rayhan 35e1cc77e8 remediate CVE's by upgrading mcp to >=1.28.1 (#17315) ...

## Summary
  
Remediates HIGH severity CVEs in the `mcp` package by bumping from
`>=1.19.0` to `>=1.28.1,<2` in `pyproject.toml`.
  
  | CVE | Severity | Package | Installed | Fixed in |
  |---|---|---|---|---|
  | CVE-2025-66416 | HIGH | mcp | 1.19.0 | 1.23.0 |
  | CVE-2026-52869 | HIGH | mcp | 1.19.0 | 1.27.2 |
  | CVE-2026-59950 | HIGH | mcp | 1.19.0 | 1.28.1 |

Raised lower bound to `>=1.28.1`, added `<2` upper bound per the MCP SDK
maintainers' recommendation to avoid unstable major releases.
  
  ## Verification
  
All module paths RAGFlow imports from `mcp` remain present and unchanged
in 1.28.1:
  
  - `mcp.client.session.ClientSession`
  - `mcp.client.sse.sse_client`
  - `mcp.client.streamable_http.streamablehttp_client`
  - `mcp.types.CallToolResult, ListToolsResult, TextContent, Tool`
  - `mcp.server.lowlevel.Server`
  - `mcp.server.sse.SseServerTransport`
  - `mcp.server.streamable_http_manager.StreamableHTTPSessionManager`
  
  Import smoke test confirmed all seven paths resolve correctly.
  
  ## Testing
  
  - MCP unit tests pass (`test/unit_test/mcp/`)
  - All MCP import paths verified present and functional on 1.28.1
  - `uv sync` resolves cleanly, no unexpected transitive version jumps

2026-07-23 22:47:31 +08:00

11 KiB

Raw Blame History

View Raw