From fd8538ec2cb5ee05b66f1d7e2c088938422236fd Mon Sep 17 00:00:00 2001 From: "repo-maintenance (claudebox)" Date: Sun, 2 Aug 2026 03:37:57 +0000 Subject: [PATCH] fix(deps): cap mcp<2 so the MCP server can import again MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mcp 2.0.0 removed `mcp.server.fastmcp`, which mcp_server/server.py imports. mcp_server/requirements.txt declared an unbounded `mcp>=1.0.0`, so a fresh `pip install -r mcp_server/requirements.txt` resolves 2.0.0 and the server dies at import with ModuleNotFoundError. Capping below 2.0 resolves 1.29.0 and server.py imports cleanly again. No other dependency changed. requirements.txt carries only `>=` floors with no pins and no lockfile, so under update_policy=patch there is nothing to bump — the floors already resolve to the newest release on every install. That is also why this break was possible; see the PR for the pinning recommendation. Verified against a fresh Python 3.11 resolve (matching the Dockerfile): every third-party import the app uses still resolves — apscheduler, authlib, dotenv, flask, flask_limiter (now 4.1.1, a major above the >=3.5 floor), flask_talisman, flask_wtf, werkzeug, pytz — and mcp_server/server.py imports. --- mcp_server/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mcp_server/requirements.txt b/mcp_server/requirements.txt index 9714bd9..239aace 100644 --- a/mcp_server/requirements.txt +++ b/mcp_server/requirements.txt @@ -1,2 +1,2 @@ -mcp>=1.0.0 +mcp>=1.0.0,<2 httpx>=0.27.0