chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/carla_env#980
chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/carla_env#980dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.26.0 to 1.28.1. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.26.0...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
chore(deps): bump mcp 1.26.0 → 1.28.1 in /envs/carla_env — native Dependabot (dependabot/uv/envs/carla_env/mcp-1.28.1). mcp is a transitive dep (openenv → fastmcp → mcp; no pin in envs/carla_env/pyproject.toml), so a lock-only change is correct — no pyproject edit expected.
Automated Checks
- Lint: PASS (N/A to this PR) —
.claude/hooks/lint.shlints only Python;uv.lock/TOML aren't linted. The reformat candidates it prints are all pre-existing (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env) — carla_env is not among them, and this PR changes no Python. - Debug code: CLEAN —
check-debug.shhits are all pre-existing insrc/; 0 in carla_env (lockfile-only change).
Verification (all pass)
uv lock --check --project envs/carla_env→ PASS (123 resolved).- Package set: 122 pkgs both sides, 0 added / 0 removed, only
mcpchanged 1.26.0 → 1.28.1.files.pythonhosted.orgartifact-line count identical (1488/1488). - 1.28.1 hashes match PyPI exactly (wheel
2726bca5…, sdistd51e36a5…);requires-python >=3.10satisfied by carla_env>=3.11; not yanked; no known vulns in 1.28.1.
Security (positive)
Base mcp 1.26.0 carries two advisories, both fixed_in: 1.27.2 → 1.28.1 remediates both:
- CVE-2026-52870 / GHSA-hvrp-rf83-w775 — experimental tasks feature (
server.experimental.enable_tasks()) acted on tasks without checking session ownership (cross-client read/cancel).enable_tasksis unused anywhere in OpenEnv (grep → none) → exposure ≈ nil. - CVE-2026-52869 / GHSA-jpw9-pfvf-9f58 — SSE / Streamable-HTTP transports routed requests by session ID without verifying the authenticated principal (session hijack). Low real-world exposure in OpenEnv's single-tenant per-container model, but a genuine transport-layer fix.
Open RFCs Context
RFCs: 000/001/002/003/005 In Review, 004 (no status), 010 Draft. None govern Python packaging / PyPI index / dependency resolution. RFC 003 "MCP Support" (In Review, @Darktex / @pankit-eng) is adjacent since this bumps the MCP SDK, but it governs protocol architecture (dual API boundary), not the pinned SDK version → no conflict (adjacent context only).
Tier 1: Fixes Required
None. Lock is consistent, hashes authentic, constraints satisfied, no debug/lint/security regressions.
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: Lockfile-wide index-source flip (HF mirror → public PyPI)
- Principle at stake: "Container isolation for reproducibility and security" (
.claude/docs/PRINCIPLES.md:15) - The concern: Beyond the mcp bump, this re-lock rewrote every package's
sourcefromhttps://pypi.registries.huggingface.tech/(internal HF mirror) tohttps://pypi.org/simple(public PyPI) — 126 lines — and bumpedrevision = 2 → 3. Artifact URLs stayfiles.pythonhosted.organd all hashes are unchanged (pinned-by-hash → functionally benign), but it silently changes the declared provenance for the whole env and widens an existing cross-env split (some env locks are still on the mirror, others already on pypi.org). No committed config pins the mirror — it lives only insideuv.lockfiles. Registry choice is a team decision → flagging, not reverting. - Suggested reviewers: @Darktex (reproducibility principle author, PRINCIPLES.md:15), @burtenshaw (owns dependabot config + lock provenance)
RFC Conflicts
None identified.
