Bump idna from 3.10 to 3.15 in /python/samples/demos/mcp_with_oauth#14186
Bump idna from 3.10 to 3.15 in /python/samples/demos/mcp_with_oauth#14186dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.15. - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.10...v3.15) --- updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 86%
✓ Correctness
This is a straightforward Dependabot security update bumping idna from 3.10 to 3.15 in a uv.lock file. The update addresses CVE-2026-45409 (quadratic-time bypass). The lock file changes are auto-generated by uv's resolver: the idna version, hashes, and URLs are updated, and the exceptiongroup typing-extensions marker shifted from <3.12 to <3.11 as a normal side effect of re-resolution. No correctness issues found.
✓ Security Reliability
This is a straightforward Dependabot security bump of the
idnapackage from 3.10 to 3.15 in theuv.lockfile for themcp_with_oauthsample. The update addresses CVE-2026-45409, which fixes a bypass of the CVE-2024-3651 mitigation for quadratic-time processing of oversized inputs. The lock file changes are auto-generated byuv, include proper SHA256 hashes for integrity verification, and theexceptiongroupmarker adjustment is a normal side-effect of lock resolution. No security or reliability concerns.
✓ Test Coverage
This is a Dependabot PR that bumps the
idnadependency from 3.10 to 3.15 in the uv.lock file of a sample/demo project (python/samples/demos/mcp_with_oauth). The change is confined entirely to a lockfile — no source code or test code is modified. There are no new behaviors, APIs, or logic changes that would require test coverage. No test coverage concerns apply.
✓ Failure Modes
This PR is a straightforward Dependabot security bump of idna from 3.10 to 3.15 in the uv.lock file for a sample/demo project. The update addresses CVE-2026-45409 (quadratic-time processing bypass). The only changes are version, hash, and URL updates for the idna package, plus a minor marker adjustment for exceptiongroup's typing-extensions dependency (a normal side effect of lock file re-resolution). No source code is modified, no new failure modes are introduced.
✗ Design Approach
The dependency bump is incomplete for this demo: the top-level client lockfile now uses
idna 3.15, but the same sample’s documented server flow still resolves frompython/samples/demos/mcp_with_oauth/server/uv.lock, which remains pinned toidna 3.10. Because the README directs users to run both the authorization server and resource server from that subproject, this change does not fully address the security update for the sample as a whole.
Flagged Issues
-
python/samples/demos/mcp_with_oauth/README.md:16-19and:34-40instruct users to run the sample frompython/samples/demos/mcp_with_oauth/server, butpython/samples/demos/mcp_with_oauth/server/uv.lock:127-132still pinsidnato3.10. Updating only the parentuv.lockleaves the documented server code path on the old version, so the PR does not fully solve the dependency bump it is trying to make.
Automated review by dependabot[bot]'s agents
| [[package]] | ||
| name = "idna" | ||
| version = "3.10" | ||
| version = "3.15" |
There was a problem hiding this comment.
This only updates the client-side lockfile. The demo's README still tells users to cd samples/demos/mcp_with_oauth/server and run both servers there (README.md:16-19, :34-40), and that subproject's separate lockfile still pins idna 3.10 (server/uv.lock:127-132). As written, the documented server path for this sample remains on the old version, so the security bump is incomplete.
|
Flagged issue
Source: automated DevFlow PR review |
Bumps idna from 3.10 to 3.15.
Changelog
Sourced from idna's changelog.
... (truncated)
Commits
af30a09Release 3.1530314d4Pre-release 3.15rc005d4b21Merge pull request #237 from kjd/convert-docs-to-markdown2987fdbConvert README and HISTORY from reStructuredText to Markdown59fa800Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333eadef6983Merge branch 'master' into dependabot/github_actions/actions-f3e34333eabbd8004Merge pull request #234 from StanFromIreland/patch-1edd07c0Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group5557db0Merge branch 'master' into patch-1f11746cMerge pull request #235 from StanFromIreland/patch-2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.