Refresh the locked runtime dependencies

uv.lock had not moved for most runtime dependencies since mid-2025, so
the `locked` CI leg was certifying anyio 4.10 / starlette 0.49 /
uvicorn 0.35 / pyjwt 2.10 while a fresh install of the SDK gets
releases a year newer. Re-resolve the runtime closure of mcp[cli,rich]
(the same set the dependency canary floats) to current versions; test
and docs tooling are left where they were for Dependabot to move.
Every bumped version is at least two weeks old.

Newer stubs need three typing adjustments, none of which change
behaviour: anyio 4.12+ types `TaskGroup.start_soon` as taking a
coroutine function (which it always required at runtime), so `_spawn`
and `_contained_notify` say so; Starlette 0.52 made `Request` generic
over its state type, so the one test that reads request attributes
pins the parameter; and `start_soon` now returns a handle, so a test
callback that must return None wraps it.

Author: maxisbey

src/mcp/shared/jsonrpc_dispatcher.py

@@ -9,7 +9,7 @@
 
 import contextvars
 import logging
-from collections.abc import Awaitable, Callable, Mapping
+from collections.abc import Awaitable, Callable, Coroutine, Mapping
 from dataclasses import dataclass, field
 from functools import partial
 from typing import Any, Generic, Literal, cast
@@ -209,7 +209,9 @@ async def _wrapped(progress: float, total: float | None, message: str | None) ->
     return _wrapped
 
 
-def _contained_notify(fn: OnNotify) -> OnNotify:
+def _contained_notify(
+    fn: OnNotify,
+) -> Callable[[DispatchContext[TransportContext], str, Mapping[str, Any] | None], Coroutine[Any, Any, None]]:
     """Wrap a notification handler so it can't crash the dispatcher (same boundary as `_shielded_progress`)."""
 
     async def _wrapped(dctx: DispatchContext[TransportContext], method: str, params: Mapping[str, Any] | None) -> None:
@@ -670,7 +672,7 @@ def _resolve_pending(self, request_id: RequestId | None, outcome: dict[str, Any]
 
     def _spawn(
         self,
-        fn: Callable[..., Awaitable[Any]],
+        fn: Callable[..., Coroutine[Any, Any, Any]],
         *args: object,
         sender_ctx: contextvars.Context | None,
     ) -> None:

tests/client/test_stdio.py

@@ -436,7 +436,10 @@ async def die_late() -> None:
                     process.exit(0)
 
                 # The grace wait starts when stdin closes; anchor the death there.
-                process.on_stdin_close = lambda: tg.start_soon(die_late)
+                def schedule_death() -> None:
+                    tg.start_soon(die_late)
+
+                process.on_stdin_close = schedule_death
                 # no branch: the tracer drops this nested async-with's arcs under
                 # trio's MockClock even though the body runs.
                 async with stdio_client(FAKE_PARAMS):  # pragma: no branch

tests/shared/test_streamable_http.py

@@ -1314,17 +1314,20 @@ async def _handle_context_list_tools(
 
 async def _handle_context_call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) -> CallToolResult:
     assert params.name in ("echo_headers", "echo_context")
-    assert isinstance(ctx.request, Request)
+    assert ctx.request is not None
+    # Starlette's Request is generic over its state type (0.52+); pin the parameter so member access stays typed.
+    request: Request[Any] = ctx.request
+    assert isinstance(request, Request)
 
     if params.name == "echo_headers":
-        return CallToolResult(content=[TextContent(type="text", text=json.dumps(dict(ctx.request.headers)))])
+        return CallToolResult(content=[TextContent(type="text", text=json.dumps(dict(request.headers)))])
 
     assert params.arguments is not None
     context_data: dict[str, Any] = {
         "request_id": params.arguments.get("request_id"),
-        "headers": dict(ctx.request.headers),
-        "method": ctx.request.method,
-        "path": ctx.request.url.path,
+        "headers": dict(request.headers),
+        "method": request.method,
+        "path": request.url.path,
         "protocol_version": ctx.protocol_version,
         "session_protocol_version": ctx.session.protocol_version,
     }