From 7b70a86828bf8005c210124806ca9958edb3a8fd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 19:30:05 +0000 Subject: [PATCH 1/3] fix(deps-dev): bump tree-sitter-language-pack from 1.20.0 to 1.21.0 Bumps [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) from 1.20.0 to 1.21.0. - [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases) - [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md) - [Commits](https://github.com/xberg-io/tree-sitter-language-pack/compare/v1.20.0...v1.21.0) --- updated-dependencies: - dependency-name: tree-sitter-language-pack dependency-version: 1.21.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pyproject.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index f2147cf26..34ae65bba 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -98,7 +98,7 @@ mcp = [ code = [ "tree-sitter>=0.23; python_version >= '3.10'", "tree-sitter-language-pack==0.9.0; python_version < '3.10'", - "tree-sitter-language-pack==1.20.0; python_version >= '3.10'", + "tree-sitter-language-pack==1.21.0; python_version >= '3.10'", ] # Local resource extraction. Text/code/HTML/DOCX remain stdlib-only; this adds PDF # extraction and image OCR bindings (the Tesseract executable is installed separately). @@ -145,7 +145,7 @@ all = [ "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", "tree-sitter-language-pack==0.9.0; python_version < '3.10'", - "tree-sitter-language-pack==1.20.0; python_version >= '3.10'", + "tree-sitter-language-pack==1.21.0; python_version >= '3.10'", "pypdf>=6.15.0", "Pillow>=12.3.0; python_version >= '3.10'", "pytesseract>=0.3.10; python_version >= '3.10'", @@ -188,7 +188,7 @@ test = [ "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", "tree-sitter-language-pack==0.9.0; python_version < '3.10'", - "tree-sitter-language-pack==1.20.0; python_version >= '3.10'", + "tree-sitter-language-pack==1.21.0; python_version >= '3.10'", "pypdf>=6.15.0", "Pillow>=12.3.0; python_version >= '3.10'", "pytesseract>=0.3.10; python_version >= '3.10'", From 6fa5148b7709afb9816b1304935a15f10a899ef4 Mon Sep 17 00:00:00 2001 From: Jaixii Date: Wed, 14 Oct 2026 03:42:54 -0400 Subject: [PATCH 2/3] Keep new benchmark campaigns on the updated tree-sitter grammars --- eval/configs/benchmark-requirements-windows-py312-current.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eval/configs/benchmark-requirements-windows-py312-current.txt b/eval/configs/benchmark-requirements-windows-py312-current.txt index cb312a3c3..e7639e7c8 100644 --- a/eval/configs/benchmark-requirements-windows-py312-current.txt +++ b/eval/configs/benchmark-requirements-windows-py312-current.txt @@ -105,7 +105,7 @@ torch==2.13.0 tqdm==4.70.1 transformers==5.17.0 tree-sitter==0.26.0 -tree-sitter-language-pack==1.17.0 +tree-sitter-language-pack==1.21.0 typer==0.27.2 typing-inspection==0.4.4 typing_extensions==4.16.0 From ad5dd8ad42e674e49733f8e5a89412576b18e6d8 Mon Sep 17 00:00:00 2001 From: Jaixii Date: Fri, 16 Oct 2026 01:08:38 -0400 Subject: [PATCH 3/3] fix: address verified release audit findings Validated local candidate: e142e3158e06c92c00253266120496d33d111a92 - e142e3158e06c92c00253266120496d33d111a92 fix(packaging): align MCP install paths with the patched SDK floor - e5631206443c0d069d3e9114bccb87111b89d602 fix(deps): require the patched MCP 1.30 transport --- pyproject.toml | 8 ++++---- requirements.txt | 2 +- tests/test_packaging.py | 5 +++-- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 34ae65bba..0ef7ded1a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -83,9 +83,9 @@ vector = [ # The MCP server — plug Engraphis into Claude Code, Cursor, Cline, Zed, etc. # The upstream MCP SDK requires Python 3.10+; the numpy-only core remains Python 3.9. mcp = [ - # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly + # 1.30.0 fixes CVE-2026-59951 in the compatible 1.x SDK; upstream explicitly # recommends the <2 cap because stable v2 is a breaking line. - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.30.0,<2; python_version >= '3.10'", "python-multipart>=0.0.31; python_version >= '3.10'", "starlette>=1.3.1,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", @@ -140,7 +140,7 @@ all = [ "python-dotenv>=1.0", "python-multipart>=0.0.31; python_version >= '3.10'", "sentence-transformers>=2.7; python_version >= '3.10'", - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.30.0,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", @@ -183,7 +183,7 @@ test = [ # exercises the real sqlite-vec native KNN backend (k=? + filtered widening) in CI. # 0.1.9 fixes DELETE behavior for vec0 rows with longer text primary keys. "sqlite-vec>=0.1.9,<0.2", - "mcp>=1.28.1,<2; python_version >= '3.10'", + "mcp>=1.30.0,<2; python_version >= '3.10'", "pydantic-settings>=2.14.2; python_version >= '3.10'", "cryptography>=50.0.0; python_version >= '3.10'", "tree-sitter>=0.23; python_version >= '3.10'", diff --git a/requirements.txt b/requirements.txt index 87a500e57..d546275ec 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,7 +15,7 @@ numpy>=1.24 pydantic>=2.0 python-dotenv>=1.0 sentence-transformers>=2.7; python_version >= '3.10' -mcp>=1.28.1,<2; python_version >= '3.10' +mcp>=1.30.0,<2; python_version >= '3.10' pydantic-settings>=2.14.2; python_version >= '3.10' cryptography>=50.0.0; python_version >= '3.10' pypdf>=6.15.0 diff --git a/tests/test_packaging.py b/tests/test_packaging.py index ac7378ba1..0e25ce9c1 100644 --- a/tests/test_packaging.py +++ b/tests/test_packaging.py @@ -492,10 +492,11 @@ def test_extras_stay_resolvable_on_the_lowest_supported_python(): def test_dependency_floors_exclude_known_vulnerable_and_breaking_releases(): pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8") requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8") - expected = '"mcp>=1.28.1,<2; python_version >= \'3.10\'"' + expected = '"mcp>=1.30.0,<2; python_version >= \'3.10\'"' assert pyproject.count(expected) == 3 combined = pyproject + requirements - assert "mcp>=1.28.1,<2" in requirements + assert "mcp>=1.30.0,<2" in requirements + assert "mcp>=1.28.1" not in combined assert "mcp>=1.14.0" not in combined assert "python-multipart>=0.0.31" in combined assert "starlette>=1.3.1,<2" in combined