Non-blocking notes
- revision 2 → 3 needs uv ≥ ~0.8 to parse.
openenv-baseships uv 0.5.27 and envserver/Dockerfiles only upgrade uvif ! command -v uv— verify the base image can read revision-3 locks before a Docker/HF-Space rebuild. Won't fire on this lock-only PR (docker-build triggers on Dockerfile/py, notuv.lock; several envs already ship revision 3). cc @burtenshaw - exclude-paths process mismatch: this is a native
dependabot/uv/...PR touchingenvs/carla_env/**, yet.github/dependabot.yml'suvupdater isdirectory: "/"withexclude-paths: ["envs/**"](dependabot.yml:8) — not being honored for theuvecosystem (the intended path for env bumps is the aggregatecodex/dependabot-envs-*roll-ups). cc @burtenshaw
Summary
- 0 mechanical (Tier 1) issues to fix
- 1 alignment point for human review (index-source flip / provenance) + 2 non-blocking process/infra notes
- 0 RFC conflicts
Verdict: COMMENT — correct and security-positive (remediates two 1.26.0 CVEs, clean single-package bump). The only discussion item is the recurring registry-provenance flip, which is a team decision.
Sent by Cursor Automation: Pre-review
| name = "mcp" | ||
| version = "1.26.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "1.28.1" |
There was a problem hiding this comment.
mcp 1.26.0 → 1.28.1 (transitive via openenv → fastmcp; no pin in pyproject → lock-only is correct). Verified against PyPI: wheel 2726bca5… / sdist d51e36a5… match, not yanked, requires-python >=3.10 (carla_env is >=3.11), no known vulns. Remediates two advisories present in 1.26.0, both fixed in 1.27.2: CVE-2026-52870 (experimental enable_tasks cross-client access — unused in OpenEnv) and CVE-2026-52869 (SSE/Streamable-HTTP session hijack). uv lock --check passes; 122 pkgs, only mcp changed.
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lock revision 2 → 3 (uv re-lock side effect). Revision-3 locks need uv ≥ ~0.8. openenv-base ships uv 0.5.27 and env Dockerfiles only upgrade uv if ! command -v uv, so verify the base image can read revision-3 before a Docker/HF-Space rebuild. Non-blocking (docker-build isn't triggered by uv.lock, and several envs already ship revision 3).
| name = "aiofile" | ||
| version = "3.11.1" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| source = { registry = "https://pypi.org/simple" } |
There was a problem hiding this comment.
Index-source flip starts here: this re-lock rewrites every package's source from the internal HF mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple) — 126 lines, base had 0 on pypi.org. Hashes + files.pythonhosted.org artifact URLs are unchanged (pinned-by-hash → benign), but it changes declared provenance and widens the cross-env split. Team decision → flagging, not reverting. cc @Darktex / @burtenshaw (PRINCIPLES.md:15 reproducibility).
|
Aggregated into #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps mcp from 1.26.0 to 1.28.1.
Release notes
Sourced from mcp's releases.
... (truncated)
Commits
777b8d0[v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...4720467[v1.x] Set Development Status classifier to Production/Stable (#2976)6df3d73[v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...32d3290[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...0dca751[v1.x] Deflake the child process cleanup tests (#2839)52258a9[v1.x] Add a v2 status banner to the README (#2835)b8f4917[v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...2309e5efix: omit null optional fields from task result payloads (#2809)494eb11[v1.x] Support Python 3.14 (#2769)6213787[v1.x] Scope experimental tasks to the session that created them (#2720)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only change with a minor MCP SDK bump; main caveat is possible new DeprecationWarnings or auth behavior if MCP WebSocket/tasks or OAuth paths are exercised in CI.
Overview
Updates
envs/carla_env/uv.lockso transitivemcpmoves from 1.26.0 to 1.28.1 (pulled in throughopenenv→fastmcp). Lock revision increments to 3.The lock refresh also rewrites every resolved package’s
source.registryfrom the Hugging Face PyPI mirror tohttps://pypi.org/simple; artifact versions and hashes otherwise match the same resolution graph aside frommcp.mcp1.28.x adds Python 3.14 support, auth/session hardening (e.g. binding transport sessions to the authenticated principal), andDeprecationWarningon WebSocket transport and experimental tasks APIs when those code paths run—relevant only if Carla env tests hit those surfaces with strict warning filters.Reviewed by Cursor Bugbot for commit bd6163c. Bugbot is set up for automated code reviews on this repo. Configure here.