Bump mcp to 1.28.1 (fixes GHSA-jpw9-pfvf-9f58, GHSA-hvrp-rf83-w775)

[thekoma]

Summary

Updates mcp in poetry.lock from 1.26.0 to 1.28.1, fixing two high-severity advisories (both patched in 1.27.2):

• GHSA-jpw9-pfvf-9f58 — HTTP transports serve session requests without verifying the authenticated principal (CVSS 7.1)
• GHSA-hvrp-rf83-w775 — experimental task handlers allow any client to access and cancel other clients' tasks (CVSS 7.6)

mcp is a transitive dependency of fastapi-mcp (^0.4.0, which requires mcp >= 1.12.0), so only the lock file changes — no pyproject.toml update needed.

Testing

Full test suite passes locally with the updated lock: 136 passed.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 04569158-07ee-4746-9b2f-9935b10c961c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/bump-mcp-1.27.2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}