Repository navigation
chore(deps): sync mcp 1.28.1 + cryptography 50.0.0 to develop, pin mcp below 2.0 - #385
Merged
Paulo Lacerda (placerda) merged 3 commits intoAug 7, 2026
Merged
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.27.1 to 1.28.1. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.27.1...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.1 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.1...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-update targeting Raises the mcp extra floor to >=1.28.1 (matching the version synced from main) and keeps the <2 upper bound: mcp 2.0.0 is a breaking rewrite that replaces FastMCP with MCPServer, and src/agentops/mcp/server.py targets the 1.x API. Also documents in .github/dependabot.yml why security PRs land on main despite target-branch: develop, and the correct way to re-cut them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Paulo Lacerda (placerda)
deleted the
chore/sync-security-deps-to-develop
branch
August 7, 2026 14:50
Paulo Lacerda (placerda)
added a commit
that referenced
this pull request
Aug 7, 2026
Dependabot security updates always target the default branch and ignore `target-branch: develop` in dependabot.yml. Two of them (#356 mcp, #362 cryptography) squash-merged straight into `main`, leaving `main` two commits ahead of `develop`. Their content was already cherry-picked into `develop` via #385, and `develop` has since moved further ahead: package develop main aiohttp 3.14.3 3.14.1 cryptography 50.0.0 50.0.0 mcp 1.28.1 1.28.1 nltk 3.10.0 3.9.4 So `develop` is a strict superset. What was missing was only the ancestry link, and that gap is not cosmetic: `git merge-tree origin/main origin/develop` reproduces a real CONFLICT in `uv.lock`. The next `release/vX.Y.Z` -> `main` merge would have hit that conflict. This uses `-s ours` deliberately. Both main-only commits touch `uv.lock` and nothing else, and `develop` already carries equal-or-newer versions of every package they bumped, so discarding their tree loses nothing. The merge exists to advance the merge-base, not to move files. Verified after merging: `git diff HEAD origin/develop` is empty (no file changed) and `git log origin/develop..origin/main` is empty (ancestry closed). Refs #366 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: bcb9c0b6-d506-46dc-90d2-8120413166ee
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the two Dependabot security fixes that were merged into
main(#356, #362) ontodevelop, and prevents this class of mistake from recurring.Why
developwas missing theseDependabot security updates always open against the repository default branch (
main) and ignoretarget-branch: "develop"in.github/dependabot.yml. That config is already correct - it governs scheduled version updates only, and there is no option that redirects security updates.Retargeting with
gh pr edit --base developis not a reliable fix: Dependabot resets the base back tomainthe next time it rebases the branch. That is exactly what happened to #356 and #362 - they were retargeted, CI ran green againstdevelop, Dependabot then rebased and silently restoredbase: main, and the subsequent squash merges landed onmain.Net effect right now:
mainis ahead ofdevelopby these 2 commits. This PR restores parity.What is included
02e1a11mcp1.27.1 -> 1.28.1 (cherry-pick of #356), closes alerts #36/#35/#34b0d42e3cryptography48.0.1 -> 50.0.0 (cherry-pick of #362), closes alert #446cbf8bfmcpfloor to 1.28.1; document security-update targeting independabot.ymlBoth cherry-picks applied cleanly onto current
develop(which already has thenltk#381 andaiohttp#382 lockfile updates).Risk assessment
cryptography48 -> 50 (two major versions) - reviewed, low risk. This is the only bump here with a direct import.src/agentops/agent/server/auth.pyusesload_pem_public_key,ec.EllipticCurvePublicKey,public_key.verify(..., ec.ECDSA(hashes.SHA256()))andInvalidSignature. The 49.x/50.x breaking changes are FFDH deprecation and stricter DER / SCT / OCSP / CRL / PKCS#7 parsing - none of which this code path touches (it is EC-only, and parses a PEM public key rather than certificates). The identical lockfile passed the full CI matrix on #362 (lint, mypy, coverage, build-vsix, tests on ubuntu+windows x 3.11/3.12/3.13) before it was merged.mcp1.27.1 -> 1.28.1 - low risk, patch-level within the pinned<2range. Passed the full matrix on #356.mcpfloor raised to>=1.28.1, upper bound kept at<2. This deliberately supersedes #359, which proposed widening to<3.mcp2.0.0 is already published and is a breaking rewrite (FastMCP->MCPServer, newClient, removed APIs); upstream explicitly advises keeping a<2bound until you migrate.src/agentops/mcp/server.pyimportsfrom mcp.server.fastmcp import FastMCP, so<3would have resolved to an incompatible major. Note that #359's green checks were not meaningful evidence: CI runsuv sync --group dev, which never installs themcpextra, sotests/unit/test_mcp_server.pyskips via_HAS_MCP.Follow-up for maintainers
maincurrently carries security fixes that are not in any tagged release. Worth cutting a patch release (or amain->developsync perdocs/release-process.md) so the branches do not drift further.