Repository navigation
Security: Update Starlette dependency to address vulnerabilities #1557
Description
Activity
@Kludex the vulnerable starlette version is pinned in the uv.lock and is causing downstream consumers to pull it in as a transitive dependency.
Surely we aren't suggesting that everyone downstream of MCP should explicitly add the updated starlette version to resolve this since we're not willing to update the lock file, right?
I agree with the non-pinned update in the pyproject.toml, but not updating the lock seems not ideal
What are you talking about?
Who are the downstream consumers?
Yeah, it's okay to update the lock. But that shouldn't matter anyway as well.
Issue
The project currently uses Starlette
>=0.27, which includes versions with known security vulnerabilities. The dependency should be updated to>=0.49.1to address these issues.Impact
pyproject.tomlexamples/servers/simple-streamablehttp/pyproject.tomlexamples/servers/simple-streamablehttp-stateless/pyproject.tomlResolution
A pull request has been created to update the Starlette dependency across all affected files:
References
>=0.49.1