From 197cfc462744a766f0f62a3758f1fb24e2bb5725 Mon Sep 17 00:00:00 2001 From: Andrea Cervesato Date: Fri, 17 Jul 2026 18:02:21 +0200 Subject: [PATCH] Bump mcp from 1.26.0 to 1.28.1 to fix GHSA-jpw9-pfvf-9f58 and GHSA-hvrp-rf83-w775 Both high-severity advisories affect mcp <= 1.27.1 and are fixed in 1.27.2: - GHSA-jpw9-pfvf-9f58: HTTP transports serve session requests without verifying the authenticated principal (CVSS 7.1) - GHSA-hvrp-rf83-w775: experimental task handlers allow any client to access and cancel other clients' tasks (CVSS 7.6) mcp is pulled in via fastapi-mcp (^0.4.0, requires mcp >= 1.12.0), so only the lock file changes. Co-Authored-By: Claude Fable 5 --- poetry.lock | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/poetry.lock b/poetry.lock index a850455..b8b49ed 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1031,28 +1031,37 @@ files = [ [[package]] name = "mcp" -version = "1.26.0" +version = "1.28.1" description = "Model Context Protocol SDK" optional = false python-versions = ">=3.10" groups = ["main"] files = [ - {file = "mcp-1.26.0-py3-none-any.whl", hash = "sha256:904a21c33c25aa98ddbeb47273033c435e595bbacfdb177f4bd87f6dceebe1ca"}, - {file = "mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66"}, + {file = "mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df"}, + {file = "mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683"}, ] [package.dependencies] anyio = ">=4.5" -httpx = ">=0.27.1" +httpx = ">=0.27.1,<1.0.0" httpx-sse = ">=0.4" jsonschema = ">=4.20.0" -pydantic = ">=2.11.0,<3.0.0" +pydantic = [ + {version = ">=2.11.0,<3.0.0", markers = "python_version < \"3.14\""}, + {version = ">=2.12.0,<3.0.0", markers = "python_version >= \"3.14\""}, +] pydantic-settings = ">=2.5.2" pyjwt = {version = ">=2.10.1", extras = ["crypto"]} python-multipart = ">=0.0.9" -pywin32 = {version = ">=310", markers = "sys_platform == \"win32\""} +pywin32 = [ + {version = ">=310", markers = "sys_platform == \"win32\" and python_version < \"3.14\""}, + {version = ">=311", markers = "sys_platform == \"win32\" and python_version >= \"3.14\""}, +] sse-starlette = ">=1.6.1" -starlette = ">=0.27" +starlette = [ + {version = ">=0.27", markers = "python_version < \"3.14\""}, + {version = ">=0.48.0", markers = "python_version >= \"3.14\""}, +] typing-extensions = ">=4.9.0" typing-inspection = ">=0.4.1" uvicorn = {version = ">=0.31.1", markers = "sys_platform != \"emscripten\""}