Security fix. mcp 1.26.0 carries two advisories, both
fixed_in: 1.27.2:- GHSA-hvrp-rf83-w775 (CVE-2026-52870) — cross-session task access via the experimental tasks feature.
- GHSA-jpw9-pfvf-9f58 (CVE-2026-52869) — SSE / Streamable-HTTP session hijack when using built-in bearer-token auth.
1.27.2 has no known vulnerabilities. Merging is a net security improvement.
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (non-blocking dependabot
exclude-pathsprocess note) - 0 RFC conflicts
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "mcp" | ||
| version = "1.26.0" | ||
| version = "1.27.2" |
There was a problem hiding this comment.
mcp 1.26.0 → 1.27.2. This is a transitive dep (via openenv → fastmcp → mcp; qed_math_env/pyproject.toml has no mcp pin), so a lock-only change is correct.
Security-motivated: mcp 1.26.0 has two advisories, both fixed in 1.27.2 — GHSA-hvrp-rf83-w775 (CVE-2026-52870, cross-session task access) and GHSA-jpw9-pfvf-9f58 (CVE-2026-52869, SSE/Streamable-HTTP session hijack). 1.27.2 has no known vulns.
| { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, | ||
| ] | ||
| sdist = { url = "https://files.pythonhosted.org/packages/fc/6d/62e76bbb8144d6ed86e202b5edd8a4cb631e7c8130f3f4893c3f90262b10/mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66", size = 608005, upload-time = "2026-01-24T19:40:32.468Z" } | ||
| sdist = { url = "https://files.pythonhosted.org/packages/27/3c/347cf965d313f5d41764e7d46bea6ffe7d9ef13b983cc429b0340962a082/mcp-1.27.2.tar.gz", hash = "sha256:8e02db104096d1c25b28e64bde29a5c32b31bc241710213e12fd4d84985bdfef", size = 621116, upload-time = "2026-05-29T17:16:04.039Z" } |
There was a problem hiding this comment.
Hashes verified real against PyPI: sdist 8e02db1… (621116 B) and wheel d6ff516… (220498 B) match the published files exactly. yanked: false, requires_python >=3.10.
This env lock is born clean — source is already https://pypi.org/simple (no HF-mirror→PyPI index flip) and no revision bump. Package set is unchanged (142→142, 0 add/remove) and uv lock --check passes.
|
Superseded by #986. |
1 participant
Bumps mcp from 1.26.0 to 1.27.2.
Release notes
Sourced from mcp's releases.
Commits
6213787[v1.x] Scope experimental tasks to the session that created them (#2720)ce267b6[v1.x] Bind transport sessions to the authenticated principal (#2719)1abcca2[v1.x] Add subject and claims to AccessToken (#2690)9773a3f[v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact (...77431eb[v1.x] refactor: import SSEError from httpx_sse public API (#2561)2034cae[v1.x] build: restrict httpx to <1.0.0 (#2559)73d458b[v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthCli...8d4c2f5[v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2...6524782[v1.x] fix: handle ClosedResourceError when transport closes mid-request (#2334)2e9897e[v1.x] fix: handle non-UTF-8 bytes in stdio server stdin (#2303)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Lockfile-only bump, but the new SDK versions include authentication and session-binding changes that could affect MCP server/client behavior in
qed_math_envif OAuth or StreamableHTTP paths are used.Overview
Updates
envs/qed_math_env/uv.lockso the resolvedmcp(Model Context Protocol Python SDK) package moves from 1.26.0 to 1.27.2, including refreshed sdist/wheel URLs and hashes. No application source in this PR changes.Upstream 1.27.x adds OAuth/auth hardening (e.g. binding transport sessions to the authenticated principal, richer
AccessTokenclaims), task/session scoping, Pydantic 2.13 compatibility fixes, StreamableHTTP idle timeout, and assorted transport/stdio fixes.qed_math_envrelies on MCP via OpenEnv and FastMCP tooling, so behavior may shift only where those code paths exercise the bumped SDK.Reviewed by Cursor Bugbot for commit 3b7738d. Bugbot is set up for automated code reviews on this repo. Configure here.