Skip to content

Build(deps): bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth - #14627

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/samples/demos/mcp_with_oauth/mcp-1.30.0
Closed

Build(deps): bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth#14627
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/samples/demos/mcp_with_oauth/mcp-1.30.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps mcp from 1.28.1 to 1.30.0.

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
  • c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
  • Additional commits viewable in compare view

Copilot AI balanced review requested due to automatic review settings October 19, 2026 14:02
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Oct 19, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 19, 2026 14:02 Inactive
@dependabot
dependabot Bot requested a review from a team as a code owner October 19, 2026 14:02
Copilot AI reviewed Oct 19, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@dependabot
dependabot Bot temporarily deployed to github-app-auth October 19, 2026 14:03 Inactive
@semantic-kernel-automation semantic-kernel-automation Bot added the python Pull requests for the Python Semantic Kernel label Oct 19, 2026
@github-actions github-actions Bot changed the title Bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth Python: Bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth Oct 19, 2026
eavanvalkenburg
Eduard van Valkenburg (eavanvalkenburg) previously approved these changes Oct 26, 2026
View reviewed changes

@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency-only lockfile update; checks are green.

@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Oct 26, 2026
eavanvalkenburg
Eduard van Valkenburg (eavanvalkenburg) approved these changes Oct 26, 2026
View reviewed changes

@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency-only lockfile update rebased onto current main; checks are green.

@eavanvalkenburg

Eduard van Valkenburg (eavanvalkenburg) commented Oct 26, 2026

Copy link
Copy Markdown
Member

Dependabot (@dependabot) recreate

2 similar comments
@eavanvalkenburg

Eduard van Valkenburg (eavanvalkenburg) commented Oct 26, 2026

Copy link
Copy Markdown
Member

Dependabot (@dependabot) recreate

@eavanvalkenburg

Eduard van Valkenburg (eavanvalkenburg) commented Oct 26, 2026

Copy link
Copy Markdown
Member

Dependabot (@dependabot) recreate

@dependabot dependabot Bot changed the title Python: Bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth Bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth Oct 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python/samples/demos/mcp_with_oauth/mcp-1.30.0 branch from 21dd30d to 2c34172 Compare October 26, 2026 12:13
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 26, 2026 12:13 Inactive
eavanvalkenburg
Eduard van Valkenburg (eavanvalkenburg) approved these changes Oct 26, 2026
View reviewed changes

@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency-only lockfile update recreated on current main; checks are green.

@dependabot
Build(deps): bump mcp in /python/samples/demos/mcp_with_oauth
150ecb7 
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.28.1 to 1.30.0.
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v1.30.0)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth Build(deps): bump mcp from 1.28.1 to 1.30.0 in /python/samples/demos/mcp_with_oauth Nov 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python/samples/demos/mcp_with_oauth/mcp-1.30.0 branch from 2c34172 to 150ecb7 Compare November 4, 2026 14:41
@dependabot
dependabot Bot temporarily deployed to github-app-auth November 4, 2026 14:41 Inactive
Merged
1 of 4 tasks
@eavanvalkenburg

Eduard van Valkenburg (eavanvalkenburg) commented Nov 4, 2026

Copy link
Copy Markdown
Member

Consolidated into #14720 for the Python 1.47.0 release, including the dependency changes and regenerated lockfiles. The release branch includes the merged Python 3.10 removal from #14708. Closing this PR as superseded; the combined changes remain under review in #14720.

auto-merge was automatically disabled November 4, 2026 14:47

Pull request was closed

westey (westey-m) pushed a commit to westey-m/semantic-kernel-1 that referenced this pull request Nov 5, 2026
@eavanvalkenburg
Python: Prepare 1.47.0 release and consolidate dependency updates (mi…
d08a482 
…crosoft#14720)

### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

Prepare the Semantic Kernel Python package for the `1.47.0` release and
consolidate all six open Python package Dependabot updates into one
validated change.

