From 48f7317bb308dba4a6ad726708fd8b5a528618ea Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 19:29:47 +0000 Subject: [PATCH 1/2] fix(deps-dev): bump openai-codex from 0.159.0 to 0.160.1 --- updated-dependencies: - dependency-name: openai-codex dependency-version: 0.160.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index f2147cf26..939b2a4e5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -44,7 +44,7 @@ dependencies = [ # Hosted productivity experiments only. The Codex SDK requires Python 3.10+; # this extra never becomes a dependency of the Python 3.9-compatible core. hosted-eval = [ - "openai-codex==0.159.0; python_version >= '3.10'", + "openai-codex==0.160.1; python_version >= '3.10'", ] # Managed Cloud Sync encrypts every bundle client-side with ChaCha20-Poly1305. Keep this # outside the NumPy-only core so local/offline users do not acquire a crypto runtime. From 22fd123938353731b9f03a5afd0b8e53f67a4136 Mon Sep 17 00:00:00 2001 From: Jaixii Date: Fri, 16 Oct 2026 01:08:30 -0400 Subject: [PATCH 2/2] fix: address verified release audit findings Validated local candidate: f9dabd9d69d779210ce83e919b410b1770505e43 - f9dabd9d69d779210ce83e919b410b1770505e43 fix(packaging): align MCP install paths with the patched SDK floor - 24afc26e882c0f3fa5eab4b6e2b5294fe73bd4c6 fix(deps): require the patched MCP 1.30 transport --- pyproject.toml | 8 ++++---- requirements.txt | 2 +- tests/test_packaging.py | 5 +++-- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 939b2a4e5..3a4b86f52 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -83,9 +83,9 @@ vector = [ # The MCP server — plug Engraphis into Claude Code, Cursor, Cline, Zed, etc. # The upstream MCP SDK requires Python 3.10+; the numpy-only core remains Python 3.9. mcp = [ - # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly + # 1.30.0 fixes CVE-2026-59951 in the compatible 1.x SDK; upstream explicitly # recommends the <2 cap because stable v2 is a breaking line. - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.30.0,<2; python_version >= '3.10'", "python-multipart>=0.0.31; python_version >= '3.10'", "starlette>=1.3.1,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", @@ -140,7 +140,7 @@ all = [ "python-dotenv>=1.0", "python-multipart>=0.0.31; python_version >= '3.10'", "sentence-transformers>=2.7; python_version >= '3.10'", - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.30.0,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", @@ -183,7 +183,7 @@ test = [ # exercises the real sqlite-vec native KNN backend (k=? + filtered widening) in CI. # 0.1.9 fixes DELETE behavior for vec0 rows with longer text primary keys. "sqlite-vec>=0.1.9,<0.2", - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.30.0,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", diff --git a/requirements.txt b/requirements.txt index 87a500e57..d546275ec 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,7 +15,7 @@ numpy>=1.24 pydantic>=2.0 python-dotenv>=1.0 sentence-transformers>=2.7; python_version >= '3.10' -mcp>=1.28.1,<2; python_version >= '3.10' +mcp>=1.30.0,<2; python_version >= '3.10' pydantic-settings>=2.14.2; python_version >= '3.10' cryptography>=50.0.0; python_version >= '3.10' pypdf>=6.15.0 diff --git a/tests/test_packaging.py b/tests/test_packaging.py index ac7378ba1..0e25ce9c1 100644 --- a/tests/test_packaging.py +++ b/tests/test_packaging.py @@ -492,10 +492,11 @@ def test_extras_stay_resolvable_on_the_lowest_supported_python(): def test_dependency_floors_exclude_known_vulnerable_and_breaking_releases(): pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8") requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8") - expected = '"mcp>=1.28.1,<2; python_version >= \'3.10\'"' + expected = '"mcp>=1.30.0,<2; python_version >= \'3.10\'"' assert pyproject.count(expected) == 3 combined = pyproject + requirements - assert "mcp>=1.28.1,<2" in requirements + assert "mcp>=1.30.0,<2" in requirements + assert "mcp>=1.28.1" not in combined assert "mcp>=1.14.0" not in combined assert "python-multipart>=0.0.31" in combined assert "starlette>=1.3.1,<2" in combined