Skip to content

chore(deps): bump the uv group across 1 directory with 3 updates - #1127

Merged
santoshkumarradha merged 1 commit into
mainfrom
dependabot/uv/sdk/python/uv-135cd329b3
Oct 26, 2026
Merged

chore(deps): bump the uv group across 1 directory with 3 updates#1127
santoshkumarradha merged 1 commit into
mainfrom
dependabot/uv/sdk/python/uv-135cd329b3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the uv group with 3 updates in the /sdk/python directory: aiohttp, claude-agent-sdk and mcp.

Updates aiohttp from 3.14.3 to 3.14.4
Updates claude-agent-sdk from 0.1.63 to 0.2.121

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.121

Bug Fixes

  • Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

  • Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
  • CI now lints and typechecks scripts/ alongside src/ and tests/
  • CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
  • Updated bundled Claude CLI to version 2.1.212

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/

pip install claude-agent-sdk==0.2.121

v0.2.120

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.211

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.120/

pip install claude-agent-sdk==0.2.120

v0.2.119

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.210

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.119/

pip install claude-agent-sdk==0.2.119
</tr></table>

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.121

Bug Fixes

  • Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

  • Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
  • CI now lints and typechecks scripts/ alongside src/ and tests/
  • CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
  • Updated bundled Claude CLI to version 2.1.212

0.2.120

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.211

0.2.119

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.210

0.2.118

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.209

0.2.117

Bug Fixes

  • Escaped untrusted fields in Slack issue notification workflow: Fixed the Slack notification workflow to properly escape issue titles and usernames using jq instead of bash substitution, preventing malformed JSON payloads and mrkdwn injection from specially crafted issue titles (#1116)

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.208

0.2.116

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.207
  • Fixed CI workspace trust so Claude Code honors project-scoped permission grants in checkout directories (#1085)

0.2.115

... (truncated)

Commits
  • f604b8c docs: update changelog for v0.2.121
  • 0a87d2c chore: release v0.2.121
  • 1cd470d chore: bump bundled CLI version to 2.1.212
  • 0278287 Validate CLAUDE_CLI_VERSION and remove shell interpolation from the build scr...
  • 347a1cb Pass --resume and --session-id as a single argv token (#1123)
  • af69c01 docs: update changelog for v0.2.120
  • 07f1ab3 chore: release v0.2.120
  • 135bf9a chore: bump bundled CLI version to 2.1.211
  • 57f67cd docs: update changelog for v0.2.119
  • d434722 chore: release v0.2.119
  • Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
  • c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested review from a team and AbirAbbas as code owners October 22, 2026 14:01
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 22, 2026
@github-actions

github-actions Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Performance

SDK Memory Δ Latency Δ Tests Status
Python 9.1 KB - 0.25 µs -29% ✓ ✓

✓ No regressions detected

@github-actions

github-actions Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface Current Baseline Δ
control-plane 88.20% 87.40% ↑ +0.80 pp 🟡
sdk-go 93.70% 92.00% ↑ +1.70 pp 🟢
sdk-python 94.72% 93.73% ↑ +0.99 pp 🟢
sdk-typescript 92.50% 90.42% ↑ +2.08 pp 🟢
web-ui 84.89% 84.79% ↑ +0.10 pp 🟡
aggregate 86.11% 85.75% ↑ +0.36 pp 🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

@github-actions

github-actions Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface Touched lines Patch coverage Status
control-plane 0 — ➖ no changes
sdk-go 0 — ➖ no changes
sdk-python 0 — ➖ no changes
sdk-typescript 0 — ➖ no changes
web-ui 0 — ➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.

@dependabot
dependabot Bot force-pushed the dependabot/uv/sdk/python/uv-135cd329b3 branch 2 times, most recently from 1cc2191 to a53e4b6 Compare October 24, 2026 18:30
santoshkumarradha
santoshkumarradha approved these changes Oct 26, 2026
View reviewed changes

@santoshkumarradha santoshkumarradha left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the current head and focused validation. This looks good to me.

@dependabot
dependabot Bot force-pushed the dependabot/uv/sdk/python/uv-135cd329b3 branch from a53e4b6 to d5ab4cd Compare October 26, 2026 13:28
@dependabot
chore(deps): bump the uv group across 1 directory with 3 updates
3053874 
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: direct:production
- dependency-name: claude-agent-sdk
  dependency-version: 0.2.121
  dependency-type: direct:production
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/sdk/python/uv-135cd329b3 branch from d5ab4cd to 3053874 Compare October 26, 2026 22:21
@santoshkumarradha
santoshkumarradha added this pull request to the merge queue Oct 26, 2026
Merged via the queue into main with commit 9780d03 Oct 26, 2026
29 checks passed
@santoshkumarradha
santoshkumarradha deleted the dependabot/uv/sdk/python/uv-135cd329b3 branch October 26, 2026 22:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@santoshkumarradha santoshkumarradha santoshkumarradha approved these changes
@AbirAbbas AbirAbbas Awaiting requested review from AbirAbbas AbirAbbas is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@santoshkumarradha