The prerequisite microsoft#14708 has merged and is included in this branch.
Python 3.10 support is removed; the package now requires Python 3.11+
and advertises support through Python 3.14. This compatibility change is
the reason for the minor release.

Other Python changes already merged since `python-1.46.0` include fixes
for MCP initialization and prompt arguments, Redis vector search, Google
AI embeddings and token usage, Mistral settings and finish reasons, SQL
Server handling, OpenAPI URL matching, schema generation, chat history
and tool results, Handlebars helpers, and empty in-memory searches.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

- Update `semantic_kernel.__version__` from `1.46.0` to `1.47.0`.
- Allow `flit-core >=3.9,<5.0`; verified the build with Flit Core 4.2.0.
Supersedes microsoft#14596.
- Expand the boto3 upper bound to `<1.44.0` and lock boto3/botocore
1.43.123 with s3transfer 0.19.3. Supersedes microsoft#14597.
- Expand the google-genai upper bound to `<2.30`. The combined Google
extra still resolves google-genai 1.75.0 because google-cloud-aiplatform
requires `<2.0.0`. Supersedes microsoft#14598.
- Expand the Redis upper bound to `<9`; lock Redis 8.1.0 and compatible
redisvl 0.30.0. Supersedes microsoft#14599.
- Pin ONNX Runtime GenAI to 0.18.0 and lock its required ONNX Runtime
1.31.1. No Python 3.10 compatibility pins remain. Supersedes microsoft#14600.
- Update the MCP OAuth sample lockfile from MCP 1.28.1 to 1.30.0.
Supersedes microsoft#14627.
- Regenerate both affected lockfiles. Preserve exact original lock
entries, including registry URLs and artifact metadata, for every
unchanged SDK dependency. New package versions use PyPI because the
existing proxy returned a metadata 404 for the new ONNX GenAI wheel.

Validation:

- `uv build --project python --no-sources` — passed; built the `1.47.0`
wheel and source distribution. The build selected Flit Core 4.2.0. uv
reports the existing prerelease-mode deprecation warning.
- `cd python && uv run --no-sync pytest tests/unit/connectors/ai/bedrock
tests/unit/connectors/ai/google/google_ai tests/unit/connectors/ai/onnx
tests/unit/connectors/memory/test_redis_store.py
tests/unit/connectors/mcp --disable-warnings -q` — passed on Python
3.14.0rc3 with boto3 1.43.123, Redis 8.1.0, redisvl 0.30.0, ONNX Runtime
GenAI 0.18.0, and ONNX Runtime 1.31.1 installed.
- `python/.venv/bin/pre-commit run --files python/pyproject.toml
python/semantic_kernel/__init__.py python/uv.lock
python/samples/demos/mcp_with_oauth/uv.lock --config
python/.pre-commit-config.yaml` — passed for all applicable hooks.
- `uvx --from uv==0.5.30 uv lock --project python --check` — passed,
using the SDK's pre-commit resolver version.
- `uv lock --project python/samples/demos/mcp_with_oauth --check` —
passed.
- `git diff --check` — passed.
- Parsed wheel `METADATA` and source `PKG-INFO` — passed: version
`1.47.0`, `Requires-Python: >=3.11`, and all requested runtime
dependency bounds are present.
- Asserted that all unchanged SDK dependencies retain their exact
original lock entries and that both affected lockfiles contain the
requested updates — passed.

The full unit-test suite and live-service integration tests were not run
locally. This PR remains a draft pending release review and CI; it does
not publish a release.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

This branch was previously deployed

2 inactive (1 outdated) deployments
github-app-auth — 150ecb7f Deployed Nov 4, 2026 by dependabot[bot] via add_label #29589
integration — 21dd30d5 Deployed Oct 26, 2026 by eavanvalkenburg via Python Pre-Merge Integration Tests - Multi-Modality (3.11, ubuntu-latest) #31099
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) eavanvalkenburg approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code python Pull requests for the Python Semantic Kernel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eavanvalkenburg