Discovered during a public-repo PR review sweep.
The audit job blocks #152 (dependencies group). Pre-existing transitive advisories on main's lock:
mcp 1.27.2 → 1.28.1 (CVE-2026-59950)setuptools 82.0.1 → 83.0.0 (PYSEC-2026-3447)
uv lock --upgrade-package mcp setuptools, then rebase/merge #152.
Discovered during a public-repo PR review sweep.
The
auditjob blocks #152 (dependencies group). Pre-existing transitive advisories onmain's lock:mcp 1.27.2→ 1.28.1 (CVE-2026-59950)setuptools 82.0.1→ 83.0.0 (PYSEC-2026-3447)uv lock --upgrade-package mcp setuptools, then rebase/merge #152.