chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/sumo_rl_env#988
chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/sumo_rl_env#988dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Lock-only mcp 1.26.0 → 1.28.1 bump in sumo_rl_env. Transitive, born-clean, security-positive — no blocking issues.
Automated Checks
- Lint: PASS (for this PR).
.claude/hooks/lint.shexits 1, but every flagged file is a pre-existingruff formatcandidate in other envs (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env). None issumo_rl_env, anduv.lockis not linted (ruff/usort only touch.py). This PR introduces no lint issues. - Debug code: CLEAN.
check-debug.shreports only pre-existing hits insrc/openenv/cli/…andsrc/openenv/auto/…; 0 insumo_rl_env.
Open RFCs Context
- RFC 003 — MCP Support (In Review; @Darktex, @pankit-eng): governs the MCP protocol/interface, not the pinned
mcpSDK version → topically adjacent, no conflict. - No RFC covers dependency management / PyPI version pins, so a lock-only bump has no RFC surface.
Tier 1: Fixes Required
None.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This lock is born-clean — already fully on pypi.org/simple (143/143, 0 HF-mirror refs) and revision = 3 on both base and head — so the usual index-source-flip reproducibility flag does not apply. The diff is a minimal +3/-3 touching only the mcp block.
Process note (informational, not a code issue) — cc @burtenshaw: .github/dependabot.yml configures the uv updater with directory: "/" + exclude-paths: ["envs/**"] (lines 8–9, from 5f499da9/#566), yet this native dependabot/uv/envs/sumo_rl_env/… PR still edits envs/sumo_rl_env/uv.lock. exclude-paths is a supported Dependabot key, so the uv ecosystem doesn't appear to honor it (the aggregate codex/dependabot-envs-* roll-ups are the intended path). A config/process observation, not a defect in this PR.
RFC Conflicts
None identified.
Verification Performed
- Transitive dep:
sumo_rl_envpins nomcp; it arrives viaopenenv → fastmcp 3.1.1 → mcp, so lock-only (nopyproject.tomledit) is correct. - Lock consistency:
uv lock --check --project envs/sumo_rl_envpasses (126 pkgs). Package set unchanged (124 → 124, 0 added/removed; onlymcp1.26.0 → 1.28.1). No new transitive deps. - Hashes: sdist
d51e36a5…(638501) and wheel2726bca5…(222620) match PyPI exactly;requires-python >=3.10satisfied; not yanked. - Security (net positive):
mcp1.26.0 carries three advisories; 1.28.1 clears all and has none:GHSA-hvrp-rf83-w775/ CVE-2026-52870 (experimental-tasks cross-session) — fixed in 1.27.2GHSA-jpw9-pfvf-9f58/ CVE-2026-52869 (SSE/Streamable-HTTP session-id-only auth) — fixed in 1.27.2GHSA-vj7q-gjh5-988w/ CVE-2026-59950 (deprecated WebSocket transport missing Host/Origin validation) — fixed in 1.28.1 (so 1.28.1 is required; 1.27.2 would leave this one)- All three are narrow and don't apply to OpenEnv in practice (no
enable_tasks()/websocket_serverusage — 0 grep hits).
- mcp 1.28.0 deprecations (WebSocket transport + experimental-tasks API): no OpenEnv usage (0 grep hits in
src/+envs/sumo_rl_env) and nofilterwarnings = errorin pytest config → no warning-as-error risk.
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (dependabot
exclude-pathsprocess note, cc @burtenshaw — informational) - 0 RFC conflicts
Lock-only, born-clean, security-positive bump. Looks good to merge.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "mcp" | ||
| version = "1.26.0" | ||
| version = "1.28.1" |
There was a problem hiding this comment.
mcp 1.26.0 → 1.28.1, transitive via openenv → fastmcp 3.1.1 → mcp (sumo_rl_env pins no mcp), so this lock-only bump is correct.
Security — net positive. mcp 1.26.0 carries three advisories; 1.28.1 clears all of them (0 known vulns):
GHSA-hvrp-rf83-w775/ CVE-2026-52870 — fixed in 1.27.2GHSA-jpw9-pfvf-9f58/ CVE-2026-52869 — fixed in 1.27.2GHSA-vj7q-gjh5-988w/ CVE-2026-59950 — fixed in 1.28.1 (1.27.2 would not fix this one)
All three are narrow and unused by OpenEnv (no enable_tasks() / websocket_server; 0 grep hits). Lock is born-clean (no index flip; revision stays 3), uv lock --check passes, and the package set is unchanged (124 → 124).
| { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, | ||
| ] | ||
| sdist = { url = "https://files.pythonhosted.org/packages/fc/6d/62e76bbb8144d6ed86e202b5edd8a4cb631e7c8130f3f4893c3f90262b10/mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66", size = 608005, upload-time = "2026-01-24T19:40:32.468Z" } | ||
| sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" } |
There was a problem hiding this comment.
Hashes verified against PyPI: sdist d51e36a5…6683 (638501) and wheel 2726bca5…91df (222620) match the published mcp 1.28.1 artifacts; requires-python >=3.10 (env floor OK), not yanked, and no new transitive deps.
Note: mcp 1.28.0 deprecates the WebSocket transport and the experimental-tasks API — but OpenEnv uses neither (0 grep hits in src/ + envs/sumo_rl_env) and has no filterwarnings = error, so there's no deprecation-warning-as-error risk.
|
Aggregated into #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only minor dependency bump with no repo code changes; typical low risk unless upstream MCP releases introduce breaking protocol behavior for fastmcp consumers.
Overview
Updates the locked
mcppackage inenvs/sumo_rl_env/uv.lockfrom 1.26.0 to 1.28.1, including refreshed sdist/wheel URLs and hashes. No application source orpyproject.tomlchanges in this diff—only the lockfile entry for the Model Context Protocol SDK, which is pulled in transitively (e.g. viafastmcp).Reviewed by Cursor Bugbot for commit 8b25389. Bugbot is set up for automated code reviews on this repo. Configure here.