Repository navigation
deps: move the MCP lock to mcp 2.3.0 - #93
Merged
Merged
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 2.2.0 to 2.3.0. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v2.2.0...v2.3.0) --- updated-dependencies: - dependency-name: mcp dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
cristiangirlea
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot's bump of
mcpto 2.3.0 changed only the manifest; this adds the regeneratedrequirements-mcp.lockon top of its commit, so the hash-checked fetcher installs what the manifest says.Resolved inside the pinned
python:3.12-bookwormimage withpip download --only-binary=:all:for CPython 3.12 on Linux x86_64 and, new in this lock, aarch64 (the published images are built for both), with every tag frommanylinux2014tomanylinux_2_36so the wheel the fetcher picks on bookworm is the one hashed; every hash frompip hash -a sha256, recomputed once more withhashlibby the script that wrote the lock, and both platforms checked to resolve to the same version of every package. A download without--platform, whatmcp-fetcherdoes, gave the same x86_64 files. Fourteen other packages moved with the SDK (mcp-types2.3.0,cryptography50.0.2,httpcore2andhttpx22.16.0,pycparser3.12,pydantic2.14.1,pydantic-core2.50.1,pyjwt2.15.1,rpds-py2026.9.1,sse-starlette3.6.0,starlette1.10.0,truststore0.10.5,uvicorn0.54.0); none was added or removed. The server needed no change.docs/mcp.mdand the lock header say the lock now covers both architectures; one CHANGELOG line under Unreleased.Files:
requirements-mcp.txt(Dependabot),requirements-mcp.lock,docs/mcp.md,CHANGELOG.md.Checks on this head, merged with main:
mcp-fetcherwith--require-hashesfrom an empty cache,mcp-tests(125), the full deterministic sequence of AGENTS.md, and.github/scripts/audit.sh(pip-audit 2.10.1 on both locks andcomposer audit: nothing). Both worker images also build forlinux/arm64under QEMU on the development machine; the aarch64 wheels were hashed from what PyPI served but not run on an aarch64 machine. Review: independent read by Codex (gpt-6.1-sol) of the dependency graph, the wheel hashes against PyPI and the server's use of the SDK: no defect.