Skip to content

deps: bump requests to 2.33.0 in mcp_server_vefaas_browser_use - #262

Open
katsugtgz wants to merge 1 commit into
volcengine:mainfrom
katsugtgz:deps/requests-2.33.0
Open

deps: bump requests to 2.33.0 in mcp_server_vefaas_browser_use#262
katsugtgz wants to merge 1 commit into
volcengine:mainfrom
katsugtgz:deps/requests-2.33.0

Conversation

@katsugtgz

Copy link
Copy Markdown

Updates requests from 2.32.3 to 2.33.0 in mcp/server/mcp_server_vefaas_browser_use/pyproject.toml.

Evidence:

  • pyproject.toml pinned requests==2.32.3
  • OSV reports GHSA-9hjg-9r4m-mvj7 (netrc credentials leak via malicious URLs) and PYSEC-2026-2275 against 2.32.3
  • 2.32.4 still sits in range for GHSA-gc5v-m9x4-r6x2, so 2.33.0 is the lowest release clear of both advisories

Validation:

  • requests@2.33.0 installs into a fresh Python 3.10 venv and imports
  • the server module imports and its console entrypoint resolves with mcp<2 plus requests==2.33.0 (the current mcp>=1.6.0 floor resolves to 2.x where mcp.server.fastmcp no longer exists; that is pre-existing and unchanged by this bump)
  • no test suite exists for this server

Scope: dependency bump only.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant