modelcontextprotocol/servers
Watch
1
0
Fork
You've already forked servers
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
4,156 commits 1 branch 46 tags 29 MiB
Commit graph servers/src/time/uv.lock
Author SHA1 Message Date
dependabot[bot]
3bcfedd8e4
 		chore(deps): bump the uv group across 3 directories with 4 updates 
Bumps the uv group with 3 updates in the /src/git directory: [gitpython](https://github.com/gitpython-developers/GitPython), [mcp](https://github.com/modelcontextprotocol/python-sdk) and [pydantic-settings](https://github.com/pydantic/pydantic-settings).
Bumps the uv group with 2 updates in the /src/time directory: [mcp](https://github.com/modelcontextprotocol/python-sdk) and [pydantic-settings](https://github.com/pydantic/pydantic-settings).
Bumps the uv group with 2 updates in the /src/fetch directory: [mcp](https://github.com/modelcontextprotocol/python-sdk) and [soupsieve](https://github.com/facelessuser/soupsieve).


Updates `gitpython` from 3.1.50 to 3.1.54
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.50...3.1.54)

Updates `mcp` from 1.23.0 to 1.28.1
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.23.0...v1.28.1)

Updates `pydantic-settings` from 2.12.0 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](https://github.com/pydantic/pydantic-settings/compare/v2.12.0...v2.14.2)

Updates `mcp` from 1.25.0 to 1.28.1
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.23.0...v1.28.1)

Updates `pydantic-settings` from 2.12.0 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](https://github.com/pydantic/pydantic-settings/compare/v2.12.0...v2.14.2)

Updates `mcp` from 1.23.0 to 1.28.1
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.23.0...v1.28.1)

Updates `soupsieve` from 2.6 to 2.8.4
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.6...2.8.4)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.54
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pydantic-settings
  dependency-version: 2.14.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pydantic-settings
  dependency-version: 2.14.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: soupsieve
  dependency-version: 2.8.4
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-29 22:05:20 +00:00
Ola Hungerford
b2a94a21a5
 		fix(deps): bump python-multipart, cryptography, pyjwt to clear HIGH alerts (#4398) 
Resolves a fresh batch of Dependabot alerts (disclosed 2026-06-15/16,
after PR #4376 merged) across the fetch, git, and time server lockfiles:

- python-multipart 0.0.27 -> 0.0.32 (CVE-2026-53539 HIGH querystring DoS,
  plus CVE-2026-53537/53538/53540 parameter smuggling / buffering)
- cryptography     48.0.0  -> 49.0.0 (GHSA-537c-gmf6-5ccf HIGH, vulnerable
  OpenSSL statically linked in wheels < 48.0.1)
- pyjwt            2.12.1  -> 2.13.0 (HIGH + medium JWT advisories)

All three are transitive deps; lockfiles only. Diff scoped to exactly
these 9 version bumps with no other resolution churn. git server tests
unchanged vs base (43 passed; 37 pre-existing Windows tempdir errors).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-29 09:13:57 +02:00
olaservo
0588ec098e fix(security): bump vulnerable deps; harden git_add (defense-in-depth) 
Real fixes (deps):
- python (git/fetch/time): idna 3.10->3.18 (GHSA-65pc), starlette
  0.49.1->1.3.1 (GHSA-86qp)
- npm: vitest ^2.1.8->^4.1.8 (critical GHSA-5xrq UI server RCE). vitest 4
  pulls vite 8 (rolldown, no esbuild), clearing the esbuild/vite advisories
  natively. Remaining root overrides: qs>=6.15.2 (GHSA-q8mj, via express),
  hono>=4.12.21 (via @modelcontextprotocol/sdk).
- npm audit: 0 vulnerabilities; all TS (313) + Python (git/fetch/time) suites
  and TS builds pass.

Hardening (git_add):
- The repo already mitigates CVE-2026-27735 by using repo.git.add (the git
  CLI rejects out-of-tree paths, PR #3164's fix), not repo.index.add (which
  did not). Add an explicit path-boundary check in git_add as defense in
  depth plus regression tests asserting the security invariant (out-of-tree
  paths are never staged), guarding against a regression to repo.index.add.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-14 13:46:02 -07:00
olaservo
0db9a34071 chore(deps): bump python deps to address security alerts 
Bumps vulnerable Python deps via `uv lock --upgrade-package` across the
three Python workspaces (src/git, src/fetch, src/time):

High severity
- gitpython 3.1.45 -> 3.1.49 (src/git): command injection via Git options
  bypass and unsafe `multi_options` validation (GHSA-x9j5-25mq-w6vh,
  GHSA-2gv7-q9w6-xfwm)
- lxml 5.3.0 -> 6.1.0 (src/fetch): XXE in default iterparse() and
  ETCompatXMLParser() (GHSA-pjj9-h2g6-3v7q)
- pyjwt 2.10.1 -> 2.12.1 (all): accepts unknown `crit` header extensions
  (GHSA-75c5-xw7c-p5pm)

