Repository navigation
chore(deps): pyjwt / mcp / urllib3 を修正版へ — 週次の pip-audit の赤を戻す（#781） - #782
Merged
Merged
Conversation
- mcp 1.29.0 → 1.30.0（CVE-2026-59951）。直接の依存なので宣言の下限も >=1.30.0 に上げる（mcp<2 は不変） - pyjwt 2.13.0 → 2.15.1（PYSEC-2026-4140〜4143・mcp 経由の推移的依存） - urllib3 2.7.0 → 2.8.0（PYSEC-2026-4175〜4177） uv lock --upgrade-package で修正版を == 指定して固定した（lock の差分は3パッケージだけ）。 Closes #781 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
何を
mcp>=1.30.0に）pyjwturllib3uv lock --upgrade-package <pkg>==<修正版>で固定した。lock の差分はこの3パッケージだけ（20行）mcp<2の制約はそのまま。1.30.0 は 1.x 系の内側src/はpyjwtを import していない（mcp の内部でだけ使われる）[Unreleased]を足した（宣言の下限が変わるので、前回 1.8.170 と同じ扱い）なぜ
main の週次 CI は 10-05 と 10-12 に赤い（#781）。10-12 時点で落ちていたのは pyjwt だけで、mcp と urllib3 はその後に出た報告。
実測（2026-10-18・ローカル）
uv run pytest: 471 passed, 9 skipped（coverage 92.97%）uv run mypy src/: no issuesuv run ruff check/ruff format --check: 通過uv run pip-audit --ignore-vuln PYSEC-2025-183: No known vulnerabilities found（EXIT=0）Closes #781
🤖 Generated with Claude Code