From df1402b06a3857b8ab9a10f164c470604f7a936b Mon Sep 17 00:00:00 2001 From: Andrey Fedorov Date: Fri, 31 Jul 2026 15:03:59 -0400 Subject: [PATCH] ci(dependabot): ignore major-version bumps of mcp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `mcp>=1.28.1,<2` cap does not keep SDK 2.0 out on its own. Dependabot maintains the constraint rather than obeying it: the very next run proposed `mcp>=2.0.0,<3`, and CI failed again on `ModuleNotFoundError: No module named 'mcp.server.fastmcp'`. An ignore condition is the only thing that holds the line. It is evaluated before grouping, so the weekly `python` group still ships every other bump — it just stops carrying mcp 2.x. Drop this entry when the SDK 2.0 migration lands; the pyproject comment points here so the two can't drift apart. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 10 +++++++++- pyproject.toml | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6fdee67..2ba6196 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,4 +15,12 @@ updates: groups: python: patterns: - - "*" \ No newline at end of file + - "*" + ignore: + # The `mcp<2` cap in pyproject.toml does not hold on its own: dependabot rewrites the + # constraint it finds (it proposed `mcp>=2.0.0,<3`) rather than staying inside it. Only + # an ignore condition keeps 2.x out of the weekly group. SDK 2.0 removes + # `mcp.server.fastmcp` entirely, so the adapter does not import under it — the port is a + # deliberate PR, not a dependency bump. Drop this entry when that migration lands. + - dependency-name: "mcp" + update-types: ["version-update:semver-major"] \ No newline at end of file diff --git a/pyproject.toml b/pyproject.toml index 11b1175..4de5be4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -23,6 +23,8 @@ dependencies = [ # Capped below 2.0: that release removes `mcp.server.fastmcp` entirely (FastMCP -> # MCPServer) and moves transport config off the constructor, so the adapter does not # import under it. Migration is a deliberate PR, not a dependency bump. + # The cap alone does not hold the line — dependabot rewrites it. The matching ignore + # condition in .github/dependabot.yml is what actually keeps 2.x out; change both together. "mcp>=1.28.1,<2", ]