Merge pull request #217 from CyberDefenseOperations/contrib/bump-mcp-security

deps: raise mcp floor to >=1.28.1 (PYSEC-2026-3481/3482/3483)
This commit is contained in:
Rohit Prasad 2026-08-23 11:52:51 -07:00 committed by GitHub
commit 161e058083
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -21,7 +21,7 @@ dependencies = [
"docstring_parser",
"pyyaml>=6", # persona manifest frontmatter (YAML)
"pydantic>=2",
"mcp>=1.1,<2", # MCP client (stdio + streamable-http); 2.0 removed streamablehttp_client
"mcp>=1.28.1,<2", # MCP client (stdio + streamable-http); floor >=1.28.1 avoids PYSEC-2026-3481/3482/3483 (fixed in 1.27.2/1.28.1); <2 since 2.0.0 removed streamablehttp_client
"httpx>=0.27", # sync outbound senders for messaging connectors (send_message tool)
"websockets>=13", # managed Slack relay client transport (relay_client.py)
"ddgs>=9", # keyless default web-search provider (DuckDuckGo); Tavily/Brave use httpx