Medium / low
- cryptography 46.0.5 -> 48.0.0 (all): buffer overflow with non-contiguous
  buffers; incomplete DNS name constraint enforcement
- python-dotenv 1.0.1/1.2.1 -> 1.2.2 (all): symlink-following arbitrary
  file overwrite in set_key
- python-multipart 0.0.22 -> 0.0.27 (all): DoS via large preamble/epilogue
- pytest 8.3.x -> 9.0.3 (all): vulnerable tmpdir handling
- pygments 2.19.2 -> 2.20.0 (src/fetch): ReDoS in GUID matcher
- requests 2.32.4 -> 2.33.1 (src/fetch): insecure temp file reuse in
  extract_zipped_paths()

All three workspaces sync cleanly and `uv run pytest` passes:
- src/fetch: 20 passed
- src/time: 38 passed
- src/git: 41 passed (35 preexisting Windows-only fixture cleanup
  errors are reproducible on main and unrelated to this change)

Supersedes/extends dependabot PR #3748 (which only bumped requests and
cryptography to 46.0.6).
 2026-05-05 06:55:44 -07:00
dependabot[bot]
e3ea3c8b7f
 		Bump the uv group across 3 directories with 1 update 
Bumps the uv group with 1 update in the /src/fetch directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /src/git directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /src/time directory: [cryptography](https://github.com/pyca/cryptography).


Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-11 02:51:37 +00:00
dependabot[bot]
a1f9dfa470
 		Bump the uv group across 3 directories with 1 update 
Bumps the uv group with 1 update in the /src/fetch directory: [python-multipart](https://github.com/Kludex/python-multipart).
Bumps the uv group with 1 update in the /src/git directory: [python-multipart](https://github.com/Kludex/python-multipart).
Bumps the uv group with 1 update in the /src/time directory: [python-multipart](https://github.com/Kludex/python-multipart).


Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22)

Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22)

Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22)

---
updated-dependencies:
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-26 23:57:45 +00:00
dependabot[bot]
b906f726fa
 		Bump the uv group across 3 directories with 5 updates 
Bumps the uv group with 5 updates in the /src/fetch directory:

| Package | From | To |
| --- | --- | --- |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.2.0` | `1.23.0` |
| [requests](https://github.com/psf/requests) | `2.32.3` | `2.32.4` |
| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |
| [starlette](https://github.com/Kludex/starlette) | `0.41.2` | `0.49.1` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.2.3` | `2.6.3` |

Bumps the uv group with 3 updates in the /src/git directory: [mcp](https://github.com/modelcontextprotocol/python-sdk), [h11](https://github.com/python-hyper/h11) and [starlette](https://github.com/Kludex/starlette).
Bumps the uv group with 2 updates in the /src/time directory: [h11](https://github.com/python-hyper/h11) and [starlette](https://github.com/Kludex/starlette).


Updates `mcp` from 1.2.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `requests` from 2.32.3 to 2.32.4
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.3...v2.32.4)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.2 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `urllib3` from 2.2.3 to 2.6.3
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.2.3...2.6.3)

Updates `mcp` from 1.2.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.2 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.2.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.2 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.1.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.1.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.1.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: requests
  dependency-version: 2.32.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-17 18:03:32 +00:00
Koichi ITO
9c9813d9dc fix(time): Fix McpError constructor usage in time server 
Fixes CI failures in PR #3220.

PR #3220 updated `mcp` library from 1.0.0 to 1.23.0, which caused test
failures due to a breaking change in `McpError` constructor API.

The `McpError` constructor now expects an `ErrorData` object instead of
a plain string message. This commit fixes the usage in `get_zoneinfo()`
function to use `ErrorData(code=INVALID_PARAMS, message=...)`.

```console
Error before fix:
  AttributeError: 'str' object has no attribute 'message'
```

Also updates `mcp` dependency to >=1.23.0 in pyproject.toml to ensure
compatibility with the new API.
 2026-01-17 23:12:04 +09:00
Frederick Ros
cd88954e18 fix: resolve ZoneInfo error by using IANA-compliant local timezone 
Replaced local timezone detection using tzinfo string (e.g. "CEST")
with tzlocal.get_localzone_name() to ensure a valid IANA time zone
(e.g. "Europe/Paris") is passed to ZoneInfo. This avoids runtime
errors on macOS and other systems that return non-IANA tz abbreviations.
 2025-05-13 18:53:03 +02:00
David Soria Parra
e7e1c85058
 		python servers 0.6.2 2024-12-04 15:57:31 +00:00
David Soria Parra
f86486984c
 		python servers 0.6.0 2024-11-29 17:54:40 +00:00
David Soria Parra
bccd33f7a1
 		fix time server 2024-11-29 11:29:23 +00:00
Mariusz Korzekwa
d37ce3cc51 Fix uv lock for time-server, update Readme 2024-11-28 22:18:40 +01:00
Mariusz Korzekwa
740b744ea8 Clean time server implementation 2024-11-28 22:12:09 +01:00
Mariusz Korzekwa
122ca1aaa5 Update pyproject of time server, remove time server temporary files 2024-11-28 22:12:09 +01:00
Mariusz Korzekwa
b7ca691573 Add initial time server 2024-11-28 22:12:09 +01:00