build(no-ticket): upgrade mcp to 1.28.1 - #347
Open
cloudsmith-iduffy wants to merge 1 commit into
Open
Conversation
CVE-2026-59950 (high): the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without Host or Origin validation, leaving no SDK-level way to restrict which origins could connect. The CLI's MCP server does not use the websocket transport, so it is not exposed; this bump clears the CodeQL dependency alert that currently fails on every branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the pinned mcp dependency to address a high-severity CodeQL advisory, ensuring the CLI’s dependency set no longer triggers the CodeQL failing alert.
Changes:
- Bump
mcpfrom1.27.2to1.28.1inpyproject.toml(exact pin). - Update
uv.lockto reflect the newmcpversion (and regenerated lock resolution markers / artifacts).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pyproject.toml | Updates the exact mcp pin to ==1.28.1. |
| uv.lock | Regenerates the lock to include mcp==1.28.1 and updated resolution markers/artifacts. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Clears the high-severity CodeQL dependency alert CVE-2026-59950 (
mcp1.27.2 → 1.28.1), which currently fails the CodeQL check on every open PR.The deprecated
mcp.server.websocket.websocket_servertransport accepted WebSocket handshakes without applyingHostorOriginheader validation, leaving no SDK-level way to restrict which origins could connect to an application exposing that transport.cloudsmith mcpdoes not use the websocket transport, so the CLI is not exposed. This is the version bump to clear the alert.mcpis pinned exactly (==) inpyproject.toml, so both the pin and the lockfile move.Type of Change
Dependency/security bump.
Additional Notes
uv lock --upgrade-package mcp, thenuv sync --all-extras --dev. Test suite on this branch: 628 passed, 40 skipped, andcloudsmith mcp --helpstill resolves.Note this touches
uv.lock, as does the companioncryptographybump — whichever merges second will need a re-lock.🤖 Generated with Claude Code