Skip to content

0.3.43

Choose a tag to compare

View all tags
@vndee vndee released this 03 Aug 04:13
· 87 commits to main since this release
0.3.43
be1493b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes a broken MCP install

mcp 2.0.0 removed mcp.server.fastmcp, which the MCP server imports at module scope. The extras allowed it through an unbounded mcp>=1.10.0, so any fresh install since mcp 2.0.0 shipped produced a server that would not start:

$ pip install 'llm-sandbox[mcp-docker]'
ModuleNotFoundError: No module named 'mcp.server.fastmcp'

This affected everyone installing 0.3.42 fresh, including via the MCP registry entry. Upgrade if you use the MCP server.

What changed

mcp>=1.10.0 → mcp>=1.28.1,<2 across the mcp-docker, mcp-podman, and mcp-k8s extras.

The ceiling stops 2.0.0. The floor is not arbitrary — it also clears two high-severity advisories in mcp:

Advisory Fixed in
WebSocket transport lacks Host/Origin validation 1.28.1
HTTP transports serve sessions without verifying the authenticated principal 1.27.2

Neither was exploitable here, since this server runs over stdio, but there is no reason to keep permitting the vulnerable range.

Resolves to mcp 1.29.0. Support for mcp 2.x requires migrating off mcp.server.fastmcp and will follow separately.

Also in this release

Repository and metadata only, no runtime impact: CITATION.cff now updates automatically on release, and the JOSS paper builds in CI.

Full changelog: 0.3.42...0.3.43

Assets 2
Loading