From 635e22d942d2aac5126095e47c7cc4467cd74e85 Mon Sep 17 00:00:00 2001 From: Mother Seara Date: Tue, 4 Aug 2026 23:19:19 +0900 Subject: [PATCH] =?UTF-8?q?fix(mcp):=20pin=20mcp<2=20=E2=80=94=20an=20unbo?= =?UTF-8?q?unded=20floor=20let=20CI=20install=20a=20breaking=20major?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `dependencies = ["mcp>=1.0.0"]` had no upper bound, so CI installed mcp 2.0.0 as soon as it shipped. The server imports `mcp.server.fastmcp`, which 2.x no longer exposes at that path, and the `mcp` job started failing with ModuleNotFoundError. Nothing in this repo changed — the dependency did. main has not re-run CI since 2026-07-22, so the rot only surfaced when a PR triggered the workflow. Pin to `>=1.0.0,<2` to restore a working install. Supporting 2.x is a separate change: it needs the new import path, so the bound should be lifted together with it, not before. Co-Authored-By: Claude Opus 5 (1M context) --- mcp/pyproject.toml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mcp/pyproject.toml b/mcp/pyproject.toml index 0f40f5e..bd78eec 100644 --- a/mcp/pyproject.toml +++ b/mcp/pyproject.toml @@ -9,7 +9,10 @@ classifiers = [ "License :: OSI Approved :: Apache Software License", ] dependencies = [ - "mcp>=1.0.0", + # Upper bound is deliberate: the server imports `mcp.server.fastmcp`, which mcp 2.x no longer + # exposes at that path. An unbounded floor let CI silently install the new major and break the + # import. Lift this only together with the 2.x import path. + "mcp>=1.0.0,<2", ] [project.scripts]