From a68cf19c40b5ccb6bcf2fd6fe99201b6eca6fd52 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 19:14:41 +0000 Subject: [PATCH 1/2] chore(deps): update mcp requirement from <2,>=1.28.1 to >=1.28.1,<3 Updates the requirements on [mcp](https://github.com/modelcontextprotocol/python-sdk) to permit the latest version. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.28.1...v2.2.0) --- updated-dependencies: - dependency-name: mcp dependency-version: 2.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pyproject.toml | 6 +++--- requirements.txt | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 57c4e3d6..52aa3748 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -85,7 +85,7 @@ vector = [ mcp = [ # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly # recommends the <2 cap because stable v2 is a breaking line. - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.28.1,<3; python_version >= '3.10'", "python-multipart>=0.0.31; python_version >= '3.10'", "starlette>=1.3.1,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", @@ -140,7 +140,7 @@ all = [ "python-dotenv>=1.0", "python-multipart>=0.0.31; python_version >= '3.10'", "sentence-transformers>=2.7; python_version >= '3.10'", - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.28.1,<3; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", @@ -183,7 +183,7 @@ test = [ # exercises the real sqlite-vec native KNN backend (k=? + filtered widening) in CI. # 0.1.9 fixes DELETE behavior for vec0 rows with longer text primary keys. "sqlite-vec>=0.1.9,<0.2", - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.28.1,<3; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", diff --git a/requirements.txt b/requirements.txt index 87a500e5..a7abc14e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,7 +15,7 @@ numpy>=1.24 pydantic>=2.0 python-dotenv>=1.0 sentence-transformers>=2.7; python_version >= '3.10' -mcp>=1.28.1,<2; python_version >= '3.10' +mcp>=1.28.1,<3; python_version >= '3.10' pydantic-settings>=2.14.2; python_version >= '3.10' cryptography>=50.0.0; python_version >= '3.10' pypdf>=6.15.0 From b9f0b85a5310e6af0dfac030d5d62578bc479e12 Mon Sep 17 00:00:00 2001 From: Coding-Dev-Tools Date: Sat, 12 Sep 2026 05:31:37 -0400 Subject: [PATCH 2/2] Preserve MCP 1.x compatibility and repair Pi audit --- .github/dependabot.yml | 4 ++++ integrations/pi/npm-shrinkwrap.json | 6 +++--- integrations/pi/package.json | 2 +- pyproject.toml | 6 +++--- requirements.txt | 2 +- 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 277ac103..2501aa4f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,10 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 5 + # MCP 2 changes the server API; migrate and qualify it separately. + ignore: + - dependency-name: "mcp" + update-types: ["version-update:semver-major"] labels: - "dependencies" - package-ecosystem: "npm" diff --git a/integrations/pi/npm-shrinkwrap.json b/integrations/pi/npm-shrinkwrap.json index 8268d41c..02a3687e 100644 --- a/integrations/pi/npm-shrinkwrap.json +++ b/integrations/pi/npm-shrinkwrap.json @@ -3121,9 +3121,9 @@ } }, "node_modules/hono": { - "version": "4.13.0", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz", - "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==", + "version": "4.13.7", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz", + "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==", "license": "MIT", "engines": { "node": ">=16.9.0" diff --git a/integrations/pi/package.json b/integrations/pi/package.json index 20c3dfac..e7ab1166 100644 --- a/integrations/pi/package.json +++ b/integrations/pi/package.json @@ -49,7 +49,7 @@ "@modelcontextprotocol/sdk": "1.30.0" }, "overrides": { - "hono": "^4.12.34" + "hono": "^4.13.5" }, "peerDependencies": { "@earendil-works/pi-coding-agent": "*", diff --git a/pyproject.toml b/pyproject.toml index 52aa3748..57c4e3d6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -85,7 +85,7 @@ vector = [ mcp = [ # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly # recommends the <2 cap because stable v2 is a breaking line. - "mcp>=1.28.1,<3; python_version >= '3.10'", + "mcp>=1.28.1,<2; python_version >= '3.10'", "python-multipart>=0.0.31; python_version >= '3.10'", "starlette>=1.3.1,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", @@ -140,7 +140,7 @@ all = [ "python-dotenv>=1.0", "python-multipart>=0.0.31; python_version >= '3.10'", "sentence-transformers>=2.7; python_version >= '3.10'", - "mcp>=1.28.1,<3; python_version >= '3.10'", + "mcp>=1.28.1,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", @@ -183,7 +183,7 @@ test = [ # exercises the real sqlite-vec native KNN backend (k=? + filtered widening) in CI. # 0.1.9 fixes DELETE behavior for vec0 rows with longer text primary keys. "sqlite-vec>=0.1.9,<0.2", - "mcp>=1.28.1,<3; python_version >= '3.10'", + "mcp>=1.28.1,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", diff --git a/requirements.txt b/requirements.txt index a7abc14e..87a500e5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,7 +15,7 @@ numpy>=1.24 pydantic>=2.0 python-dotenv>=1.0 sentence-transformers>=2.7; python_version >= '3.10' -mcp>=1.28.1,<3; python_version >= '3.10' +mcp>=1.28.1,<2; python_version >= '3.10' pydantic-settings>=2.14.2; python_version >= '3.10' cryptography>=50.0.0; python_version >= '3.10' pypdf>=6.15.0