From 90dc2803486c972bb673d6edc9efaf9c7b75f98f Mon Sep 17 00:00:00 2001
From: Ian Duffy <iduffy@cloudsmith.io>
Date: Sun, 9 Aug 2026 05:51:46 +0100
Subject: [PATCH] build(no-ticket): upgrade mcp to 1.28.1

CVE-2026-59950 (high): the deprecated mcp.server.websocket.websocket_server
transport accepted WebSocket handshakes without Host or Origin validation,
leaving no SDK-level way to restrict which origins could connect.

The CLI's MCP server does not use the websocket transport, so it is not
exposed; this bump clears the CodeQL dependency alert that currently fails on
every branch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 pyproject.toml |  2 +-
 uv.lock        | 13 ++++++++-----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index f780aece..c5463bc7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -45,7 +45,7 @@ dependencies = [
     "json5>=0.9.0",  # For parsing JSONC (JSON with comments) in VS Code settings
     "cloudsmith-api>=2.0.29,<3.0",  # Compatible upto (but excluding) 3.0+
     "keyring>=25.4.1",
-    "mcp==1.27.2",
+    "mcp==1.28.1",
     # The crypto extra must be declared here: the OIDC flow verifies JWT
     # signatures, and a bare PyJWT requirement would let the
     # standalone-binary build resolve without the cryptography wheels.
diff --git a/uv.lock b/uv.lock
index fc698672..bdab8960 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2,7 +2,10 @@ version = 1
 revision = 3
 requires-python = ">=3.10.0"
 resolution-markers = [
-    "python_full_version >= '3.12'",
+    "python_full_version >= '3.14' and sys_platform == 'win32'",
+    "python_full_version >= '3.14' and sys_platform != 'win32'",
+    "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform == 'win32'",
+    "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform != 'win32'",
     "python_full_version == '3.11.*'",
     "python_full_version < '3.11'",
 ]
@@ -532,7 +535,7 @@ requires-dist = [
     { name = "cloudsmith-api", specifier = ">=2.0.29,<3.0" },
     { name = "json5", specifier = ">=0.9.0" },
     { name = "keyring", specifier = ">=25.4.1" },
-    { name = "mcp", specifier = "==1.27.2" },
+    { name = "mcp", specifier = "==1.28.1" },
     { name = "pyjwt", extras = ["crypto"], specifier = ">=2.0.0" },
     { name = "python-toon", specifier = "==0.1.2" },
     { name = "requests", specifier = ">=2.18.4" },
@@ -1074,7 +1077,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.27.2"
+version = "1.28.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -1092,9 +1095,9 @@ dependencies = [
     { name = "typing-inspection" },
     { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/27/3c/347cf965d313f5d41764e7d46bea6ffe7d9ef13b983cc429b0340962a082/mcp-1.27.2.tar.gz", hash = "sha256:8e02db104096d1c25b28e64bde29a5c32b31bc241710213e12fd4d84985bdfef", size = 621116, upload-time = "2026-05-29T17:16:04.039Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c9/11/252c6f971dc4f16af1d98a1c469d8ba523aab00d1bb76b4d3bc1ff32eacc/mcp-1.27.2-py3-none-any.whl", hash = "sha256:d6ff5160c6ca65d93013626efb3fc249de683c30b2d8570755ceddd490344de5", size = 220498, upload-time = "2026-05-29T17:16:02.442Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/5e/d118fce19f87a2e7d8101c35c8ae0ec289098a4df0ff244cec23e415aca0/mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df", size = 222620, upload-time = "2026-06-26T12:57:27.218Z" },
 ]
 
 [[package]]