chore(deps): bump mcp from 1.27.0 to 1.28.1 in /envs/jupyter_env#982
chore(deps): bump mcp from 1.27.0 to 1.28.1 in /envs/jupyter_env#982dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.27.0 to 1.28.1. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.27.0...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
PR #982 — chore(deps): bump mcp from 1.27.0 to 1.28.1 in /envs/jupyter_env (Dependabot, native dependabot/uv/... branch). Diff: 1 file, +3/-3 — only envs/jupyter_env/uv.lock.
Automated Checks
- Lint: PASS (for this PR). Lockfiles/TOML aren't linted — the hook only touches
.pyinsrc//tests//envs/, and this PR changes no.py.bash .claude/hooks/lint.shdoes exit non-zero, but only on ~20 pre-existing reformat candidates in unrelated envs (opencode_env, chat_env, coding_tools_env, …). Notably its list even includesenvs/jupyter_env/server/jupyter_environment.py, which is not part of this diff — so it's baseline debt, not introduced here. - Debug code: CLEAN (for this PR).
check-debug.shonly scanssrc/; this PR touches nosrc/files. Its hits (console.print/TODO insrc/openenv/cli/...) are pre-existing and unrelated. - Lockfile consistency:
uv lock --check --project envs/jupyter_env→ PASS (127 packages resolved). - Hashes verified against PyPI: sdist
d51e36a5…b69683(638501) and wheel2726bca5…9df(222620) matchmcp1.28.1 on PyPI;yanked: false;requires-python >=3.10(env is>=3.10).
Open RFCs Context
- RFC 003 — MCP Support (In Review): topically adjacent since it governs OpenEnv's MCP interface, but this is a version bump of the underlying
mcplibrary (a transitive dep), not an interface change → no conflict. - No RFC covers Python packaging / dependency management / PyPI, so dependency bumps have no RFC surface. Other In-Review RFCs (000/001/002/005) and Draft RFC 010 are unrelated.
Tier 1: Fixes Required
- None.
mcpis a transitive dependency (pulled viaopenenv→fastmcp3.2.4, which imposes nomcppin; jupyter_env'spyproject.tomlhas nomcpentry), so a lock-only change with nopyproject.tomledit is correct. Version + sdist + wheel updated consistently, and the lock is verified.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. A transitive dependency bump doesn't touch API surface, reward computation, client/server separation, or the Gymnasium interface.
This lock is born clean (base and head both revision = 3, 0 HF-mirror refs, 132 pypi.org/simple), so — unlike some other env-lock Dependabot PRs — there is no registry index-flip and no lock-revision bump here. Nothing to flag on reproducibility.
RFC Conflicts
None identified.
Process note (non-blocking)
ALIGNMENT FLAG (process/config, not a blocker): .github/dependabot.yml scopes the uv updater to directory: "/" with exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/jupyter_env/... PR modifies envs/jupyter_env/uv.lock. The uv ecosystem doesn't appear to honor exclude-paths for these env locks (the intended path is the aggregated codex/dependabot-envs-* roll-ups). Harmless for this PR; flagging so config-vs-behavior stays a conscious choice.
- Suggested reviewer: @burtenshaw (authored the dependabot
exclude-pathsscoping — commit5f499da9, #566).
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (the non-blocking Dependabot
exclude-pathsprocess note) - 0 RFC conflicts to discuss
Net positive — security fix. mcp 1.27.0 carries two advisories — GHSA-hvrp-rf83-w775 / CVE-2026-52870 and GHSA-jpw9-pfvf-9f58 / CVE-2026-52869 (both fixed_in: 1.27.2); 1.28.1 clears both and has 0 known vulnerabilities. Lock-only, verified, and consistent — safe to merge.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "mcp" | ||
| version = "1.27.0" | ||
| version = "1.28.1" |
There was a problem hiding this comment.
mcp 1.27.0 → 1.28.1 verified. It's a transitive dep (via openenv → fastmcp 3.2.4, which sets no mcp pin), so a lock-only change with no pyproject.toml edit is correct. uv lock --check --project envs/jupyter_env passes (127 pkgs); the resolved mcp dependency block is unchanged.
Security-positive: base 1.27.0 is affected by GHSA-hvrp-rf83-w775 (CVE-2026-52870) and GHSA-jpw9-pfvf-9f58 (CVE-2026-52869), both fixed in ≥1.27.2; 1.28.1 has 0 known vulnerabilities.
| { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, | ||
| ] | ||
| sdist = { url = "https://files.pythonhosted.org/packages/8b/eb/c0cfc62075dc6e1ec1c64d352ae09ac051d9334311ed226f1f425312848a/mcp-1.27.0.tar.gz", hash = "sha256:d3dc35a7eec0d458c1da4976a48f982097ddaab87e278c5511d5a4a56e852b83", size = 607509, upload-time = "2026-04-02T14:48:08.88Z" } | ||
| sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" } |
There was a problem hiding this comment.
sdist/wheel hashes match PyPI for mcp 1.28.1 — sdist d51e36a5…b69683 (638501), wheel 2726bca5…9df (222620); yanked: false, requires-python >=3.10.
This lock is born clean (already revision = 3, all sources on pypi.org/simple), so this PR stays a minimal +3/-3 single-package bump — no registry index-flip and no lock-revision change to review.
|
Aggregated into #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps mcp from 1.27.0 to 1.28.1.
Release notes
Sourced from mcp's releases.
Commits
777b8d0[v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...4720467[v1.x] Set Development Status classifier to Production/Stable (#2976)6df3d73[v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...32d3290[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...0dca751[v1.x] Deflake the child process cleanup tests (#2839)52258a9[v1.x] Add a v2 status banner to the README (#2835)b8f4917[v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...2309e5efix: omit null optional fields from task result payloads (#2809)494eb11[v1.x] Support Python 3.14 (#2769)6213787[v1.x] Scope experimental tasks to the session that created them (#2720)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only minor version bump of a transitive MCP SDK dependency with no direct code changes in this env.
Overview
Updates
envs/jupyter_env/uv.lockso the transitivemcppackage (pulled in byfastmcp) moves from 1.27.0 to 1.28.1. No application source orpyproject.tomlchanges.The newer SDK adds Python 3.14 support, deprecation warnings for WebSocket transport and experimental tasks APIs (still present in 1.x), and minor fixes such as omitting null optional fields from task result payloads. Jupyter env integration goes through FastMCP / OpenEnv MCP types, not those deprecated entry points directly.
Reviewed by Cursor Bugbot for commit 351312f. Bugbot is set up for automated code reviews on this repo. Configure here.