uipath-langchain 0.16.1 uses mcp 1.26.0 as a dependency with several CVE vulnerabilities

[mikael-andersson91]

The security scans of our GitHub Actions workflows on coded agents using uipath-langchain has mcp version 1.26.0 as a sub-dependency with several high-severity with know fixes available.

The library would need to be updated to ensure improved security.

Name	Version	Severity	EPSS	Vulnerability	CVE	Fixed-In
mcp	1.26.0	High	0.3%	GHSA-jpw9-pfvf-9f58	CVE-2026-52869	1.27.2
mcp	1.26.0	High	0.2%	GHSA-hvrp-rf83-w775	CVE-2026-52870	1.27.2
mcp	1.26.0	High	0.1%	GHSA-vj7q-gjh5-988w	CVE-2026-59950	1.28.1