Skip to content

v2.34.1

Choose a tag to compare

View all tags
@caspel26 caspel26 released this 12 Aug 00:11
· 8 commits to main since this release
v2.34.1
2d388ac

🔒 Security

⬆️ Raised minimum mcp version to 1.28.1

pyproject.toml

The optional mcp extra's floor (mcp>=1.2.0, <2.0.0) allowed installing versions affected by six published GitHub Security Advisories against the mcp PyPI package — all High severity (CVSS 7.1–8.7): denial-of-service via uncaught exceptions (CVE-2025-53365, CVE-2025-53366), DNS-rebinding auth bypass on HTTP transports (CVE-2025-66416), cross-client access to the opt-in experimental task-handler feature (CVE-2026-52870), session hijacking via guessable session IDs (CVE-2026-52869), and missing origin validation on the deprecated websocket transport (CVE-2026-59950).

ninja_aio.mcp only uses stdio transport with no experimental features enabled, so none of these were reachable through this project's code path — but the permissive floor still allowed installing vulnerable versions. The mcp extra now requires mcp>=1.28.1, <2.0.0, which is patched against all six.

🎯 Summary

Dependency-floor security patch — no functional or API changes. If you installed django-ninja-aio-crud[mcp] previously, run pip install -U "django-ninja-aio-crud[mcp]" to pick up a patched mcp version.

Assets 2
Loading