Skip to content

chore(deps): bump mcp in integration-tests lockfile - #5874

Merged
cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261020-uv-integration-tests
Oct 20, 2026
Merged

cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261020-uv-integration-tests

Conversation

@cdbartholomew

Copy link
Copy Markdown
Contributor

Routine dependency maintenance for hindsight-integration-tests/uv.lock.

Closes Dependabot alerts #1872

The lock was regenerated with uv lock --upgrade-package for mcp only; nothing else was re-resolved apart from what those upgrades require.

mcp stays on the 1.x line at 1.30.0, the first fixed release. The 2.x major changes the HTTP client stack and is out of scope for a maintenance bump.

Verification

  • uv build: OK
  • uv sync --frozen: OK (mcp 1.30.0)
  • uv run pytest tests: 8 failed, 1 skipped locally. The same 8 tests fail identically on a clean origin/main checkout (httpx.ConnectError: All connection attempts failed against the live API server the suite expects). The test-integration job runs it against a real server.

@cdbartholomew cdbartholomew added security Security / dependency vulnerability remediation p2 Medium severity - remediate within 60 days labels Oct 20, 2026
@cdbartholomew cdbartholomew self-assigned this Oct 20, 2026
@cdbartholomew
cdbartholomew merged commit f21f702 into main Oct 20, 2026
100 checks passed
@cdbartholomew
cdbartholomew deleted the chore/security-daily-20261020-uv-integration-tests branch October 20, 2026 21:12
@nicoloboschi nicoloboschi mentioned this pull request Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

p2 Medium severity - remediate within 60 days security Security / dependency vulnerability remediation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant