From 2dbea1be4c976fde0322ebc67984dc8023e81be6 Mon Sep 17 00:00:00 2001
From: WSHAPER <42714629+WSHAPER@users.noreply.github.com>
Date: Mon, 12 Oct 2026 19:50:56 +0200
Subject: [PATCH] fix(deps): floor mcp >=1.30.0 and langgraph >=1.0.1 per SBOM
 fleet reports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- mcp: add explicit constraint >=1.30.0,<2.0 (lock 1.29.0 -> 1.30.0); exits
  CVE-2026-59951 range and picks up the 1.29.1 request-body-size limits
- langgraph: make floor explicit (>=1.0.1,<2.0) at the verified resolver
  ceiling; >=1.2.14 requires langchain-core >=1.4.7 which conflicts with
  langchain ^0.3.25 (poetry: version solving failed) — full langgraph
  family bump deferred to the langchain 1.x migration card
- fastmcp held at ^2.14 (no 3.x), authlib held at 1.7.2 (CVE-2026-96760
  watch item, no upstream fix yet)

Signed-off-by: WSHAPER <42714629+WSHAPER@users.noreply.github.com>
Assisted-by: opencode:zai/glm-5.3
---
 poetry.lock    | 10 +++++-----
 pyproject.toml |  3 ++-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 8cdd8610..e1a33b40 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -2423,14 +2423,14 @@ tests = ["pytest", "simplejson"]
 
 [[package]]
 name = "mcp"
-version = "1.29.0"
+version = "1.30.0"
 description = "Model Context Protocol SDK"
 optional = false
 python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "mcp-1.29.0-py3-none-any.whl", hash = "sha256:f5a075bb611f23d6f4d080c6a1699fa62772eebc562ba9e66b306ddde1c755f7"},
-    {file = "mcp-1.29.0.tar.gz", hash = "sha256:52d01f334de1868cc3bb2d6604931126a67631f99a6c5d3b82ba47290315ec36"},
+    {file = "mcp-1.30.0-py3-none-any.whl", hash = "sha256:666edb5009503e1047c9d60346a756f94b261f05cc2625f23d41c728ffc484d0"},
+    {file = "mcp-1.30.0.tar.gz", hash = "sha256:445414625fce5c295faa505bb11bacece661ab6f4028d57c935db57820b7a3e4"},
 ]
 
 [package.dependencies]
@@ -3796,7 +3796,7 @@ description = "A lightway and fast implementation of QUIC and HTTP/3"
 optional = false
 python-versions = ">=3.7"
 groups = ["main"]
-markers = "(platform_machine == \"x86_64\" or platform_machine == \"s390x\" or platform_machine == \"armv7l\" or platform_machine == \"ppc64le\" or platform_machine == \"ppc64\" or platform_machine == \"AMD64\" or platform_machine == \"aarch64\" or platform_machine == \"arm64\" or platform_machine == \"ARM64\" or platform_machine == \"x86\" or platform_machine == \"i686\" or platform_machine == \"riscv64\" or platform_machine == \"riscv64gc\") and (platform_system == \"Darwin\" or platform_system == \"Windows\" or platform_system == \"Linux\") and (platform_python_implementation == \"CPython\" or platform_python_implementation == \"PyPy\") and (platform_python_implementation == \"CPython\" or python_version == \"3.11\")"
+markers = "(platform_system == \"Darwin\" or platform_system == \"Windows\" or platform_system == \"Linux\") and (platform_machine == \"x86_64\" or platform_machine == \"s390x\" or platform_machine == \"armv7l\" or platform_machine == \"ppc64le\" or platform_machine == \"ppc64\" or platform_machine == \"AMD64\" or platform_machine == \"aarch64\" or platform_machine == \"arm64\" or platform_machine == \"ARM64\" or platform_machine == \"x86\" or platform_machine == \"i686\" or platform_machine == \"riscv64\" or platform_machine == \"riscv64gc\") and (platform_python_implementation == \"PyPy\" or platform_python_implementation == \"CPython\") and (platform_python_implementation == \"CPython\" or python_version == \"3.11\")"
 files = [
     {file = "qh3-1.9.4-cp313-cp313t-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:66567176a55bc92f12a7cdaae6d0245f808333a6a55221f37577f79c56848b71"},
     {file = "qh3-1.9.4-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a931eba5b6b11292ed65e164a416b78a50139fb9c9dc9dce90006cbd853d1fdd"},
@@ -5327,4 +5327,4 @@ cffi = ["cffi (>=1.17,<2.0) ; platform_python_implementation != \"PyPy\" and pyt
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.11,<4"
-content-hash = "97611da2fa2c136637f4bed7a31ca500949c0f0d869776823b98f774c1665da0"
+content-hash = "60796fdbebe2c6cec1597ce3010b96c0c22bbab69a417a450cc68fa597428732"
diff --git a/pyproject.toml b/pyproject.toml
index 1ca2173d..04ea9d91 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,7 +11,7 @@ package-mode = false
 [tool.poetry.dependencies]
 python = ">=3.11,<4"
 nc-py-api = {version = "^0.30.3", extras = ["calendar"]}
-langgraph = "1.*"
+langgraph = ">=1.0.1,<2.0"
 langchain = "^0.3.25"
 ics = "^0.7.2"
 icalendar = "^7.1.2"
@@ -24,6 +24,7 @@ youtube-search = "^2.1.2"
 uvicorn = "^0.40"
 langchain-mcp-adapters = "^0.1.9"
 fastmcp = "^2.14"
+mcp = ">=1.30.0,<2.0"
 niquests = "^3.17.0"
 ddgs = "^9.13.1"