From d849b1210a4eb650d0185db9f36bab5311d47312 Mon Sep 17 00:00:00 2001
From: costin-uipath <48773677+costin-uipath@users.noreply.github.com>
Date: Fri, 16 Oct 2026 19:08:14 +0300
Subject: [PATCH] fix(deps): bump mcp 1.28.1 -> 1.30.0 for CVE-2026-59951

Raise the dev floor to mcp>=1.30.0 and lock mcp 1.30.0, the 1.x release that
fixes CVE-2026-59951. The lock changes no other package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 pyproject.toml | 2 +-
 uv.lock        | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 09608c9e..cd2a0f78 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -72,7 +72,7 @@ dev = [
     "pytest-mock>=3.15.1",
     "pytest-cov>=7.1.0",
     "pytest-xdist[psutil]>=3.0.0",
-    "mcp>=1.28.1",  # >=1.28.1 clears CVE-2026-52869/52870 (1.27.2) + CVE-2026-59950 (1.28.1)
+    "mcp>=1.30.0",  # >=1.30.0 clears CVE-2026-52869/52870 (1.27.2) + CVE-2026-59950 (1.28.1) + CVE-2026-59951 (1.30.0)
     "ruff>=0.15.7",
     "pyright>=1.1.408",
     "pip-audit>=2.10.0",
diff --git a/uv.lock b/uv.lock
index fcc4b164..cae203b8 100644
--- a/uv.lock
+++ b/uv.lock
@@ -583,7 +583,7 @@ requires-dist = [
     { name = "jmespath", specifier = ">=1.1.0" },
     { name = "jsonschema", specifier = ">=4.26.0" },
     { name = "litellm", marker = "extra == 'litellm'", specifier = ">=1.95.0,<2.0.0" },
-    { name = "mcp", marker = "extra == 'dev'", specifier = ">=1.28.1" },
+    { name = "mcp", marker = "extra == 'dev'", specifier = ">=1.30.0" },
     { name = "openai-codex", marker = "extra == 'codex'", specifier = ">=0.155.1" },
     { name = "opentelemetry-sdk", specifier = ">=1.30.0,<2.0.0" },
     { name = "pip-audit", marker = "extra == 'dev'", specifier = ">=2.10.0" },
@@ -1493,7 +1493,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.28.1"
+version = "1.30.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -1511,9 +1511,9 @@ dependencies = [
     { name = "typing-inspection" },
     { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/93/0142dc84a666daf8ad51a34268f34c12fd6fda4f3810c4be2504eecc8212/mcp-1.30.0.tar.gz", hash = "sha256:445414625fce5c295faa505bb11bacece661ab6f4028d57c935db57820b7a3e4", size = 680511, upload-time = "2026-09-07T14:34:15.845Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e2/5e/d118fce19f87a2e7d8101c35c8ae0ec289098a4df0ff244cec23e415aca0/mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df", size = 222620, upload-time = "2026-06-26T12:57:27.218Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/f4/e58bc33317c92a0203664daaf00bf6f41166cc0149e5d6870a03f7cd004a/mcp-1.30.0-py3-none-any.whl", hash = "sha256:666edb5009503e1047c9d60346a756f94b261f05cc2625f23d41c728ffc484d0", size = 234581, upload-time = "2026-09-07T14:34:14.266Z" },
 ]
 
 [[package]]