From d8ee412df9c71c51a193f16decbe3d866f2d54fe Mon Sep 17 00:00:00 2001 From: JSv4 Date: Sat, 1 Aug 2026 08:27:26 -0500 Subject: [PATCH] Pin mcp below v2 to fix pip resolution-too-deep and avoid a breaking-API bump pydantic-ai-slim[mcp]'s fastmcp-slim dependency caps mcp<2.0 across its whole published range, so the previously-unbounded mcp>=1.28.1 pin was resolving to 1.x only by accident; Dependabot's mcp>=2.0.0 bump (PR #2207) directly contradicts that transitive cap and pip's resolver gives up with resolution-too-deep. mcp 2.0 also removes decorator-based handler registration from mcp.server.lowlevel.Server in favor of on_*= constructor kwargs, which opencontractserver/mcp/server.py does not speak yet (10 registration sites), so forcing the bump would break the MCP subsystem at ASGI import time. Explicit <2 pin documents the constraint until that migration is scoped. --- changelog.d/2207-pin-mcp-below-v2.fixed.md | 13 +++++++++++++ requirements/base.txt | 9 ++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 changelog.d/2207-pin-mcp-below-v2.fixed.md diff --git a/changelog.d/2207-pin-mcp-below-v2.fixed.md b/changelog.d/2207-pin-mcp-below-v2.fixed.md new file mode 100644 index 000000000..c6fd029af --- /dev/null +++ b/changelog.d/2207-pin-mcp-below-v2.fixed.md @@ -0,0 +1,13 @@ +- `requirements/base.txt:85` — pinned `mcp` to `>=1.28.1,<2` (was unbounded). + Dependabot's `mcp>=2.0.0` bump (#2207) hit `pip`'s resolver as + `resolution-too-deep`: `pydantic-ai-slim[mcp]`'s `fastmcp-slim` dependency + caps `mcp<2.0` across its entire published range, so the unbounded pin was + resolving to 1.x only by transitive accident. `mcp` 2.0 is also a breaking + rewrite — `mcp.server.lowlevel.Server` drops decorator-based handler + registration (`@mcp_server.list_resources()` etc.) in favor of `on_*=` + constructor kwargs with a new `(ctx, params)` handler signature — which + `opencontractserver/mcp/server.py` does not yet speak (10 registration + sites across `create_mcp_server()` and `create_scoped_mcp_server()`), so + forcing the bump would fail at ASGI import time, not just in CI. PR #2207 + is left open/unmerged; revisit the `mcp` 2.x migration as its own scoped + task once `fastmcp-slim` ships v2 support. diff --git a/requirements/base.txt b/requirements/base.txt index c67111e38..ed94375ac 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -82,7 +82,14 @@ posthog==7.33.0 # https://github.com/posthog/posthog-python # Model Context Protocol # ------------------------------------------------------------------------------ -mcp>=1.28.1 # https://github.com/anthropics/python-sdk +mcp>=1.28.1,<2 # https://github.com/modelcontextprotocol/python-sdk +# ^ pydantic-ai-slim[mcp] -> fastmcp-slim caps mcp<2.0 across its whole +# published range as of 2026-08; mcp 2.0 is a breaking rewrite (decorator-based +# handler registration on mcp.server.lowlevel.Server removed in favor of +# on_*= constructor kwargs) that opencontractserver/mcp/server.py does not yet +# speak. Bump this pin only alongside a migration of that file, once +# fastmcp-slim ships v2 support (or fastmcp-slim/mcp is dropped in favor of +# calling the v2 API directly). # Not directly required, pinned by Snyk to avoid a vulnerability # ------------------------------------------------------------------------------