Skip to content

fix(deps): bump mcp to 1.30.0 and remediate FOSSA CVEs in samples and testcases #249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robert-ursu merged 4 commits into from
Sep 15, 2026
Merged

fix(deps): bump mcp to 1.30.0 and remediate FOSSA CVEs in samples and testcases #249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f378fc1
fix(deps): bump mcp to 1.30.0 and remediate FOSSA CVEs in samples and…
robert-ursu Sep 15, 2026
a6837fe
fix(deps): require the patched uipath 2.14.16
robert-ursu Sep 15, 2026
7afd490
ci: exempt uipath packages from the safe-chain minimum package age check
robert-ursu Sep 15, 2026
66e2729
fix(samples): port the agent samples to the SDK MCP helpers on mcp 2.0
robert-ursu Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
paths:
- pyproject.toml

env:
SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: uipath,uipath-core,uipath-dev,uipath-langchain,uipath-mcp,uipath-platform,uipath-runtime

jobs:
lint:
uses: ./.github/workflows/lint.yml
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/integration_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ permissions:
pull-requests: write
actions: read

env:
SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: uipath,uipath-core,uipath-dev,uipath-langchain,uipath-mcp,uipath-platform,uipath-runtime

jobs:
discover-testcases:
runs-on: uipath-ubuntu-latest
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Lint
on:
workflow_call

env:
SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: uipath,uipath-core,uipath-dev,uipath-langchain,uipath-mcp,uipath-platform,uipath-runtime

jobs:
lint:
name: Lint
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/publish-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
pull_request:
types: [opened, synchronize, reopened, labeled]

env:
SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: uipath,uipath-core,uipath-dev,uipath-langchain,uipath-mcp,uipath-platform,uipath-runtime

jobs:
publish-dev:
runs-on: uipath-ubuntu-latest
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
SONAR_TOKEN:
required: false

env:
SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: uipath,uipath-core,uipath-dev,uipath-langchain,uipath-mcp,uipath-platform,uipath-runtime

jobs:
test:
name: Test
Expand Down
8 changes: 4 additions & 4 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
[project]
name = "uipath-mcp"
version = "0.3.0"
version = "0.3.1"

@radugheo radugheo Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The five server samples still lock vulnerable mcp, 1.9.0 in mcp-longrunning-server and 1.11.0 in the other four. Their uipath-mcp>=0.0.101 floors already permit 0.3.1, so a re-lock once it publishes is all that is needed.

@robert-ursu robert-ursu Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, that is the plan. The five server-sample locks are left untouched here and will be re-locked once 0.3.1 is on PyPI, since their mcp comes transitively from the published uipath-mcp.

description = "UiPath MCP SDK"
readme = { file = "README.md", content-type = "text/markdown" }
requires-python = ">=3.11"
dependencies = [
"mcp==1.26.0",
"mcp==1.30.0",
"pysignalr==1.3.0",
"uipath>=2.10.40, <2.14.0",
"uipath-runtime>=0.10.0, <0.13.0",
"uipath>=2.14.16, <2.15.0",
"uipath-runtime>=0.13.1, <0.14.0",
]
classifiers = [
"Development Status :: 3 - Alpha",
Expand Down
Loading
Loading