Skip to content

Conversation

@RinZ27
Copy link

@RinZ27 RinZ27 commented Jan 17, 2026

I've updated the dev dependency group to reference the project's own cli and ws extras. This ensures that the test environment is complete for local development without duplicating package entries.

Also, I've reverted the starlette version bump based on the feedback that the constraint change wasn't necessary in this context.

Let me know if this revised approach looks good to you.

@RinZ27 RinZ27 force-pushed the fix/bump-starlette branch 2 times, most recently from d48df76 to 0863e2d Compare January 18, 2026 13:04
pyproject.toml Outdated
"dirty-equals>=0.9.0",
"coverage[toml]>=7.13.1",
"pillow>=12.0",
"typer>=0.16.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is typer here?

@Kludex
Copy link
Member

Kludex commented Jan 18, 2026

Dropping the constraints is not necessary. This is not a vulnerability here.

This ensures that the dev environment has all necessary optional dependencies for running tests locally without duplication. Reverted the starlette version bump as it was deemed unnecessary for this project's context.
@RinZ27 RinZ27 force-pushed the fix/bump-starlette branch from 0863e2d to b66941b Compare January 18, 2026 14:49
@RinZ27 RinZ27 changed the title [Security] Bump starlette to >=0.40.0 to fix CVE-2024-47874 chore: include cli and ws extras in dev environment Jan 18, 2026
@RinZ27
Copy link
Author

RinZ27 commented Jan 18, 2026

I've updated the PR to address your feedback.

Specifically, I've replaced the manual typer and websockets entries with a reference to the project's own extras (mcp[cli,ws]) in the dev group. This ensures the test environment is complete while keeping everything in sync.

I've also reverted the starlette version change as it wasn't necessary for this project's context. Let me know if you think this revised version is worth merging.

Comment on lines +58 to +70
"pyright>=1.1.400",
"pytest>=8.3.4",
"ruff>=0.8.5",
"trio>=0.26.2",
"pytest-flakefinder>=1.1.0",
"pytest-xdist>=3.6.1",
"pytest-examples>=0.0.14",
"pytest-pretty>=1.2.0",
"inline-snapshot>=0.23.0",
"dirty-equals>=0.9.0",
"coverage[toml]>=7.13.1",
"pillow>=12.0",
"mcp[cli,ws]",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you move it to the first, and add a note, please?

Something like # We add mcp[cli,ws] so uv sync considers the extras..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants