build(deps): refresh stale uv.lock (reconcile ~30 missing deps) (#2349)

Browse source

## Description

Refreshes the **stale `uv.lock`** and clears the mcp CVEs in one pass.
main's lock had drifted far from `pyproject.toml` — a full `uv lock`
(with the **CI-matching uv 0.11.29**, what `astral-sh/setup-uv@v5`
installs) reconciles ~30 declared-but-unlocked dependencies and their
transitives. This is the comprehensive counterpart to the minimal #2348.

Closes #

## Type of Change
- [x] Bug fix (security + dependency hygiene)

## Why it's this big
`uv lock --check` **fails on `main`** (the committed lock predates
several pyproject deps). CI hasn't caught it because the pipeline only
ever runs `uv export --frozen` (consume-as-is), never a re-lock — so the
drift accumulated silently. A correct lock is ~1100 lines of
reconciliation.

## Changes Made
- `pyproject.toml`: `mcp>=1.0.0` → `>=1.28.1` (core + `[mcp]` extra) —
carried from the security fix.
- `uv.lock`: full refresh via `uv lock` (uv 0.11.29). `mcp` → **1.28.1**
(clears CVE-2026-52869/52870/59950); ~30 previously-missing deps added;
transitives reconciled.

## Testing
```text
uv 0.11.29 lock --check   -> Resolved 269 packages (up to date, no error)
uv export --frozen ...    -> succeeds (CI pip-audit path)
mcp in refreshed lock     -> 1.28.1
```
The transitive version changes are what `uv lock` produces for the
current `pyproject.toml`; **CI's full test matrix is the validation
gate** for behavior (that's the point of the shards).

## Relationship to #2348
**Superset.** #2348 is the minimal, surgical mcp bump (5-line diff) for
immediate CVE closure with near-zero blast radius. This PR does the same
mcp fix **plus** the full stale-lock reconciliation. Merge **one**:
- Prefer low risk / fast → merge **#2348**, land this refresh separately
afterwards.
- Prefer fixing the lock drift now → merge **this**, close #2348.

No `CHANGELOG.md` edit (release-please owns it).

...

This commit is contained in:

Tejas Chopra 2026-07-17 04:08:59 -07:00 • committed by GitHub

parent a90be94e32

commit 0fa337f64f

No known key found for this signature in database

GPG key ID: B5690EEEBB952194

1 changed files with 986 additions and 123 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1109

uv.lock generated

View file

File diff suppressed because it is too large Load diff