From efdfc822747f5c43c1a9321c48109e897dfd0b22 Mon Sep 17 00:00:00 2001 From: Mohammad Saddam Hossain Date: Sun, 23 Aug 2026 12:07:01 +0530 Subject: [PATCH] =?UTF-8?q?fix:=20restore=20the=20mcp=20upper=20bound=20?= =?UTF-8?q?=E2=80=94=20without=20it=20the=20alerting=20is=20decoration?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 0.5.0 shipped `mcp>=2.0.0` with no ceiling, on the stated reasoning that Dependabot would raise the widening PR when mcp 3.0 landed. That reasoning was wrong, and the first run proved it within minutes of #5 merging: the pip job completed successfully and opened zero PRs, while the github-actions job opened three. Dependabot raises a PR when a new release falls *outside* the declared constraint. Against an open `>=` there is nothing to widen, so it stays silent — including on a major that removes the API this server registers with. That is precisely the shape of #2: an unbounded mcp dependency, a breaking major, and no signal until a user filed a bug 25 days later. 0.5.0 swapped an unbounded `>=1.0.0` for an unbounded `>=2.0.0` and kept the defect. The ceiling is back and is not temporary. It does two jobs: users never silently resolve to a major that cannot run this code, and the exclusion is what gives Dependabot something to report. Comments in both files now say so, so the bound does not get "cleaned up" later by someone reading it as leftover caution. Verified against the rebuilt wheel in a clean venv: resolves mcp 2.0.0, 85/85 tools registered, entry point exits 0, selenium-mcp-test 68/68 over real stdio. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 7 +++++++ pyproject.toml | 28 ++++++++++++++++++++-------- 2 files changed, 27 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0305321..fd94ea9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,13 @@ # The pip ecosystem watches pyproject.toml. When mcp 3.0.0 lands, Dependabot # opens a PR widening the pin — that PR is the alert. Do not auto-merge it: # widening the pin is exactly the change that needs the release gate run first. +# +# This only works while pyproject.toml keeps an UPPER bound on mcp. Dependabot +# raises a PR when a new release falls outside the declared constraint; against +# an open `>=` it sees nothing to do and says nothing. Confirmed the hard way on +# 2026-08-23: with an unbounded `mcp>=2.0.0` the first pip run opened zero PRs +# while the github-actions run opened three. If the ceiling is ever removed, +# this file stops being alerting and becomes decoration. version: 2 updates: - package-ecosystem: "pip" diff --git a/pyproject.toml b/pyproject.toml index 87df1c1..f4f442f 100755 --- a/pyproject.toml +++ b/pyproject.toml @@ -21,14 +21,26 @@ classifiers = [ "Programming Language :: Python :: 3.13", ] dependencies = [ - # server.py was migrated to the mcp 2.0 API in 0.5.0 — the decorators this - # server used to register with (Server.list_tools / Server.call_tool) were - # removed in 2.0.0 and are gone for good (#2). 1.x is therefore no longer - # supported: the floor, not a ceiling, is what's load-bearing now. - # An upper bound goes back the moment mcp 3.0 is on the horizon — - # Dependabot opens that PR (.github/dependabot.yml); do not merge it - # without running the selenium-mcp-test gate first. - "mcp>=2.0.0", + # Both bounds are load-bearing, and for different reasons. + # + # Floor: server.py speaks the mcp 2.0 API as of 0.5.0 — the decorators it + # used to register with (Server.list_tools / Server.call_tool) were removed + # in 2.0.0, so 1.x cannot run this code at all (#2). + # + # Ceiling: this is the bound whose absence caused #2, and it is NOT + # temporary. Two things depend on it: + # 1. Users never silently resolve to a major that removed our API. That + # is the 25-day outage, exactly. + # 2. It is what makes dependency alerting work. Dependabot only opens a + # PR when the constraint *excludes* the new release; against an open + # `>=` it has nothing to say and stays silent. Verified 2026-08-23 — + # the first pip run against an unbounded `mcp>=2.0.0` completed + # successfully and opened zero PRs. + # + # So when mcp 3.0 ships, Dependabot proposes widening this line, and that + # PR *is* the alert. Do not merge it without running the selenium-mcp-test + # gate against the new major first. + "mcp>=2.0.0,<3.0.0", "selenium>=4.6.0", ]