[dependabot]

Bumps the uv group with 2 updates in the / directory: mcp and pyjwt.

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

• streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's client does) are not affected.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

• Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
• Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
• Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
• session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

• [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in modelcontextprotocol/python-sdk#3396
• [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in modelcontextprotocol/python-sdk#3426
• [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in modelcontextprotocol/python-sdk#3431
• [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in modelcontextprotocol/python-sdk#3448
• [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

• [v1.x] Complete the FastMCP Settings model at import time by @​maxisbey in modelcontextprotocol/python-sdk#3352
• [v1.x] Apply the request body limit to the SSE and OAuth endpoints by @​maxisbey in modelcontextprotocol/python-sdk#3344

... (truncated)

Commits

• 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
• 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
• 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
• 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
• 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
• b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
• 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
• ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
• 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
• c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

Security

- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.
Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed



JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
PyJWKClient.fetch_data() now raises
PyJWKClientError("The JWKS endpoint did not return a JSON object") when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
</tr></table> 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.