From 1497c392e4ed911a81ea049fa30b4e9473e92c7c Mon Sep 17 00:00:00 2001 From: Patrick Buckley Date: Thu, 11 Jun 2026 20:30:14 -0700 Subject: [PATCH] chore: cap mcp <2 ahead of the v2 breaking rewrite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mcp 2.0.0a1 shipped 2026-06-11 (stable targeted ~2026-07-27). v2 removes streamablehttp_client, changes the transport tuple arity, and renames mcp.types fields to snake_case — all of which our client imports. The maintainers' release note asks downstream packages to add an upper bound now (their worked example is this exact constraint). Floor stays at 1.27: nothing newer adds anything our surface needs, and the #2147 shutdown busy-loop we wrap remains unfixed at every released version. Resolution is unchanged (1.27.2); lockfile re-pinned metadata only. --- pyproject.toml | 2 +- uv.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 330d0031..37f019ce 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -26,7 +26,7 @@ dependencies = [ "openai>=2.37", "anthropic>=0.108", # claude-fable-5 support; hard runtime floor is 0.105 (mid-conversation system blocks) "httpx>=0.28", - "mcp>=1.27", + "mcp>=1.27,<2", # v2 is a breaking rewrite (2.0.0a1 live 2026-06-11; stable ~2026-07-27) — streamablehttp_client removed, 2-tuple transport, snake_case types; migrate deliberately "starlette>=1.0.1", # PYSEC-2026-161: host-header path-injection in URL reconstruction (auth-bypass on apps comparing reconstructed URL paths) "uvicorn>=0.34", "sse-starlette>=2.0", diff --git a/uv.lock b/uv.lock index 70c1b74b..70c56fa4 100644 --- a/uv.lock +++ b/uv.lock @@ -2385,7 +2385,7 @@ requires-dist = [ { name = "httpx", specifier = ">=0.28" }, { name = "httpx-sse", specifier = ">=0.4" }, { name = "lacme", specifier = ">=1.0.5" }, - { name = "mcp", specifier = ">=1.27" }, + { name = "mcp", specifier = ">=1.27,<2" }, { name = "mypy", marker = "extra == 'dev'", specifier = ">=1.14" }, { name = "openai", specifier = ">=2.37" }, { name = "psycopg", extras = ["binary"], specifier = ">=3.2" },