From e81c7c7be7c7d9d330cc827616f23592432566a3 Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:10:01 -0700 Subject: [PATCH 1/2] fix(VULN-103416): bump mcp to >=1.27.2 for task isolation CVE Add a direct mcp floor in pyproject.toml and refresh poetry.lock so transitive MCP SDK usage resolves to 1.29.0 (fixed release). Pin the log-mcp-calls example requirements to the same minimum. Co-authored-by: Cursor --- .../log-mcp-calls/requirements.txt | 2 +- poetry.lock | 110 +++--------------- pyproject.toml | 1 + 3 files changed, 21 insertions(+), 92 deletions(-) diff --git a/examples/logging-samples/log-mcp-calls/requirements.txt b/examples/logging-samples/log-mcp-calls/requirements.txt index a5993abc..9b41d248 100644 --- a/examples/logging-samples/log-mcp-calls/requirements.txt +++ b/examples/logging-samples/log-mcp-calls/requirements.txt @@ -1,4 +1,4 @@ anthropic splunk-ao -mcp +mcp>=1.27.2,<2 python-dotenv \ No newline at end of file diff --git a/poetry.lock b/poetry.lock index 588c0532..35e73cb1 100644 --- a/poetry.lock +++ b/poetry.lock @@ -391,87 +391,6 @@ files = [ {file = "certifi-2025.8.3.tar.gz", hash = "sha256:e564105f78ded564e3ae7c923924435e1daa7463faeab5bb932bc53ffae63407"}, ] -[[package]] -name = "cffi" -version = "1.17.1" -description = "Foreign Function Interface for Python calling C code." -optional = false -python-versions = ">=3.8" -groups = ["main", "test"] -files = [ - {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"}, - {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"}, - {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"}, - {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"}, - {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"}, - {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"}, - {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"}, - {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"}, - {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"}, - {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"}, - {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"}, - {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"}, - {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"}, - {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"}, - {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"}, - {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"}, - {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"}, - {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"}, - {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"}, - {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"}, - {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"}, - {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"}, - {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"}, - {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"}, - {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"}, - {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"}, - {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"}, - {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"}, -] -markers = {main = "(extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" and python_version == \"3.14\"", test = "python_version == \"3.14\" and platform_python_implementation == \"PyPy\""} - -[package.dependencies] -pycparser = "*" - [[package]] name = "cffi" version = "2.1.0" @@ -2477,29 +2396,38 @@ markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra [[package]] name = "mcp" -version = "1.27.0" +version = "1.29.0" description = "Model Context Protocol SDK" optional = true python-versions = ">=3.10" groups = ["main"] markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" files = [ - {file = "mcp-1.27.0-py3-none-any.whl", hash = "sha256:5ce1fa81614958e267b21fb2aa34e0aea8e2c6ede60d52aba45fd47246b4d741"}, - {file = "mcp-1.27.0.tar.gz", hash = "sha256:d3dc35a7eec0d458c1da4976a48f982097ddaab87e278c5511d5a4a56e852b83"}, + {file = "mcp-1.29.0-py3-none-any.whl", hash = "sha256:f5a075bb611f23d6f4d080c6a1699fa62772eebc562ba9e66b306ddde1c755f7"}, + {file = "mcp-1.29.0.tar.gz", hash = "sha256:52d01f334de1868cc3bb2d6604931126a67631f99a6c5d3b82ba47290315ec36"}, ] [package.dependencies] anyio = ">=4.5" -httpx = ">=0.27.1" +httpx = ">=0.27.1,<1.0.0" httpx-sse = ">=0.4" jsonschema = ">=4.20.0" -pydantic = ">=2.11.0,<3.0.0" +pydantic = [ + {version = ">=2.11.0,<3.0.0", markers = "python_version < \"3.14\""}, + {version = ">=2.12.0,<3.0.0", markers = "python_version >= \"3.14\""}, +] pydantic-settings = ">=2.5.2" pyjwt = {version = ">=2.10.1", extras = ["crypto"]} python-multipart = ">=0.0.9" -pywin32 = {version = ">=310", markers = "sys_platform == \"win32\""} +pywin32 = [ + {version = ">=310", markers = "sys_platform == \"win32\" and python_version < \"3.14\""}, + {version = ">=311", markers = "sys_platform == \"win32\" and python_version >= \"3.14\""}, +] sse-starlette = ">=1.6.1" -starlette = ">=0.27" +starlette = [ + {version = ">=0.27", markers = "python_version < \"3.14\""}, + {version = ">=0.48.0", markers = "python_version >= \"3.14\""}, +] typing-extensions = ">=4.9.0" typing-inspection = ">=0.4.1" uvicorn = {version = ">=0.31.1", markers = "sys_platform != \"emscripten\""} @@ -4059,7 +3987,7 @@ files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {main = "python_version <= \"3.13\" and platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\" and (extra == \"openai\" or extra == \"all\") or (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" and (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or (extra == \"langchain\" or extra == \"all\") and implementation_name != \"PyPy\" and (extra == \"openai\" or extra == \"all\") or (extra == \"langchain\" or extra == \"all\") and python_version == \"3.14\" and platform_python_implementation == \"PyPy\"", test = "platform_python_implementation == \"PyPy\" and (implementation_name != \"PyPy\" or python_version == \"3.14\")"} +markers = {main = "python_version <= \"3.13\" and implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\") or implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" and implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} [[package]] name = "pydantic" @@ -4555,7 +4483,7 @@ description = "Python for Window Extensions" optional = true python-versions = "*" groups = ["main"] -markers = "(extra == \"openai\" or extra == \"all\") and sys_platform == \"win32\" or python_version <= \"3.13\" and sys_platform == \"win32\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\") and platform_system == \"Windows\"" +markers = "python_version <= \"3.13\" and sys_platform == \"win32\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\") and platform_system == \"Windows\" or (extra == \"openai\" or extra == \"all\") and sys_platform == \"win32\"" files = [ {file = "pywin32-311-cp310-cp310-win32.whl", hash = "sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3"}, {file = "pywin32-311-cp310-cp310-win_amd64.whl", hash = "sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b"}, @@ -6637,4 +6565,4 @@ openai = ["openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "7f0626d1fd4a9f67fcf5d91023a20c51b0043cc4b8506df9f3d2bf20be4c2c7f" +content-hash = "f8f1e9dd7ee4608e1c20425e363d6bf9b62c1c732354764d159a49a66e06e3fd" diff --git a/pyproject.toml b/pyproject.toml index 9a30ec7b..5cc274e3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -53,6 +53,7 @@ opentelemetry-api = "^1.38.0" opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" +mcp = { version = ">=1.27.2,<2", optional = true } [tool.poetry.group.test.dependencies] pytest = "^8.4.0" From bdf2ee1bd935b9680ecaf5b983ee35f33499916f Mon Sep 17 00:00:00 2001 From: shuningc Date: Mon, 3 Aug 2026 23:32:13 -0700 Subject: [PATCH 2/2] fix(VULN-103416): export mcp floor via openai, crewai, and all extras Wire the optional mcp>=1.27.2,<2 constraint into package extras metadata so downstream pip installs enforce the patched version, not only this repo lock. Co-authored-by: Cursor --- poetry.lock | 54 +++++++++++++++++++++++++------------------------- pyproject.toml | 6 +++--- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/poetry.lock b/poetry.lock index 4e781f75..a11c5c2e 100644 --- a/poetry.lock +++ b/poetry.lock @@ -500,7 +500,7 @@ files = [ {file = "cffi-2.1.0-cp315-cp315t-win_arm64.whl", hash = "sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210"}, {file = "cffi-2.1.0.tar.gz", hash = "sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9"}, ] -markers = {main = "python_version <= \"3.13\" and platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\") or (extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" and (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\")", test = "platform_python_implementation == \"PyPy\""} +markers = {main = "python_version <= \"3.13\" and platform_python_implementation != \"PyPy\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or (extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" and (extra == \"langchain\" or extra == \"all\") and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") and platform_python_implementation != \"PyPy\" or (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")", test = "platform_python_implementation == \"PyPy\""} [package.dependencies] pycparser = {version = "*", markers = "implementation_name != \"PyPy\""} @@ -662,7 +662,7 @@ description = "Composable command line interface toolkit" optional = true python-versions = ">=3.10" groups = ["main"] -markers = "(extra == \"openai\" or extra == \"all\") and sys_platform != \"emscripten\" or python_version <= \"3.13\" and sys_platform != \"emscripten\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\")" +markers = "sys_platform != \"emscripten\" and python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or sys_platform != \"emscripten\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\")" files = [ {file = "click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76"}, {file = "click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6"}, @@ -682,7 +682,7 @@ files = [ {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"}, {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"}, ] -markers = {main = "(python_version <= \"3.13\" or platform_system == \"Windows\") and (extra == \"crewai\" or extra == \"all\" or platform_system == \"Windows\") and (os_name == \"nt\" or platform_system == \"Windows\" or sys_platform == \"win32\")", dev = "platform_system == \"Windows\" or sys_platform == \"win32\"", test = "sys_platform == \"win32\""} +markers = {main = "(platform_system == \"Windows\" or python_version <= \"3.13\") and (extra == \"crewai\" or extra == \"all\" or platform_system == \"Windows\") and (os_name == \"nt\" or platform_system == \"Windows\" or sys_platform == \"win32\")", dev = "platform_system == \"Windows\" or sys_platform == \"win32\"", test = "sys_platform == \"win32\""} [[package]] name = "coloredlogs" @@ -869,7 +869,7 @@ description = "cryptography is a package which provides cryptographic recipes an optional = true python-versions = "!=3.9.0,!=3.9.1,>=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db"}, {file = "cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db"}, @@ -1601,7 +1601,7 @@ description = "Consume Server-Sent Event (SSE) messages with HTTPX." optional = true python-versions = ">=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "httpx_sse-0.4.1-py3-none-any.whl", hash = "sha256:cba42174344c3a5b06f255ce65b350880f962d99ead85e776f23c6618a377a37"}, {file = "httpx_sse-0.4.1.tar.gz", hash = "sha256:8f44d34414bc7b21bf3602713005c5df4917884f76072479b21f68befa4ea26e"}, @@ -1918,7 +1918,7 @@ files = [ {file = "jiter-0.10.0-cp39-cp39-win_amd64.whl", hash = "sha256:1b28302349dc65703a9e4ead16f163b1c339efffbe1049c30a44b001a2a4fff9"}, {file = "jiter-0.10.0.tar.gz", hash = "sha256:07a7142c38aacc85194391108dc91b5b57093c978a9932bd86a36862759d9500"}, ] -markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\""} +markers = {main = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\")"} [[package]] name = "json-repair" @@ -1998,7 +1998,7 @@ description = "An implementation of JSON Schema validation for Python" optional = true python-versions = ">=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "jsonschema-4.25.0-py3-none-any.whl", hash = "sha256:24c2e8da302de79c8b9382fee3e76b355e44d2a4364bb207159ce10b517bd716"}, {file = "jsonschema-4.25.0.tar.gz", hash = "sha256:e63acf5c11762c0e6672ffb61482bdf57f0876684d8d249c0fe2d730d48bc55f"}, @@ -2021,7 +2021,7 @@ description = "The JSON Schema meta-schemas and vocabularies, exposed as a Regis optional = true python-versions = ">=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "jsonschema_specifications-2025.4.1-py3-none-any.whl", hash = "sha256:4653bffbd6584f7de83a67e0d620ef16900b390ddc7939d56684d6c81e33f1af"}, {file = "jsonschema_specifications-2025.4.1.tar.gz", hash = "sha256:630159c9f4dbea161a6a2205c3011cc4f18ff381b189fff48bb39b9bf26ae608"}, @@ -2399,7 +2399,7 @@ description = "Model Context Protocol SDK" optional = true python-versions = ">=3.10" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "mcp-1.29.0-py3-none-any.whl", hash = "sha256:f5a075bb611f23d6f4d080c6a1699fa62772eebc562ba9e66b306ddde1c755f7"}, {file = "mcp-1.29.0.tar.gz", hash = "sha256:52d01f334de1868cc3bb2d6604931126a67631f99a6c5d3b82ba47290315ec36"}, @@ -2944,7 +2944,7 @@ files = [ {file = "openai-2.32.0-py3-none-any.whl", hash = "sha256:4dcc9badeb4bf54ad0d187453742f290226d30150890b7890711bda4f32f192f"}, {file = "openai-2.32.0.tar.gz", hash = "sha256:c54b27a9e4cb8d51f0dd94972ffd1a04437efeb259a9e60d8922b8bd26fe55e0"}, ] -markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\""} +markers = {main = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\")"} [package.dependencies] anyio = ">=3.5.0,<5" @@ -3254,7 +3254,7 @@ files = [ {file = "orjson-3.11.9-cp314-cp314-win_arm64.whl", hash = "sha256:eebdbdeef0094e4f5aefa20dcd4eb2368ab5e7a3b4edea27f1e7b2892e009cf9"}, {file = "orjson-3.11.9.tar.gz", hash = "sha256:4fef17e1f8722c11587a6ef18e35902450221da0028e65dbaaa543619e68e48f"}, ] -markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\") or extra == \"langchain\" or extra == \"all\"", test = "platform_python_implementation != \"PyPy\""} +markers = {main = "python_version <= \"3.13\" and (extra == \"langchain\" or extra == \"all\" or extra == \"crewai\") or extra == \"langchain\" or extra == \"all\"", test = "platform_python_implementation != \"PyPy\""} [[package]] name = "ormsgpack" @@ -3339,7 +3339,7 @@ files = [ {file = "packaging-24.2-py3-none-any.whl", hash = "sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759"}, {file = "packaging-24.2.tar.gz", hash = "sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f"}, ] -markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\" or extra == \"openai\") or extra == \"langchain\" or extra == \"all\" or extra == \"openai\""} +markers = {main = "extra == \"langchain\" or extra == \"all\" or extra == \"openai\" or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\" or extra == \"openai\")"} [[package]] name = "pathspec" @@ -3985,7 +3985,7 @@ files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {main = "python_version <= \"3.13\" and implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\" and (extra == \"openai\" or extra == \"all\") or implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\") and platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" and implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or implementation_name != \"PyPy\" and (extra == \"langchain\" or extra == \"all\") and (extra == \"openai\" or extra == \"all\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} +markers = {main = "(python_version <= \"3.13\" or extra == \"langchain\" or extra == \"all\" or extra == \"openai\" or extra == \"crewai\") and (platform_python_implementation != \"PyPy\" or extra == \"langchain\" or extra == \"all\") and (platform_python_implementation == \"PyPy\" or python_version <= \"3.13\" or extra == \"openai\" or extra == \"all\" or extra == \"crewai\") and implementation_name != \"PyPy\" and (platform_python_implementation == \"PyPy\" or extra == \"crewai\" or extra == \"all\" or extra == \"openai\") and (extra == \"langchain\" or extra == \"all\" or extra == \"crewai\" or extra == \"openai\")", test = "platform_python_implementation == \"PyPy\" and implementation_name != \"PyPy\""} [[package]] name = "pydantic" @@ -4469,7 +4469,7 @@ description = "A streaming multipart parser for Python" optional = true python-versions = ">=3.10" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "python_multipart-0.0.32-py3-none-any.whl", hash = "sha256:ff6d3f776f16878c894e52e107296ffc890e913c611b1a4ec6c44e2821fe2e23"}, {file = "python_multipart-0.0.32.tar.gz", hash = "sha256:be54b7f3fa167bb83e4fcd936b887b708f4e57fe75911c02aebf53efaf8d938e"}, @@ -4482,7 +4482,7 @@ description = "Python for Window Extensions" optional = true python-versions = "*" groups = ["main"] -markers = "python_version <= \"3.13\" and sys_platform == \"win32\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\") and platform_system == \"Windows\" or (extra == \"openai\" or extra == \"all\") and sys_platform == \"win32\"" +markers = "sys_platform == \"win32\" and python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or sys_platform == \"win32\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\") and platform_system == \"Windows\"" files = [ {file = "pywin32-311-cp310-cp310-win32.whl", hash = "sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3"}, {file = "pywin32-311-cp310-cp310-win_amd64.whl", hash = "sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b"}, @@ -4568,7 +4568,7 @@ files = [ {file = "PyYAML-6.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8"}, {file = "pyyaml-6.0.2.tar.gz", hash = "sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e"}, ] -markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\") or extra == \"langchain\" or extra == \"all\""} +markers = {main = "extra == \"langchain\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\")"} [[package]] name = "referencing" @@ -4577,7 +4577,7 @@ description = "JSON Referencing + Python" optional = true python-versions = ">=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "referencing-0.36.2-py3-none-any.whl", hash = "sha256:e8699adbbf8b5c7de96d8ffa0eb5c158b3beafce084968e2ea8bb08c6794dcd0"}, {file = "referencing-0.36.2.tar.gz", hash = "sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa"}, @@ -4804,7 +4804,7 @@ description = "Python bindings to Rust's persistent data structures (rpds)" optional = true python-versions = ">=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "rpds_py-0.27.0-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:130c1ffa5039a333f5926b09e346ab335f0d4ec393b030a18549a7c7e7c2cea4"}, {file = "rpds_py-0.27.