Repository navigation
chore(deps): update mcp requirement from <2,>=1.0 to >=1.0,<3 - #254
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [mcp](https://github.com/modelcontextprotocol/python-sdk) to permit the latest version. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.0.0...v2.1.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 2.1.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
DORA Metrics
|
brownjuly2003-code
pushed a commit
that referenced
this pull request
Sep 8, 2026
PR #254 re-proposed mcp <2 -> <3 on 2026-09-08 at 10:08, six hours after 5839a7f landed an ignore written to stop exactly that. The ignore was not missing and was not misspelled -- it reached the job intact, and did nothing. `update-types: ["version-update:semver-major"]` is derived from the CURRENT version. Neither pip ecosystem here has one: every requirement is a range (`mcp>=1.0,<2`) and Dependabot has no pip lockfile to resolve it against. Root pip run 34213488343 prints the whole failure in three lines -- "Checking if mcp needs updating" with an empty version, "Ignored versions:" with an empty list, "Updating mcp from to 2.1.1". All six conditions in that job behaved the same way: langchain-core, langchain-text-splitters, langsmith, dagster, mcp and pyiceberg-core each logged an empty ignore list. Only mcp produced a PR because it is the only one whose latest release currently sits above its ceiling; the other five were inert too, just not yet visibly so. Each condition now states `versions: [">=<ceiling>"]`, evaluated against the candidate release, so no current version is needed. Ceilings mirror the upper bound each manifest declares: langchain-core >=2, langchain-text-splitters >=2, langsmith >=1, dagster >=2, mcp >=2 (both halves of the mirrored pin), pyiceberg-core >=0.8. No policy changed -- these are the same gates 5839a7f documented, expressed in the mechanism that fires. docker and github-actions keep `update-types`: an image tag and an action ref are pinned current versions, so the update type is computable there. tests/unit/test_dependabot_ignore_contract.py holds the shape (no `update-types` in a pip ignore), ties each ceiling to the `<` bound parsed out of pyproject.toml / integrations/pyproject.toml so a widened pin cannot leave its ignore behind, and keeps the two halves of the mcp pin equal. 6 passed; test_security_tooling_policy.py and test_contract_dependencies.py still pass (27 passed). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015HsJh4f7Lqv3XmkCPSA1uF
Contributor
Author
|
Looks like mcp is no longer being updated by Dependabot, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on mcp to permit the latest version.
Release notes
Sourced from mcp's releases.
Commits
0921d94Point imports of mcp.server.fastmcp at the migration guide (#3388)4d6f87eBuild releases with the pinned hatchling and a publish action that accepts Me...c5d7d0bdocs: refresh translations for recent English changes (#3379)d8b6383Give recursive tool return types an object-rooted output schema (#3376)56af447Log MCPServer handler exceptions by kind and keep crash details off the wire ...f1c40b0Accept boolean sub-schemas in 2025-11-25 tool schema properties (#3354)57394b0Apply the request body limit to the SSE and OAuth endpoints (#3336)0cee624Hand TypedDict tool results to pydantic natively (#3331)0d92192Shorten stdio test comments (#3329)b2025abAcknowledge notification POSTs with 202 on the 2026-07-28 HTTP entry (#3326)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)