Skip to content

fix(samples): re-lock the server samples on uipath-mcp 0.3.1 - #250

Merged
robert-ursu merged 1 commit into
mainfrom
fix/cve-remediation-2026-09-b
Sep 15, 2026
Merged

robert-ursu merged 1 commit into
mainfrom
fix/cve-remediation-2026-09-b

Conversation

@robert-ursu

Copy link
Copy Markdown
Contributor

Summary

Follow-up to #249. The five server samples (mcp-dynamic-server, mcp-functions-server, mcp-longrunning-server, mcp-math-server, mcp-sdk-server) take mcp transitively from the published uipath-mcp, so their lockfiles could only move once 0.3.1 was on PyPI. All five now lock mcp 1.30.0, uipath-mcp 0.3.1, uipath 2.14.17 and uipath-runtime 0.13.5.

Two supporting changes:

  • uipath-mcp is added to [tool.uv.exclude-newer-package] alongside the other UiPath packages. The repo filters packages younger than two days, and without the exemption the samples resolve uipath-mcp 0.3.0 (mcp 1.26.0) until the window passes. Every lockfile's options block updates accordingly.
  • mcp-longrunning-server requires Python 3.11 like every other project in the repo. Its >=3.10 floor forked the resolution and kept a second mcp 1.9.0 / uipath-mcp 0.0.92 entry for 3.10.

Verification

  • each server sample synced on Python 3.11 and server.py imported cleanly
  • ruff check passes

🤖 Generated with Claude Code

The five server samples take mcp transitively from the published uipath-mcp,
so they could only move once 0.3.1 shipped. All five now lock mcp 1.30.0.

uipath-mcp joins the repo's exclude-newer exemptions so sample locks can
follow a release inside the two-day window, and mcp-longrunning-server
requires Python 3.11 like every other project here, which removes its
forked 3.10 resolution that kept mcp 1.9.0 alive.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 15, 2026 13:52

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

This PR re-locks server samples against uipath-mcp 0.3.1 and aligns dependency-age and Python-version configuration.

Changes:

  • Updates locks to the latest MCP and UiPath package versions.
  • Exempts uipath-mcp from uv’s package-age filter.
  • Raises the long-running server’s Python requirement to 3.11.
File summaries
File Description
uv.lock Updates lock options and dependency resolution.
samples/mcp-longrunning-server/pyproject.toml Requires Python 3.11.
samples/mcp-functions-agent/uv.lock Updates lock options.
samples/github-slack-agent/uv.lock Updates lock options.
samples/github-helper-agent/uv.lock Updates lock options.
pyproject.toml Adds the uipath-mcp package-age exemption.
Review details
  • Files reviewed: 2/11 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@sonarqubecloud

Copy link
Copy Markdown

@robert-ursu
robert-ursu merged commit 03e573e into main Sep 15, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants