Repository navigation
fix: restore the mcp upper bound — without it the alerting is decoration - #10
Merged
Merged
Conversation
0.5.0 shipped `mcp>=2.0.0` with no ceiling, on the stated reasoning that Dependabot would raise the widening PR when mcp 3.0 landed. That reasoning was wrong, and the first run proved it within minutes of #5 merging: the pip job completed successfully and opened zero PRs, while the github-actions job opened three. Dependabot raises a PR when a new release falls *outside* the declared constraint. Against an open `>=` there is nothing to widen, so it stays silent — including on a major that removes the API this server registers with. That is precisely the shape of #2: an unbounded mcp dependency, a breaking major, and no signal until a user filed a bug 25 days later. 0.5.0 swapped an unbounded `>=1.0.0` for an unbounded `>=2.0.0` and kept the defect. The ceiling is back and is not temporary. It does two jobs: users never silently resolve to a major that cannot run this code, and the exclusion is what gives Dependabot something to report. Comments in both files now say so, so the bound does not get "cleaned up" later by someone reading it as leftover caution. Verified against the rebuilt wheel in a clean venv: resolves mcp 2.0.0, 85/85 tools registered, entry point exits 0, selenium-mcp-test 68/68 over real stdio. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#5 and #6 left a hole, and Dependabot demonstrated it within minutes of merging.
0.5.0 shipped
mcp>=2.0.0with no ceiling, on my stated reasoning that Dependabot would open the widening PR when mcp 3.0 landed. That reasoning was wrong.The evidence
The first Dependabot run after #5 merged:
github-actionsdownload-artifact4→8, #8gradle/actions4→6, #9setup-java4→5pipDependabot raises a PR when a new release falls outside the declared constraint. Against an open
>=there is nothing to widen, so it says nothing — and it would say nothing about mcp 3.0.0 either.Why this is #2 again
That is the exact shape of the original outage: an unbounded
mcpdependency, a breaking major, no signal until a stranger filed a bug report 25 days later. 0.5.0 swapped an unbounded>=1.0.0for an unbounded>=2.0.0and carried the defect forward under a new number.The fix
mcp>=2.0.0,<3.0.0. The ceiling does two jobs, and the comments in both files now spell them out so it doesn't get tidied away later as leftover caution:The floor stays load-bearing too — 1.x genuinely cannot run 0.5.0's code.
Verification
Rebuilt wheel, installed into a clean venv (never
src/):mcp 2.0.0under the new constraintselenium-mcp-test: 68/68 over real stdio JSON-RPCNote on the version number
This does not bump the version — 0.5.0 is not on PyPI yet, so the constraint can still be corrected before it ships. This should merge before v0.5.0 is tagged, otherwise the release goes out with the unbounded pin and needs a 0.5.1 to walk it back.