Relax python-dotenv constraint to >=1.1.0 #83
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I’m integrating ScaleKit OAuth into a Graphiti MCP server that relies on FastMCP’s middleware API (mcp.add_middleware, added in FastMCP 2.9+). FastMCP ≥2.9 requires python-dotenv >=1.1.0. Your SDK currently requires python-dotenv ~=1.0.1, which creates a hard resolver conflict.
Evidence from my build:
ERROR: The conflict is caused by:
fastmcp 2.12.0 depends on python-dotenv>=1.1.0
scalekit-sdk-python 2.3.3 depends on python-dotenv~=1.0.1
Minimal steps to reproduce:
pip install "fastmcp>=2.9" "scalekit-sdk-python==2.3.3" "python-dotenv==1.1.1"
-> resolver error as above
Suggested change (setup.cfg / pyproject / setup.py):
before
python-dotenv~=1.0.1
after
python-dotenv>=1.1.0
FastMCP’s middleware is the clean way to attach auth, logging, and policy around MCP ops. It is officially documented as “New in version 2.9.0.” I need a single environment for MCP + OAuth to avoid cross-service glue. Is there any way you could relax the python-dotenv requirement to >=1.1.0 (or drop it as a hard dependency if only used for examples)? You’d need to publish a patch release with the updated constraint. The current SDK release line is 2.3.x on PyPI. A small patch would unblock modern FastMCP servers.
If there’s an internal reason for the ~=1.0.1 cap, I can adapt by not using your service, but a broader range aligns with current ecosystem baselines.