fix: relax Werkzeug and pydantic pins so frappe-mcp installs on Frappe v16

[dottenbr]

Installing frappe-mcp into a Frappe v16 bench quietly downgrades two of the framework's own pinned dependencies.

Frappe v16 pins Werkzeug==3.1.6 and pydantic~=2.12.5. frappe-mcp pins Werkzeug==3.1.3 and pydantic~=2.11.7. Neither range overlaps, so there is no version that satisfies both.

What makes this awkward is that pip doesn't complain. Frappe is installed editable, so its requirements aren't reconsidered during resolution, and pip just goes ahead:

$ ./env/bin/python -m pip install --dry-run "git+https://github.com/frappe/mcp.git"
...
Would install Werkzeug-3.1.3 attrs-26.1.0 frappe-mcp-0.1.1 jsonschema-4.26.0
  jsonschema-specifications-2025.9.1 pydantic-2.11.10 pydantic_core-2.33.2 ...

So a pip install frappe-mcp swaps out the WSGI layer that Frappe serves every request through, and nothing warns you.

There's a second-order problem on v16 specifically. Frappe v16 sets requires-python = ">=3.14,<3.15", and pydantic-core 2.33.2 (which pydantic~=2.11.7 resolves to) publishes no cp314 wheel — only an sdist. So the downgrade also drags in a Rust build of pydantic-core, which is what actually fails on a stock bench:

error: command ['maturin', 'pep517', 'build-wheel', ...] returned non-zero exit status 1
hint: `pydantic-core` (v2.33.2) was included because `frappe-mcp` depends on `pydantic` (v2.11.7)

pydantic-core 2.41.5, which pydantic 2.12.5 uses, does ship a cp314 wheel.

As far as I can tell the pins aren't load-bearing. The library imports Request and Response from werkzeug.wrappers, and BaseModel and ValidationError from pydantic — all stable across these versions. I ran the test suite against both the currently locked versions and the ones Frappe v16 pins:

• Werkzeug 3.1.3 / pydantic 2.11.7 (as locked), Python 3.10: 67 passed
• Werkzeug 3.1.6 / pydantic 2.12.5 (as Frappe v16 pins), Python 3.14: 67 passed

ruff check is clean on both.

This is the same problem #4 fixed for Click, so I've taken the same approach and widened the ranges rather than bumping to a new exact version. Pinning ==3.1.6 would just break anyone still on v15, which pins Werkzeug 3.1.3.

uv.lock is updated for the new specifiers only. The resolved versions are unchanged (Werkzeug 3.1.3, pydantic 2.11.7), so the lockfile still describes exactly the same dependency set, and uv lock --check passes.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — only dependency specifiers are widened, resolved lockfile versions are unchanged, and the PR author verified the test suite passes against both the old and target versions.

Both changed files touch only version specifiers. The lockfile still resolves to the same concrete versions, so nothing in the runtime environment changes for existing users. The surface used from each library (Request/Response from Werkzeug, BaseModel/ValidationError from pydantic) is stable across the widened ranges.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix: relax Werkzeug and pydantic pins to..." | Re-trigger Greptile}