Bump mcp/ deps to close known CVEs - #15
Conversation
…raphy, pyjwt, python-multipart, pydantic-settings, python-dotenv) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1735b700e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "telethon>=1.44.0", | ||
| "cryptg>=0.4", | ||
| "pydantic>=2.9", | ||
| "pydantic-settings>=2.7", | ||
| "python-dotenv>=1.0", | ||
| "pydantic-settings>=2.14.2", |
There was a problem hiding this comment.
This dependency block only raises pydantic-settings/python-dotenv while mcp>=1.26.0 still permits the vulnerable SDK tree. In the checked install paths I inspected (.github/workflows/ci.yml and scripts/ci-release-gate.sh), the repo uses pip install -e . without -U; pip install --help says -U, --upgrade is what upgrades specified packages, so an existing MCP venv with mcp==1.26.0 remains valid and keeps the old Starlette/PyJWT/python-multipart/cryptography versions this commit is meant to replace. Please bump the mcp lower bound to the first safe version (and add direct transitive floors if needed) so the standard update path actually exits the vulnerable range.
Useful? React with 👍 / 👎.
1 participant
Summary
uv lock --upgradeinmcp/to pull the full dependency tree to latest, closing known CVEs: starlette (BadHost auth-bypass + 4 others), cryptography, pyjwt, python-multipart, pydantic-settings, python-dotenvpydantic-settingsandpython-dotenvfloor pins inmcp/pyproject.tomlso a fresh install can't land on the vulnerable rangecontrol-plane/needed no change (pyyaml already latest, no known CVEs)Test plan
mcpunit tests (383 passed) on old deps (baseline) and again on upgraded depspython -m compileall src testsclean./scripts/fresh-install-smoke.shrelease gate: packaging-hygiene, mcp-pytest, mcp-release-gates, plugin-package-build all okcontrol-planefast_read_adaptertests are a pre-existing local-PATH artifact of this worktree setup (reproduces identically on unmodifiedmain, unrelated to this change)🤖 Generated with Claude Code