From 3c5f0a457f31a13c1e444ef4906ff40e7de7d7ef Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 13 Sep 2026 22:35:39 +0000 Subject: [PATCH] Pin mcp exactly so Dependabot can classify its updates correctly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `mcp>=2.1.1,<3` expressed the right policy — never cross into 3.x unreviewed — but it silently disabled auto-merge for every mcp update. Dependabot titles a range update "Update mcp requirement from <3,>=2.0.0 to >=2.1.1,<3", and dependabot/fetch-metadata parses the leading `3` out of that string as the previous version. Observed in smtp-mcp-wrapper#22: outputs.update-type: version-update:semver-major outputs.previous-version: 3,>=2.0.0 outputs.new-version: 2.1.1 A 2.0 -> 2.1 minor bump compared as 3 -> 2.1.1 and classified major, so the automerge workflow's patch/minor condition skipped, the job still reported success, and the PR waited for a human. One-sided ranges are unaffected, which is why pyjwt>=2.8.0 -> >=2.13.0 auto-merged normally. An exact pin gives fetch-metadata a clean previous/new pair: patch and minor bumps classify correctly and auto-merge, while 2.2.0 -> 3.0.0 still classifies as major and stays manual. The upper bound's protection is kept, just enforced by the classification rather than by pip's resolver. 2.2.0 is what `>=2.1.1,<3` resolves to today, so this does not change what the next build installs — it only removes the drift. The smoke test gates the image either way. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013fTRMScKCdAXoafoQoD3Hu --- requirements.txt | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index f1ece9e..acc34d6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,7 +1,15 @@ # Official MCP Python SDK (pulls in starlette + uvicorn used by server.py). # The upper bound is deliberate: 2.x renamed the server class and changed the # transport defaults, so a major bump is never a drop-in. Review before widening. -mcp>=2.1.1,<3 +# Pinned exactly, not as a `>=2.1.1,<3` range. The range expressed the right +# policy — never cross into 3.x unreviewed — but it broke Dependabot's +# auto-merge: its PR title reads "from <3,>=2.1.1 to ...", and +# dependabot/fetch-metadata parses the leading `3` as the previous version, so +# every mcp bump classified as semver-major and was left for manual review. +# An exact pin gives fetch-metadata a clean previous/new pair, so patch and +# minor bumps auto-merge again while a 3.0.0 still classifies as major and +# stays manual — same protection, correct classification. +mcp==2.2.0 # HTTP client used to call the Parcel REST endpoints. `httpx2` is the client the # MCP SDK now ships, so using it keeps a single HTTP stack in the image. It # verifies TLS against the system trust store (via truststore) rather than a