fix(deps): bump mcp→1.28.1 + pillow→12.3.0 (clears 24 HIGH pip-audit CVEs) - #175
Merged
Conversation
…IGH CVEs Clears 24 HIGH pip-audit findings blocking deploy: - mcp 1.28.1 fixes CVE-2026-52870, CVE-2026-52869, CVE-2026-59950 - pillow 12.3.0 fixes PYSEC-2026-2253/2254/2255/2257/3451 and more Lock regenerated via pip-compile (Python 3.11); only the two pins moved, no transitive changes. MCP low-level server API (Server/list_tools/ call_tool/stdio_server/mtypes.*) unchanged 1.27→1.28 — server.py and mcp_sampling_client.py are drop-in, no code change required. pip-audit -r simdrive/requirements.lock --vulnerability-service osv --ignore-vuln PYSEC-2025-183 --ignore-vuln PYSEC-2026-161 --strict → No known vulnerabilities found. pytest -m 'not live': 1812 passed, 7 skipped, 26 deselected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the two dependencies flagged HIGH by CI's
pip-auditgate:mcp 1.27.1 → 1.28.1— clears CVE-2026-52870, CVE-2026-52869, CVE-2026-59950 (1.28.1 is needed for the last one; 1.27.2 wouldn't cover it)pillow 12.2.0 → 12.3.0— clears PYSEC-2026-2255/2257/2254/3451/2253 et al.How
simdrive/requirements.lockregenerated with pip-compile (not hand-edited) — only the 2 pins moved, zero transitive drift.pyproject.tomlunchanged (constraints already loose:mcp>=1.0,Pillow>=10.0).Server, stdio,mcp.types.*) is unchanged; verified every imported attribute resolves.Verification
pip-audit -r requirements.lock --vulnerability-service osv --ignore-vuln PYSEC-2025-183 --ignore-vuln PYSEC-2026-161 --strict→ No known vulnerabilities.pytest -m 'not live'→ 1812 passed, 7 skipped, MCP tool-contract + image/observe paths green.Deploy-relevant: surfaced by CI while merging #173; blocks a clean release. No INIT ref attached — advisory only.