Merge remote-tracking branch 'upstream/main' into HEAD

# Conflicts:
#	tests/server/mcpserver/test_server.py

Author: he-yufeng

.claude/skills/test-quality/SKILL.md

@@ -107,7 +107,7 @@ where one exists; a rule with no stated why is a convention — follow it anyway
   silently become load-bearing.
 - Comments live next to the line they explain, not in docstrings; single backticks for code
   refs; match the surrounding comment density (one-liners next to one-liners). No
-  `from __future__ import annotations` (py310+ repo).
+  `from __future__ import annotations` (py311+ repo).
 - Test work doesn't change `src/` as a side effect — the one mechanical exception is deleting a
   pragma a new test now covers. If a test can't be written without a library change, raise it
   as a finding or defer the test; don't quietly edit `src/`.

.github/workflows/conformance.yml

@@ -44,7 +44,7 @@ jobs:
       - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
@@ -90,7 +90,7 @@ jobs:
       - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24

.github/workflows/deploy-docs.yml

@@ -55,7 +55,7 @@ jobs:
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
 
       - name: Build combined docs (main at / and /v2/, v1.x at /v1/)
         run: bash scripts/build-docs.sh site

.github/workflows/docs-preview.yml

@@ -99,7 +99,7 @@ jobs:
           # defence in depth (and avoids a refused save in the post step).
           # Mirrors publish-pypi.yml.
           enable-cache: false
-          version: 0.9.5
+          version: 0.12.24
 
       # Both triggers run this workflow file from the default branch (whatever
       # the PR targets), so the whole recipe — dependency sync included — must

.github/workflows/publish-pypi.yml

@@ -21,7 +21,7 @@ jobs:
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: false
-          version: 0.12.5
+          version: 0.12.24
 
       - name: Set up Python 3.12
         run: uv python install 3.12

.github/workflows/shared.yml

@@ -21,10 +21,10 @@ jobs:
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
 
       - name: Install dependencies
-        run: uv sync --frozen --all-extras --python 3.10
+        run: uv sync --frozen --all-extras --python 3.11
 
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         with:
@@ -36,6 +36,9 @@ jobs:
       - name: Workflow script tests
         run: node --test '.github/scripts/*.test.js'
 
+      - name: MCP Apps UI script tests
+        run: node --test tests/docs_src/test_apps.test.js
+
       - name: Surface types match vendored schema
         run: |
           uv sync --group codegen --frozen
@@ -55,7 +58,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
         dep-resolution:
           - name: lowest-direct
             install-flags: "--upgrade --resolution lowest-direct"
@@ -72,7 +75,7 @@ jobs:
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
 
       - name: Install the project
         run: uv sync ${{ matrix.dep-resolution.install-flags }} --all-extras --python ${{ matrix.python-version }}
@@ -107,10 +110,10 @@ jobs:
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
 
       - name: Install dependencies
-        run: uv sync --frozen --all-extras --python 3.10
+        run: uv sync --frozen --all-extras --python 3.11
 
       - name: Check README snippets are up to date
         run: uv run --frozen scripts/update_readme_snippets.py --check
@@ -136,7 +139,7 @@ jobs:
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-          version: 0.9.5
+          version: 0.12.24
 
       - name: Build the docs in strict mode
         run: bash scripts/docs/build.sh

AGENTS.md

@@ -34,8 +34,8 @@ assigned to their author are closed automatically.
   the example packages still take plain `uv add`.
 - Running tools: `uv run --frozen <tool>`. Always pass `--frozen` so uv doesn't
   rewrite `uv.lock` as a side effect.
-- Cross-version testing: `uv run --frozen --python 3.10 pytest ...` to run
-  against a specific interpreter (CI covers 3.10–3.14).
+- Cross-version testing: `uv run --frozen --python 3.11 pytest ...` to run
+  against a specific interpreter (CI covers 3.11–3.15).
 - Upgrading: `uv lock --upgrade-package <package>`
 - FORBIDDEN: `uv pip install`, `@latest` syntax
 - Don't raise dependency floors for CVEs alone. The `>=` constraint already
@@ -100,7 +100,7 @@ assigned to their author are closed automatically.
 CI requires 100% (`fail_under = 100`, `branch = true`).
 
 - Full check: `./scripts/test` (~23s). Runs coverage + `strict-no-cover` on the
-  default Python. Not identical to CI: CI runs 3.10–3.14 × {ubuntu, windows}
+  default Python. Not identical to CI: CI runs 3.11–3.15 × {ubuntu, windows}
   × {locked, lowest-direct}, and some branch-coverage quirks only surface on
   specific matrix entries.
 - Targeted check while iterating (~4s, deterministic):

CONTRIBUTING.md

@@ -78,7 +78,7 @@ Security reports do not belong in the issue tracker; [SECURITY.md](SECURITY.md)
 
 ## Development Setup
 
-1. Make sure you have Python 3.10+ installed
+1. Make sure you have Python 3.11+ installed
 2. Install [uv](https://docs.astral.sh/uv/getting-started/installation/)
 3. Fork the repository
 4. Clone your fork: `git clone https://github.com/YOUR-USERNAME/python-sdk.git`

README.md

@@ -29,7 +29,7 @@ The [Model Context Protocol](https://modelcontextprotocol.io) lets you build ser
 
 ## Requirements
 
-Python 3.10+.
+Python 3.11+.
 
 ## Installation
 

docs/advanced/apps.md

@@ -20,7 +20,7 @@ then come back.
 
 ## A clock with a face
 
-```python title="server.py" hl_lines="17 20 28 30"
+```python title="server.py" hl_lines="36 39 47 49"
 --8<-- "docs_src/apps/tutorial001.py"
 ```
 
@@ -51,7 +51,7 @@ The model reads `content`; the iframe is for humans. A UI-capable host still fee
 the text result to the model, and a text-only client gets *only* that. So the
 canonical pattern is one tool, two answers. Look at `get_time` again:
 
-```python title="server.py" hl_lines="21-25"
+```python title="server.py" hl_lines="40-44"
 --8<-- "docs_src/apps/tutorial001.py"
 ```