From 591504f69ff754562f44cbe7f95fba959a515f07 Mon Sep 17 00:00:00 2001
From: WSHAPER <42714629+WSHAPER@users.noreply.github.com>
Date: Thu, 22 Oct 2026 11:05:32 +0200
Subject: [PATCH] fix(deps): floor mcp >=1.30.0 and langgraph >=1.0.1 per SBOM
 fleet reports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- mcp: add explicit constraint >=1.30.0,<2.0 (lock 1.29.0 -> 1.30.0); exits
  CVE-2026-59951 range and picks up the 1.29.1 request-body-size limits
- langgraph: make floor explicit (>=1.0.1,<2.0) at the verified resolver
  ceiling; >=1.2.14 requires langchain-core >=1.4.7 which conflicts with
  langchain ^0.3.25 (poetry: version solving failed) — full langgraph
  family bump deferred to the langchain 1.x migration card
- fastmcp held at ^2.14 (no 3.x), authlib held at 1.7.2 (CVE-2026-96760
  watch item, no upstream fix yet)

Signed-off-by: WSHAPER <42714629+WSHAPER@users.noreply.github.com>
Assisted-by: opencode:zai/glm-5.3
---
 poetry.lock    | 8 ++++----
 pyproject.toml | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index b9df2e5..ad82a7b 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -2393,14 +2393,14 @@ tests = ["pytest", "simplejson"]
 
 [[package]]
 name = "mcp"
-version = "1.29.0"
+version = "1.30.0"
 description = "Model Context Protocol SDK"
 optional = false
 python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "mcp-1.29.0-py3-none-any.whl", hash = "sha256:f5a075bb611f23d6f4d080c6a1699fa62772eebc562ba9e66b306ddde1c755f7"},
-    {file = "mcp-1.29.0.tar.gz", hash = "sha256:52d01f334de1868cc3bb2d6604931126a67631f99a6c5d3b82ba47290315ec36"},
+    {file = "mcp-1.30.0-py3-none-any.whl", hash = "sha256:666edb5009503e1047c9d60346a756f94b261f05cc2625f23d41c728ffc484d0"},
+    {file = "mcp-1.30.0.tar.gz", hash = "sha256:445414625fce5c295faa505bb11bacece661ab6f4028d57c935db57820b7a3e4"},
 ]
 
 [package.dependencies]
@@ -5221,4 +5221,4 @@ cffi = ["cffi (>=1.17,<2.0) ; platform_python_implementation != \"PyPy\" and pyt
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.13,<4"
-content-hash = "915189f6a3a36e16644364b4844a2d31143e745be54d3af84157fdfe83be3083"
+content-hash = "ba8aa0f0115c536403e9559258f1d489421b9790b8bceb28914fa0ed57f6f8a2"
diff --git a/pyproject.toml b/pyproject.toml
index afd8b2b..0a40571 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,7 +11,7 @@ package-mode = false
 [tool.poetry.dependencies]
 python = ">=3.13,<4"
 nc-py-api = {version = "^0.30.3", extras = ["calendar"]}
-langgraph = "1.*"
+langgraph = ">=1.0.1,<2.0"
 langchain = "^0.3.25"
 ics = "^0.7.2"
 icalendar = "^7.1.2"
@@ -24,6 +24,7 @@ youtube-search = "^2.1.2"
 uvicorn = "^0.40"
 langchain-mcp-adapters = "^0.1.9"
 fastmcp = "^2.14"
+mcp = ">=1.30.0,<2.0"
 niquests = "^3.17.0"
 ddgs = "^9.13.1"