Skip to content

Conversation

@RinZ27
Copy link

@RinZ27 RinZ27 commented Jan 17, 2026

I've updated the dev dependency group to reference the project's own cli and ws extras. This ensures that the test environment is complete for local development without duplicating package entries.

Also, I've reverted the starlette version bump based on the feedback that the constraint change wasn't necessary in this context.

Let me know if this revised approach looks good to you.

@RinZ27 RinZ27 force-pushed the fix/bump-starlette branch 2 times, most recently from d48df76 to 0863e2d Compare January 18, 2026 13:04
pyproject.toml Outdated
"dirty-equals>=0.9.0",
"coverage[toml]>=7.13.1",
"pillow>=12.0",
"typer>=0.16.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is typer here?

@Kludex
Copy link
Member

Kludex commented Jan 18, 2026

Dropping the constraints is not necessary. This is not a vulnerability here.

@RinZ27 RinZ27 force-pushed the fix/bump-starlette branch from 0863e2d to b66941b Compare January 18, 2026 14:49
@RinZ27 RinZ27 changed the title [Security] Bump starlette to >=0.40.0 to fix CVE-2024-47874 chore: include cli and ws extras in dev environment Jan 18, 2026
@RinZ27
Copy link
Author

RinZ27 commented Jan 18, 2026

I've updated the PR to address your feedback.

Specifically, I've replaced the manual typer and websockets entries with a reference to the project's own extras (mcp[cli,ws]) in the dev group. This ensures the test environment is complete while keeping everything in sync.

I've also reverted the starlette version change as it wasn't necessary for this project's context. Let me know if you think this revised version is worth merging.

pyproject.toml Outdated
Comment on lines 58 to 70
"pyright>=1.1.400",
"pytest>=8.3.4",
"ruff>=0.8.5",
"trio>=0.26.2",
"pytest-flakefinder>=1.1.0",
"pytest-xdist>=3.6.1",
"pytest-examples>=0.0.14",
"pytest-pretty>=1.2.0",
"inline-snapshot>=0.23.0",
"dirty-equals>=0.9.0",
"coverage[toml]>=7.13.1",
"pillow>=12.0",
"mcp[cli,ws]",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you move it to the first, and add a note, please?

Something like # We add mcp[cli,ws] so uv sync considers the extras..

@RinZ27
Copy link
Author

RinZ27 commented Jan 19, 2026

@Kludex I've moved mcp[cli,ws] to the top of the dev group and added the note for uv sync as suggested. Thanks!

@RinZ27 RinZ27 force-pushed the fix/bump-starlette branch from 8ef7b94 to 0379ba0 Compare January 19, 2026 08:38
pyproject.toml Outdated
Comment on lines 60 to 71
"pyright\u003e=1.1.400",
"pytest\u003e=8.3.4",
"ruff\u003e=0.8.5",
"trio\u003e=0.26.2",
"pytest-flakefinder\u003e=1.1.0",
"pytest-xdist\u003e=3.6.1",
"pytest-examples\u003e=0.0.14",
"pytest-pretty\u003e=1.2.0",
"inline-snapshot\u003e=0.23.0",
"dirty-equals\u003e=0.9.0",
"coverage[toml]\u003e=7.13.1",
"pillow\u003e=12.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😅 ...

@RinZ27 RinZ27 force-pushed the fix/bump-starlette branch from 0379ba0 to 1420c68 Compare January 19, 2026 10:25
@RinZ27
Copy link
Author

RinZ27 commented Jan 19, 2026

Just noticed some weird Unicode sequences (\u003e=) crept into pyproject.toml during the last update—looks like my editor had a stroke while I was copy-pasting from a JSON diff. Fixed the characters and forced a clean push. Everything should be readable now!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants