Bump vulnerable dependencies and migrate rmcp to 1.4#297
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses Dependabot-reported Rust crate vulnerabilities by updating several semver-compatible dependencies and migrating the MCP server integration from rmcp 0.12 to rmcp 1.4 (to pick up the CVE fix), including the required API adaptation for ServerInfo in rmcp 1.x.
Changes:
- Upgrade
rmcpto1.4(andschemarsto1) and enable the required rmcpmacrosfeature. - Update the MCP server’s
get_infoimplementation to use rmcp 1.x’s non-exhaustiveServerInfoconstruction pattern. - Refresh
Cargo.lockto incorporate patched transitive dependency versions (e.g.,openssl,rustls-webpki,actix-http,rand,rpassword, etc.).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/mcp/server.rs |
Removes the old ToolRouter field usage and updates server metadata construction for rmcp 1.x (ServerInfo API). |
Cargo.toml |
Bumps rmcp to 1.4, updates schemars to 1, and adds the macros feature needed for rmcp proc-macros. |
Cargo.lock |
Locks updated direct/transitive crate versions consistent with the dependency security updates and rmcp migration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Resolve 16 open Dependabot alerts. Lockfile bumps: openssl 0.10.81, rustls-webpki 0.103.13, actix-http 3.12.1, rpassword 7.5.4, rand 0.9.3. rmcp needs a major bump to 1.4.0 for CVE-2026-42559, which requires schemars 1 and constructing the now-non-exhaustive ServerInfo via its builder; the vestigial tool_router field is dropped since 1.x resolves the router through Self::tool_router(). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
renatgalimov
force-pushed
the
fix/security-dependency-updates-15.07.2026
branch
from
July 15, 2026 21:15
f7cac33 to
7531baa
Compare
nicomiguelino
approved these changes
Jul 15, 2026
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixteen open Dependabot alerts flag vulnerable direct and transitive crates: openssl, rustls-webpki, actix-http, rpassword, rand, and rmcp. This bumps the five semver-compatible crates in the lockfile and upgrades rmcp from 0.12 to 1.4 to pick up the fix for CVE-2026-42559. The rmcp major bump pulls in schemars 1 and required adapting the MCP server's
get_infoto rmcp 1.x's builder-based, non-exhaustiveServerInfo. The migrated MCP server was verified end-to-end by driving an initialize/tools-list handshake over stdio — all 33 tools list correctly with their schemas.🤖 Generated with Claude Code