Pin mcp exactly so Dependabot can classify its updates correctly - #12
Merged
Merged
Conversation
`mcp>=2.1.1,<3` expressed the right policy — never cross into 3.x unreviewed —
but it silently disabled auto-merge for every mcp update.
Dependabot titles a range update "Update mcp requirement from <3,>=2.0.0 to
>=2.1.1,<3", and dependabot/fetch-metadata parses the leading `3` out of that
string as the previous version. Observed in smtp-mcp-wrapper#22:
outputs.update-type: version-update:semver-major
outputs.previous-version: 3,>=2.0.0
outputs.new-version: 2.1.1
A 2.0 -> 2.1 minor bump compared as 3 -> 2.1.1 and classified major, so the
automerge workflow's patch/minor condition skipped, the job still reported
success, and the PR waited for a human. One-sided ranges are unaffected, which
is why pyjwt>=2.8.0 -> >=2.13.0 auto-merged normally.
An exact pin gives fetch-metadata a clean previous/new pair: patch and minor
bumps classify correctly and auto-merge, while 2.2.0 -> 3.0.0 still classifies
as major and stays manual. The upper bound's protection is kept, just enforced
by the classification rather than by pip's resolver.
2.2.0 is what `>=2.1.1,<3` resolves to today, so this does not change what the
next build installs — it only removes the drift. The smoke test gates the
image either way.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013fTRMScKCdAXoafoQoD3Hu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mcp>=2.1.1,<3expressed the right policy — never cross into 3.x unreviewed — but it silently disables auto-merge for everymcpupdate.What happens
Dependabot titles a range update "Update mcp requirement from
<3,>=2.1.1to>=x.y.z,<3", anddependabot/fetch-metadataparses the leading3out of that string as the previous version. Observed on the equivalent PR insmtp-mcp-wrapper(#22 there):A minor bump compared as 3 → 2.1.1 and classified major. This repo's automerge workflow has the identical patch/minor condition, so the "Enable auto-merge" step skips, the job still reports success, and the PR waits for a human with nothing indicating why.
Not a permissions or settings problem — one-sided ranges parse fine, which is why
httpx2>=2.12.0andpyjwt[crypto]>=2.13.0are unaffected. Only the two-bound form breaks.The fix
An exact pin gives
fetch-metadataa clean previous/new pair:2.2.0→3.0.0still classifies as major and stays manualSame protection as the
<3bound, enforced by the classification instead of by pip's resolver.Why 2.2.0
>=2.1.1,<3resolves to 2.2.0 today, so this does not change what the next build installs — it only removes the drift. Pinning to 2.1.1 would have been a downgrade. Verified that the SDK APIs this server uses import cleanly on 2.2.0;scripts/smoke_test.shgates the image either way.Companion PRs apply the same change to
smtp-mcp-wrapperandcaldav-mcp-wrapper.🤖 Generated with Claude Code
https://claude.ai/code/session_013fTRMScKCdAXoafoQoD3Hu
Generated by Claude Code