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a4cf32a26fa744101b67bfd28c55d992cd19438aff611a46cac7f066afca8fd4"}, @@ -5005,7 +5005,7 @@ description = "C version of reader, parser and emitter for ruamel.yaml derived f optional = false python-versions = ">=3.9" groups = ["dev"] -markers = "python_version <= \"3.13\" and platform_python_implementation == \"CPython\"" +markers = "python_version < \"3.14\" and platform_python_implementation == \"CPython\"" files = [ {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-macosx_13_0_arm64.whl", hash = "sha256:11f891336688faf5156a36293a9c362bdc7c88f03a8a027c2c1d8e0bcde998e5"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-manylinux2014_aarch64.whl", hash = "sha256:a606ef75a60ecf3d924613892cc603b154178ee25abb3055db5062da811fd969"}, @@ -5127,7 +5127,7 @@ description = "SSE plugin for Starlette" optional = true python-versions = ">=3.9" groups = ["main"] -markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" +markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\"" files = [ {file = "sse_starlette-3.0.2-py3-none-any.whl", hash = "sha256:16b7cbfddbcd4eaca11f7b586f3b8a080f1afe952c15813455b162edea619e5a"}, {file = "sse_starlette-3.0.2.tar.gz", hash = "sha256:ccd60b5765ebb3584d0de2d7a6e4f745672581de4f5005ab31c3a25d10b52b3a"}, @@ -5153,7 +5153,7 @@ files = [ {file = "starlette-1.3.1-py3-none-any.whl", hash = "sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6"}, {file = "starlette-1.3.1.tar.gz", hash = "sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0"}, ] -markers = {main = "extra == \"openai\" or extra == \"all\" or extra == \"middleware\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"middleware\" or extra == \"crewai\")"} +markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\" or extra == \"middleware\") or extra == \"openai\" or extra == \"all\" or extra == \"crewai\" or extra == \"middleware\""} [package.dependencies] anyio = ">=3.6.2,<5" @@ -5192,7 +5192,7 @@ files = [ {file = "tenacity-9.1.2-py3-none-any.whl", hash = "sha256:f77bf36710d8b73a50b2dd155c97b870017ad21afe6ab300326b0371b3b05138"}, {file = "tenacity-9.1.2.tar.gz", hash = "sha256:1169d376c297e7de388d18b4481760d478b0e99a777cad3a9c86e556f4b697cb"}, ] -markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\") or extra == \"langchain\" or extra == \"all\""} +markers = {main = "extra == \"langchain\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"langchain\")"} [package.extras] doc = ["reno", "sphinx"] @@ -5689,7 +5689,7 @@ description = "The lightning-fast ASGI server." optional = true python-versions = ">=3.9" groups = ["main"] -markers = "(extra == \"openai\" or extra == \"all\") and sys_platform != \"emscripten\" or python_version <= \"3.13\" and sys_platform != \"emscripten\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\")" +markers = "sys_platform != \"emscripten\" and python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\") or sys_platform != \"emscripten\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\") or python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\")" files = [ {file = "uvicorn-0.35.0-py3-none-any.whl", hash = "sha256:197535216b25ff9b785e29a0b79199f55222193d47f820816e7da751e9bc8d4a"}, {file = "uvicorn-0.35.0.tar.gz", hash = "sha256:bc662f087f7cf2ce11a1d7fd70b90c9f98ef2e2831556dd078d131b96cc94a01"}, @@ -6555,13 +6555,13 @@ cffi = {version = ">=1.11", markers = "platform_python_implementation == \"PyPy\ cffi = ["cffi (>=1.11)"] [extras] -all = ["crewai", "langchain", "langchain-core", "langsmith", "litellm", "openai", "openai-agents", "packaging", "starlette"] -crewai = ["crewai", "litellm"] +all = ["crewai", "langchain", "langchain-core", "langsmith", "litellm", "mcp", "openai", "openai-agents", "packaging", "starlette"] +crewai = ["crewai", "litellm", "mcp"] langchain = ["langchain", "langchain-core", "langsmith"] middleware = ["starlette"] -openai = ["openai", "openai-agents", "packaging"] +openai = ["mcp", "openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "f98eb39ac850e98d1e68d5b9e2d8373abfe0eef515cc6c1243264fb2bb5ac89b" +content-hash = "1f875bee6832bf4b54a1eed330c57ec5307942b757af3c4ecd1e6bf6409036ff" diff --git a/pyproject.toml b/pyproject.toml index 6511e24b..94ce6fd8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -27,10 +27,10 @@ packages = [ [project.optional-dependencies] langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] -openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)"] -crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"] +openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "mcp (>=1.27.2,<2)"] +crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)"] middleware = ["starlette"] -all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"] +all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)"]