From 9b455a924c50260833b1547c8fabb0ea7dd556fa Mon Sep 17 00:00:00 2001 From: Robert Ursu Date: Wed, 21 Oct 2026 15:34:14 +0300 Subject: [PATCH 1/4] fix(deps): bump mcp to 2.3.0 mcp 2.0.0 carries CVE-2026-59951, fixed in 2.2.0. The exact pin keeps downstream installs from moving past it. Co-Authored-By: Claude Opus 5.5 --- pyproject.toml | 4 ++-- uv.lock | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 94ed95e0f..ee02e312e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "uipath-langchain" -version = "0.18.49" +version = "0.18.50" description = "Python SDK that enables developers to build and deploy LangGraph agents to the UiPath Cloud Platform" readme = { file = "README.md", content-type = "text/markdown" } requires-python = ">=3.11" @@ -24,7 +24,7 @@ dependencies = [ "jsonschema-pydantic-converter>=0.4.1", "jsonschema>=4.23.0", "jsonpath-ng>=1.7.0", - "mcp==2.0.0", + "mcp==2.3.0", "pillow>=12.3.0, <13.0.0", "rdflib>=7.0.0, <8.0.0", "a2a-sdk>=1.1.2,<2.0.0", diff --git a/uv.lock b/uv.lock index cca316b6f..ebc431d8a 100644 --- a/uv.lock +++ b/uv.lock @@ -2569,7 +2569,7 @@ wheels = [ [[package]] name = "mcp" -version = "2.0.0" +version = "2.3.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyio" }, @@ -2587,22 +2587,22 @@ dependencies = [ { name = "typing-inspection" }, { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/74/33/32d4dff2c95bb5d897c3ef4c83649a08996b17b58f0a326d2495d4c81179/mcp-2.0.0.tar.gz", hash = "sha256:0f440e735c13ece8bb19bc62cf0b86f4313448432fbb77d35e14034f4e050728", size = 1662284, upload-time = "2026-07-28T13:45:32.346Z" } +sdist = { url = "https://files.pythonhosted.org/packages/9d/8d/e0d339616f4810e9051d4aba6887afab289ab1f81875fe908b606cdfd0e3/mcp-2.3.0.tar.gz", hash = "sha256:8b147a50441cf059dc88c684e0aeed3687f0aa0f39c6cde7b90330effd2b34d8", size = 4171955, upload-time = "2026-10-02T22:06:56.091Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/67/72/7d7897418912c1d12e87556630dfb7bf0eac71160e9bef8b447960804ee3/mcp-2.0.0-py3-none-any.whl", hash = "sha256:1cb4c75d2d2c7b8c1d756355e5d82a39f2822cc7f13e22a2051d7ca3592349d6", size = 349980, upload-time = "2026-07-28T13:45:28.853Z" }, + { url = "https://files.pythonhosted.org/packages/20/d7/4a2878f128df729db3ca04e71bfce26405cc2e0c9ebe19c592feeb4c61b9/mcp-2.3.0-py3-none-any.whl", hash = "sha256:dd0c44c089d16453e8ae31a3877a0054d7a2314caaa81f5e0541b9b1734b2377", size = 368664, upload-time = "2026-10-02T22:06:52.119Z" }, ] [[package]] name = "mcp-types" -version = "2.0.0" +version = "2.3.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pydantic" }, { name = "typing-extensions" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/bb/56/9b8e1c152f61f6c6b07c4b5896c88c7d0ae90bac6ee6306f852fcc5c1eb0/mcp_types-2.0.0.tar.gz", hash = "sha256:d7d939b9285c9961ae8866ba75ef85da34d12bafe276efbf4eb6a131786d8379", size = 66632, upload-time = "2026-07-28T13:45:33.804Z" } +sdist = { url = "https://files.pythonhosted.org/packages/9e/2d/7c251e34207f6c51000312fc8839111ac45cfe02023f90b44e7f1051dd8e/mcp_types-2.3.0.tar.gz", hash = "sha256:d1e46549edb35ee19a94940fcee6d1addd7e589ab7ea92dda83f5d84781fc362", size = 65898, upload-time = "2026-10-02T22:06:57.863Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f5/4c/c78d78c3d52b0ac594ad7cc8ef5972adfe070e3597a8a4c6ce0cd39196ea/mcp_types-2.0.0-py3-none-any.whl", hash = "sha256:6b2de797ca2797f568b79529e1b25948e34de511bcc0bd82fef1039a6d1b8eb0", size = 69649, upload-time = "2026-07-28T13:45:30.713Z" }, + { url = "https://files.pythonhosted.org/packages/ce/48/32583066b155bb5d4507e7887dc88ee23118cc4de8e2a12870c49719e2a8/mcp_types-2.3.0-py3-none-any.whl", hash = "sha256:968efdbdaedfab06adae40d378a34395f1090c5921d4be3c9cde283aaf76d91d", size = 69108, upload-time = "2026-10-02T22:06:54.099Z" }, ] [[package]] @@ -4860,7 +4860,7 @@ wheels = [ [[package]] name = "uipath-langchain" -version = "0.18.49" +version = "0.18.50" source = { editable = "." } dependencies = [ { name = "a2a-sdk" }, @@ -4953,7 +4953,7 @@ requires-dist = [ { name = "langchain-quickjs", marker = "extra == 'code-interpreter'", specifier = ">=0.3.5,<0.4.0" }, { name = "langgraph", specifier = ">=1.2.11,<2.0.0" }, { name = "langgraph-checkpoint-sqlite", specifier = ">=3.1.1,<4.0.0" }, - { name = "mcp", specifier = "==2.0.0" }, + { name = "mcp", specifier = "==2.3.0" }, { name = "openinference-instrumentation-langchain", specifier = ">=0.1.69,<0.2.0" }, { name = "pillow", specifier = ">=12.3.0,<13.0.0" }, { name = "pydantic-settings", specifier = ">=2.6.0" }, From d2bb7f77f49791e9dd7d169859f630d48c6fea11 Mon Sep 17 00:00:00 2001 From: Robert Ursu Date: Wed, 21 Oct 2026 16:07:32 +0300 Subject: [PATCH 2/4] fix(deps): allow pillow 13 pillow 12.3.0 carries CVE-2026-112403 (critical) and six high CVEs in its JPEG, GIF, TIFF and PDF code, all fixed in 13.0.0. The <13 cap kept downstream installs on 12.x. The lock stays on 12.3.0 because deepagents[video] still caps pillow below 13. Co-Authored-By: Claude Opus 5.5 --- pyproject.toml | 2 +- uv.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index ee02e312e..cbbbddb99 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -25,7 +25,7 @@ dependencies = [ "jsonschema>=4.23.0", "jsonpath-ng>=1.7.0", "mcp==2.3.0", - "pillow>=12.3.0, <13.0.0", + "pillow>=12.3.0, <14.0.0", "rdflib>=7.0.0, <8.0.0", "a2a-sdk>=1.1.2,<2.0.0", "uipath-langchain-client[openai]>=1.22.0, <1.23.0", diff --git a/uv.lock b/uv.lock index ebc431d8a..e0a41b26c 100644 --- a/uv.lock +++ b/uv.lock @@ -4955,7 +4955,7 @@ requires-dist = [ { name = "langgraph-checkpoint-sqlite", specifier = ">=3.1.1,<4.0.0" }, { name = "mcp", specifier = "==2.3.0" }, { name = "openinference-instrumentation-langchain", specifier = ">=0.1.69,<0.2.0" }, - { name = "pillow", specifier = ">=12.3.0,<13.0.0" }, + { name = "pillow", specifier = ">=12.3.0,<14.0.0" }, { name = "pydantic-settings", specifier = ">=2.6.0" }, { name = "python-dotenv", specifier = ">=1.2.2,<2.0.0" }, { name = "rdflib", specifier = ">=7.0.0,<8.0.0" }, From bc4ea662c92ea23a13461f743cb8f69c40ba7bef Mon Sep 17 00:00:00 2001 From: Robert Ursu Date: Thu, 22 Oct 2026 16:13:24 +0300 Subject: [PATCH 