Bump mcp from 1.27.0 to 1.28.1#292
Conversation
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.27.0 to 1.28.1. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.27.0...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
| resolution-markers = [ | ||
| "python_full_version >= '3.13'", | ||
| "python_full_version >= '3.14' and sys_platform == 'win32'", | ||
| "python_full_version >= '3.14' and sys_platform != 'win32'", | ||
| "python_full_version == '3.13.*' and sys_platform == 'win32'", | ||
| "python_full_version == '3.13.*' and sys_platform != 'win32'", | ||
| "python_full_version < '3.13'", | ||
| ] |
There was a problem hiding this comment.
@copilot why this complicated set of markers? It would seem that the original marker is fine? Can you explain what I am missing?
There was a problem hiding this comment.
The expanded markers are auto-generated by uv — I didn't author them manually. The cause is that mcp 1.28.1 added pywin32 as a new platform-specific dependency:
{ name = "pywin32", marker = "sys_platform == 'win32'" },
When any package in the dependency graph introduces a sys_platform-conditioned dependency, uv must split its resolution markers along that platform axis so it can correctly track which packages are needed on Windows vs. non-Windows. That's why python_full_version >= '3.13' became four entries combining Python version and platform.
The uv.lock file is entirely machine-generated, so the extra verbosity there is expected and correct.
Bumps mcp from 1.27.0 to 1.28.1.
Release notes
Sourced from mcp's releases.
Commits
777b8d0[v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...4720467[v1.x] Set Development Status classifier to Production/Stable (#2976)6df3d73[v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...32d3290[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...0dca751[v1.x] Deflake the child process cleanup tests (#2839)52258a9[v1.x] Add a v2 status banner to the README (#2835)b8f4917[v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...2309e5efix: omit null optional fields from task result payloads (#2809)494eb11[v1.x] Support Python 3.14 (#2769)6213787[v1.x] Scope experimental tasks to the session that created them (#2720)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.