fix(python): require mcp>=1.29.0,<2 in fetch, git, and time

mcp 2.0.0 renamed McpError to MCPError and replaced the low-level Server
decorators with constructor handlers. The three servers had no upper bound,
so a fresh uvx install has resolved 2.0.0 since 2026-07-28 and failed to
start: fetch and time raise ImportError on the McpError import, git raises
AttributeError on server.list_tools().

The floor moves to 1.29.0, the last 1.x release. The previous floors (1.0.0
for git, 1.1.3 for fetch, 1.23.0 for time) resolved versions affected by
GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, and GHSA-hvrp-rf83-w775.

Porting to the v2 SDK is tracked separately.

Closes #4560
Closes #4570
Closes #4580

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
olaservo 2026-08-18 08:26:30 -07:00
commit 53dbe83b7a

View file

@ -17,7 +17,7 @@ classifiers = [
"Programming Language :: Python :: 3.10",
]
dependencies = [
"mcp>=1.23.0",
"mcp>=1.29.0,<2",
"pydantic>=2.0.0",
"tzdata>=2024.2",
"tzlocal>=5.3.1",