3/4] fix(deps): move the MCP samples to mcp 2.3.0 and litellm to 1.89.7 The MCP samples and test cases pin mcp themselves, so they have to follow the library's pin. litellm 1.89.3 has GHSA-3cv6-jpf6-8222, fixed in 1.89.7 on the same minor line, and CI's package proxy now refuses to download 1.89.3. Co-Authored-By: Claude Opus 5.5 --- samples/oauth-external-apps-agent/pyproject.toml | 2 +- samples/simple-local-mcp/pyproject.toml | 2 +- samples/simple-remote-mcp/pyproject.toml | 2 +- testcases/simple-http-mcp/pyproject.toml | 2 +- testcases/simple-local-mcp/pyproject.toml | 2 +- uv.lock | 6 +++--- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/samples/oauth-external-apps-agent/pyproject.toml b/samples/oauth-external-apps-agent/pyproject.toml index 557f509e6..ab65ec9c0 100644 --- a/samples/oauth-external-apps-agent/pyproject.toml +++ b/samples/oauth-external-apps-agent/pyproject.toml @@ -10,7 +10,7 @@ dependencies = [ "python-dotenv>=1.2.2", "anthropic>=0.57.1", "httpx2>=2.12.0, <3.0.0", - "mcp==2.0.0", + "mcp==2.3.0", "mypy>=1.17.1", "uipath>=2.14.41", "uipath-langchain>=0.18.46", diff --git a/samples/simple-local-mcp/pyproject.toml b/samples/simple-local-mcp/pyproject.toml index dbf0849f1..612af1e40 100644 --- a/samples/simple-local-mcp/pyproject.toml +++ b/samples/simple-local-mcp/pyproject.toml @@ -5,7 +5,7 @@ description = "Math and Weather Local MCP Server Agent" authors = [{ name = "John Doe", email = "john.doe@myemail.com" }] dependencies = [ "langchain-anthropic>=1.4.6", - "mcp==2.0.0", + "mcp==2.3.0", "uipath>=2.14.41", "uipath-langchain>=0.18.46", ] diff --git a/samples/simple-remote-mcp/pyproject.toml b/samples/simple-remote-mcp/pyproject.toml index 2dafd9158..4306c56c0 100644 --- a/samples/simple-remote-mcp/pyproject.toml +++ b/samples/simple-remote-mcp/pyproject.toml @@ -10,7 +10,7 @@ dependencies = [ "python-dotenv>=1.2.2", "anthropic>=0.57.1", "httpx2>=2.12.0, <3.0.0", - "mcp==2.0.0", + "mcp==2.3.0", "uipath>=2.14.41", "uipath-langchain>=0.18.46", ] diff --git a/testcases/simple-http-mcp/pyproject.toml b/testcases/simple-http-mcp/pyproject.toml index 88006b432..a6168ba26 100644 --- a/testcases/simple-http-mcp/pyproject.toml +++ b/testcases/simple-http-mcp/pyproject.toml @@ -11,7 +11,7 @@ dependencies = [ "uipath-langchain", "pydantic>=2.10.6", "typing-extensions>=4.12.2", - "mcp==2.0.0", + "mcp==2.3.0", "starlette>=1.3.1", "uvicorn>=0.30.0", ] diff --git a/testcases/simple-local-mcp/pyproject.toml b/testcases/simple-local-mcp/pyproject.toml index 50b0c7198..bf73630da 100644 --- a/testcases/simple-local-mcp/pyproject.toml +++ b/testcases/simple-local-mcp/pyproject.toml @@ -14,7 +14,7 @@ dependencies = [ "aiohttp>=3.14.3", "typing-extensions>=4.12.2", "ipython>=8.32.0", - "mcp==2.0.0", + "mcp==2.3.0", ] requires-python = ">=3.11" diff --git a/uv.lock b/uv.lock index e0a41b26c..f84fa4ab2 100644 --- a/uv.lock +++ b/uv.lock @@ -2460,7 +2460,7 @@ wheels = [ [[package]] name = "litellm" -version = "1.89.3" +version = "1.89.7" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "aiohttp" }, @@ -2476,9 +2476,9 @@ dependencies = [ { name = "tiktoken" }, { name = "tokenizers" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/56/f1/f7cfead063f2ab1877c8fb465d0d7fe300b75f081bcb73525f6d550aeb1c/litellm-1.89.3.tar.gz", hash = "sha256:8fcdb2b7a0ef3381d41adf164443842e31ef9f0cd5bcda6fc3c0bd8bc2959510", size = 14080611, upload-time = "2026-06-20T22:42:26.997Z" } +sdist = { url = "https://files.pythonhosted.org/packages/07/d5/30d14b55c30b83196f03715648c995c9fe4c19e8d3bdbfa5319335c56c76/litellm-1.89.7.tar.gz", hash = "sha256:94ed81946194a032eadddf0ab9d75ad8bdcd94e7fa832dd8edb48a8712eb5b9d", size = 14063688, upload-time = "2026-08-09T00:50:04.636Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/d1/f1/34d174ff1d84e459b30f971606ac9cb7078ad24cd7661e9786b25adf7def/litellm-1.89.3-py3-none-any.whl", hash = "sha256:414ef5aee504b2b3eb1b219d39f1c11902db399cbdbc06e5fb550c15d731abeb", size = 15495226, upload-time = "2026-06-20T22:42:23.156Z" }, + { url = "https://files.pythonhosted.org/packages/f6/1a/f087e0555d91ab5f93fb8c740447423aa785468b8edca9987724815b51ec/litellm-1.89.7-py3-none-any.whl", hash = "sha256:4a11bdeaec66b3bd64f7606bf59e238875867678f320e70dd38d8767fddde11b", size = 15474149, upload-time = "2026-08-09T00:50:01.992Z" }, ] [[package]] From 2cf7e1e94d0be4777570c9438ea524a5a36b6d7f Mon Sep 17 00:00:00 2001 From: Robert Ursu Date: Thu, 22 Oct 2026 16:15:05 +0300 Subject: [PATCH 4/4] fix(samples): require uipath-langchain 0.18.50 in the MCP samples Their mcp pin moved to 2.3.0, which only uipath-langchain 0.18.50 and later allow, so a lower floor would resolve to an unsatisfiable set. Co-Authored-By: Claude Opus 5.5 --- samples/oauth-external-apps-agent/pyproject.toml | 2 +- samples/simple-local-mcp/pyproject.toml | 2 +- samples/simple-remote-mcp/pyproject.toml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samples/oauth-external-apps-agent/pyproject.toml b/samples/oauth-external-apps-agent/pyproject.toml index ab65ec9c0..2537da842 100644 --- a/samples/oauth-external-apps-agent/pyproject.toml +++ b/samples/oauth-external-apps-agent/pyproject.toml @@ -13,7 +13,7 @@ dependencies = [ "mcp==2.3.0", "mypy>=1.17.1", "uipath>=2.14.41", - "uipath-langchain>=0.18.46", + "uipath-langchain>=0.18.50", ] requires-python = ">=3.11" diff --git a/samples/simple-local-mcp/pyproject.toml b/samples/simple-local-mcp/pyproject.toml index 612af1e40..cef85dec1 100644 --- a/samples/simple-local-mcp/pyproject.toml +++ b/samples/simple-local-mcp/pyproject.toml @@ -7,7 +7,7 @@ dependencies = [ "langchain-anthropic>=1.4.6", "mcp==2.3.0", "uipath>=2.14.41", - "uipath-langchain>=0.18.46", + "uipath-langchain>=0.18.50", ] requires-python = ">=3.11" diff --git a/samples/simple-remote-mcp/pyproject.toml b/samples/simple-remote-mcp/pyproject.toml index 4306c56c0..db3af70ee 100644 --- a/samples/simple-remote-mcp/pyproject.toml +++ b/samples/simple-remote-mcp/pyproject.toml @@ -12,7 +12,7 @@ dependencies = [ "httpx2>=2.12.0, <3.0.0", "mcp==2.3.0", "uipath>=2.14.41", - "uipath-langchain>=0.18.46", + "uipath-langchain>=0.18.50", ] requires-python = ">=3.11"