chore(deps): bump mcp from 1.27.0 to 1.28.1 in /envs/terminus_env - #981
chore(deps): bump mcp from 1.27.0 to 1.28.1 in /envs/terminus_env#981dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.27.0 to 1.28.1. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.27.0...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
TL;DR — Lock-only Dependabot bump of the transitive mcp SDK (1.27.0 → 1.28.1) in terminus_env. Correct, well-formed, and security-positive; no Tier 1 issues. One recurring Tier 2 provenance flag (registry-source flip) plus two non-blocking notes.
Automated Checks
- Lint: PASS (for this diff). Only
envs/terminus_env/uv.lockchanged — no Python touched, and lockfiles/TOML aren't linted.bash .claude/hooks/lint.shexits non-zero on ~20 pre-existingenvs/**files (incl.terminus_env/server/terminus_env_environment.py, which this PR does not modify) — repo baseline, not introduced here. - Debug code: CLEAN. All
check-debug.shhits are pre-existingsrc/**docstring/CLI examples; 0 interminus_env.
Open RFCs Context
All RFCs are In Review/Draft. RFC 003 "MCP Support" (In Review; @Darktex, @pankit-eng) is topically adjacent — it governs the MCP protocol/interface, not the pinned SDK version — so no conflict. No RFC covers Python packaging or dependency indexes, so the lock change has no RFC conflict.
Tier 1: Fixes Required
None. A lock-only dependency bump introduces no lint, debug, type, import, syntax, or security issues.
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: the re-lock flips every package's source registry (a side effect beyond the named mcp bump)
- Principle at stake: reproducibility / declared provenance (
PRINCIPLES.mdL15, "Container isolation for reproducibility") - The concern: all 132
sourcerefs move from the internal HF mirror (pypi.registries.huggingface.tech) → publicpypi.org/simple(0 mirror refs left), plusrevision = 2 → 3. Artifact URLs still point tofiles.pythonhosted.organd every hash is unchanged, so it's functionally benign — but it silently changes declared provenance and widens the mirror/PyPI split across envs. The same flip appears in recently merged env-lock bumps (#967, #968), so it looks intended; flagging for a conscious team decision, not something to hand-fix (please don't edit the lock to revert — registry choice is a team call). - Suggested reviewer: @Darktex + @burtenshaw
RFC Conflicts
None identified.
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (registry-source provenance flip)
- 0 RFC conflicts
Non-blocking notes (details inline): (1) process — this is a native dependabot/uv/envs/terminus_env/… PR even though .github/dependabot.yml configures the uv updater with directory: "/" + exclude-paths: ["envs/**"] (envs bumps are meant to route through the aggregate roll-up), cc @burtenshaw; (2) revision 2→3 vs the uv 0.5.27 shipped in openenv-base.
Positives: security-positive — base 1.27.0 carries CVE-2026-52870 (GHSA-hvrp-rf83-w775) and CVE-2026-52869 (GHSA-jpw9-pfvf-9f58), both fixed in 1.27.2, so 1.28.1 clears both (0 known vulns); clean single-package bump (125→125 packages, 0 added/removed); uv lock --check passes; wheel/sdist hashes match live PyPI; and mcp 1.28.0's new deprecations (mcp WebSocket transport + experimental tasks) don't affect terminus_env.
Sent by Cursor Automation: Pre-review
| name = "mcp" | ||
| version = "1.27.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "1.28.1" |
There was a problem hiding this comment.
The actual bump — verified. mcp is transitive here (pulled via the direct fastmcp>=3.0.0 dep; server/terminus_env_environment.py does from fastmcp import FastMCP), so a lock-only change with no pyproject.toml edit is correct.
Verification:
- sdist
d51e36a5…/ wheel2726bca5…match live PyPI for 1.28.1;requires_python >=3.10(env requires>=3.10); not yanked. uv lock --check --project envs/terminus_envpasses (127 resolved); package set 125→125, onlymcpchanged.- Security-positive: base 1.27.0 carries GHSA-hvrp-rf83-w775 (CVE-2026-52870) + GHSA-jpw9-pfvf-9f58 (CVE-2026-52869), both
fixed_in: 1.27.2→ 1.28.1 clears both; 1.28.1 has 0 known vulns. - mcp 1.28.0 newly deprecates its WebSocket transport + experimental tasks API, but
terminus_envuses neither (0 usages) and the repo has nofilterwarnings = ["error"], so no warning-to-error impact.
| name = "aiofile" | ||
| version = "3.9.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| source = { registry = "https://pypi.org/simple" } |
There was a problem hiding this comment.
Index-source flip — Tier 2 (reproducibility / provenance), reviewers @Darktex + @burtenshaw. This re-lock rewrote all 132 package source refs from the internal HF mirror (pypi.registries.huggingface.tech) to public pypi.org/simple (0 mirror refs remain). Artifact URLs still resolve to files.pythonhosted.org and all hashes are unchanged → functionally benign, but it changes declared provenance and widens the mirror/PyPI split across envs. Same pattern as recently merged env-lock bumps (#967, #968), so likely intended — flagging for a conscious decision, not a fix. Please don't hand-edit the lock to revert (registry choice is a team decision).
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lock revision 2 → 3 (side effect of the re-lock). Non-blocking heads-up: openenv-base (src/openenv/core/containers/images/Dockerfile) ships uv 0.5.27, which cannot parse a revision-3 lock under uv sync --frozen. This PR doesn't trigger a rebuild (docker-build.yml runs on Dockerfile/*.py changes, not uv.lock) and PR CI uses uv 0.9.3, so it's latent — worth confirming the base image's uv is recent enough before any rebuild relies on this lock.
|
Aggregated into #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps mcp from 1.27.0 to 1.28.1.
Release notes
Sourced from mcp's releases.
Commits
777b8d0[v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...4720467[v1.x] Set Development Status classifier to Production/Stable (#2976)6df3d73[v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...32d3290[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...0dca751[v1.x] Deflake the child process cleanup tests (#2839)52258a9[v1.x] Add a v2 status banner to the README (#2835)b8f4917[v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...2309e5efix: omit null optional fields from task result payloads (#2809)494eb11[v1.x] Support Python 3.14 (#2769)6213787[v1.x] Scope experimental tasks to the session that created them (#2720)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only dependency refresh with a minor MCP SDK bump; no application code changes, though CI installs may now pull from public PyPI instead of the HF registry.
Overview
Updates
envs/terminus_env/uv.lock(revision 2 → 3) for Dependabot’smcp1.27.0 → 1.28.1 bump. Package versions and wheel hashes are unchanged aside frommcp; the lock also rewrites every packagesource.registryfrom the Hugging Face PyPI mirror tohttps://pypi.org/simple.mcp1.28.x adds Python 3.14 support, fixes null optional fields in task result payloads, and emitsDeprecationWarningwhen WebSocket transport or experimental tasks APIs are used (removed in v2).terminus_envuses MCP viafastmcp/openenvonly—no direct imports of those deprecated entry points in this env.Reviewed by Cursor Bugbot for commit f33c6b4. Bugbot is set up for automated code reviews on this repo. Configure here.