chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/echo_env - #983
chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/echo_env#983dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.26.0 to 1.28.1. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.26.0...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Dependabot bump of the transitive mcp package from 1.26.0 → 1.28.1 in envs/echo_env/uv.lock. Verified this is a clean, correct, security-positive lock-only change.
Automated Checks
- Lint: PASS (for this PR).
.claude/hooks/lint.shonly reports ~20 pre-existing, unrelatedenvs/files (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env) — none is echo_env, and.lock/TOML files aren't linted. No formatting issue is introduced by this diff. - Debug code: CLEAN.
.claude/hooks/check-debug.shhits are all pre-existingsrc/openenv/cli/...; zero echo_env hits (lock-only change).
Open RFCs Context
- RFC 003 “MCP Support” (In Review, @Darktex/@pankit-eng) is the nearest RFC since this touches the
mcppackage, but it governs the MCP protocol/interface (tools/list, tools/call,CallToolAction), not the pinned SDK version — a version bump doesn't conflict (adjacent context only). - RFC 010 “echo-env-token-world-model” (Draft) is a training-loss technique, unrelated to the echo_env environment despite the name.
- No RFC covers packaging / dependency management / PyPI provenance → dependency-bump PRs have no RFC surface.
Tier 1: Fixes Required
- None. (Do not hand-edit the dependabot-generated lockfile.)
Tier 2: Alignment Discussion
Principle Conflicts
- None from the lock content. This env's lock is born-clean: no index-source flip (0
registries.huggingface.techrefs at both base and head; 124/124 onpypi.org/simple), norevisionbump (revision = 3both sides), and the package set is unchanged (117→117, 0 added/removed, onlymcpversion changed). So the usual reproducibility/index-flip flag does not apply here.
ALIGNMENT FLAG: Native dependabot uv PR modifies envs/** despite exclude-paths (process, not code)
- Principle/RFC at stake: Repo dependabot policy in
.github/dependabot.yml(not a code principle) - The concern: The
uvupdater is configureddirectory: "/"+exclude-paths: ["envs/**"](lines 4-9, commit5f499da9/ #566), yet this nativedependabot/uv/envs/echo_env/mcp-1.28.1branch editsenvs/echo_env/uv.lock. Theexclude-pathskey isn't being honored for theuvecosystem. Not blocking — the bump itself is correct — but worth confirming whether env locks should instead flow via the aggregatecodex/dependabot-envs-*roll-ups. - Suggested reviewer: @burtenshaw
RFC Conflicts
- None identified.
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (dependabot
exclude-pathsprocess note) - 0 RFC conflicts
Positive callouts
- Security fix:
mcp1.26.0 carried two advisories —GHSA-hvrp-rf83-w775/ CVE-2026-52870 (experimental-task handlers acted on task id with no session-ownership check) andGHSA-jpw9-pfvf-9f58/ CVE-2026-52869 (SSE / Streamable-HTTP transports routed by session-id alone → session hijack) — bothfixed_in: 1.27.2, so 1.28.1 remediates both; 1.28.1 has 0 known vulnerabilities. - Correctness:
mcpis transitive (echo_env pins none; it arrives viaopenenv→fastmcp), so a lock-only change (nopyproject.tomledit) is correct. sdist/wheel hashes + sizes match PyPI exactly,requires_python >=3.10is satisfied by echo_env'srequires-python = ">=3.10", anduv lock --check --project envs/echo_envpasses.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "mcp" | ||
| version = "1.26.0" | ||
| version = "1.28.1" |
There was a problem hiding this comment.
Verified correct + security-positive. mcp is transitive here — echo_env's pyproject.toml pins no mcp; it comes via openenv → fastmcp — so this lock-only bump (no pyproject edit) is right.
1.26.0 → 1.28.1 clears two advisories that affected 1.26.0: GHSA-hvrp-rf83-w775 (CVE-2026-52870, experimental-task session-ownership) and GHSA-jpw9-pfvf-9f58 (CVE-2026-52869, SSE/Streamable-HTTP session hijack), both fixed_in: 1.27.2; 1.28.1 itself has 0 known vulns.
This env's lock is born-clean — no index-flip and no revision bump — so uv lock --check passes and the package set is unchanged (117→117, only mcp).
| { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, | ||
| ] | ||
| sdist = { url = "https://files.pythonhosted.org/packages/fc/6d/62e76bbb8144d6ed86e202b5edd8a4cb631e7c8130f3f4893c3f90262b10/mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66", size = 608005, upload-time = "2026-01-24T19:40:32.468Z" } | ||
| sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" } |
There was a problem hiding this comment.
sdist + wheel hashes/sizes verified live against PyPI: sdist d51e36a5…9683 size 638501 and wheel 2726bca5…91df size 222620 both match, yanked=false. mcp 1.28.1's requires_dist floors (anyio>=4.5, httpx>=0.27.1, pydantic>=2.11.0, starlette>=0.27, pydantic-settings>=2.5.2, …) are all satisfied by the existing locked deps — no new/removed transitive packages — which is why the diff is just these 3 lines.
|
Aggregated into #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps mcp from 1.26.0 to 1.28.1.
Release notes
Sourced from mcp's releases.
... (truncated)
Commits
777b8d0[v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...4720467[v1.x] Set Development Status classifier to Production/Stable (#2976)6df3d73[v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...32d3290[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...0dca751[v1.x] Deflake the child process cleanup tests (#2839)52258a9[v1.x] Add a v2 status banner to the README (#2835)b8f4917[v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...2309e5efix: omit null optional fields from task result payloads (#2809)494eb11[v1.x] Support Python 3.14 (#2769)6213787[v1.x] Scope experimental tasks to the session that created them (#2720)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only dependency bump for echo_env; no direct code changes, though newer mcp auth/session behavior could affect MCP stacks if tests hit those paths.
Overview
Updates
envs/echo_env/uv.lockso the transitivemcpdependency moves from 1.26.0 to 1.28.1 (sdist/wheel hashes only; no application source changes in this PR).That SDK line includes auth/session binding improvements, Python 3.14 support, and deprecation warnings (not removals) for WebSocket transport and experimental tasks APIs if those code paths are exercised.
echo_envgoes throughfastmcp/ OpenEnv MCP helpers and does not reference those deprecated entry points in-repo, so day-to-day echo tooling behavior should stay the same aside from whateverfastmcppulls from the newermcprelease.Reviewed by Cursor Bugbot for commit 55b429b. Bugbot is set up for automated code reviews on this repo. Configure here.