chore(deps): weekly safe pypi updates · 2 packages

[mendral-app]

Packages bumped

Package	Old	New	Scope
websockets	<16.0.0	<17.0.0	runtime
asgi-correlation-id	<5.0.0	<6.0.0	dev

Per-package detail

websockets (<16.0.0 → <17.0.0)

Relaxes the upper bound to allow websockets 16.x (latest 16.1.1, released 2026-07-18).

Changelog highlights (16.0, Jan 2026):

• Dropped Python 3.9 support (project requires ≥3.10, no impact)
• Internal asyncio implementation rewrite — the public websockets.asyncio.client and websockets.asyncio.server APIs used by this SDK are unchanged
• Deprecated legacy websockets.legacy module (not used here)

Impact: The SDK uses connect(), serve(), async for message in ws, and ws.send() — all fully compatible with 16.x. No code changes required. Cap stays below 17.0 which requires Python 3.11+ (incompatible with our ≥3.10 floor).

---

asgi-correlation-id (≥4.3.4,<5.0.0 → ≥4.3.4,<6.0.0)

Relaxes the upper bound to allow 5.x (latest 5.0.1, released 2026-06-09). This is a dev dependency group package — not shipped to users.

Changelog highlights (5.0.0, May 2026):

• Dropped Python <3.10 (no impact, project requires ≥3.10)
• Removed Celery extension (not used in this codebase — package isn't even imported in src/)
• Loosened UUID validator to accept nginx/OTel IDs

Impact: Package is not imported anywhere in library source; it's only declared in the [dependency-groups] dev section. No code changes required.

Files modified

• pyproject.toml

Skipped this ecosystem

Package	Reason
openapi-python-client (==0.25.3)	Exact pin; upgrade to 0.28.x requires regenerating all client code (multiple breaking changes in code generation output). Risky — separate effort.
mcp (<2.0.0 cap)	2.0.0 (released 2026-07-28) is a complete SDK rewrite removing mcp.server.fastmcp which this project subclasses. Intentional cap; migration tracked separately.
websockets 17.x	Requires Python ≥3.11, incompatible with project's ≥3.10 floor.

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session

---

Note

Low Risk
Version constraint-only change; websockets is used in MCP but the bump stays within documented-compatible 16.x APIs, and asgi-correlation-id is dev-only and unused in library source.

Overview
Bumps dependency ceilings in pyproject.toml only: runtime websockets from <16.0.0 to <17.0.0 (allows 16.x while keeping Python 3.10 support), and dev-group asgi-correlation-id from <5.0.0 to <6.0.0.

No application code changes. websockets.asyncio client/server usage in MCP transport stays on the same public APIs; asgi-correlation-id is not referenced under src/.

^{Reviewed by Cursor Bugbot for commit cdd7891. Bugbot is set up for automated code reviews on this repo. Configure here.}