Skip to content

v1.108.77 — starlette floor >=1.3.1 (http/all extras)

Choose a tag to compare

View all tags
@jgravelle jgravelle released this 23 Jun 11:29
v1.108.77
1f2efec

Raise the http and all extras' starlette floor from >=0.27.0 to >=1.3.1.

starlette is a direct dependency of those extras, so a jcodemunch-mcp[http] installer could previously resolve a starlette older than 1.3.1 — vulnerable to the request-form size-limit bypass and the StaticFiles UNC-path SSRF / NTLM-credential advisories. Raising the published floor closes that resolution window for downstream installers of the HTTP transport.

Compatibility verified: mcp 1.26.0 declares no starlette upper bound and uv lock re-resolves cleanly at the new floor (148 packages). The base install and all other extras are unaffected. Full suite 4820 passed / 8 skipped.

Assets 10
Loading