Refresh the locked runtime dependencies

[maxisbey]

Stacked on #3316 (uses its uv pin); the diff against that branch is uv.lock plus three typing adjustments.

Motivation and Context

uv.lock has not moved for most runtime dependencies since mid-2025 (anyio 4.10.0, starlette 0.49.1, uvicorn 0.35.0, sse-starlette 3.0.2, pyjwt 2.10.1, typer 0.17.4, ...), because the bump PRs since then were closed rather than merged. The locked CI leg therefore certifies a dependency set roughly a year older than what pip install mcp resolves today, and the new dependency canary's "differences from uv.lock" table starts life 30 rows long.

This re-resolves the runtime closure of mcp[cli,rich] — the same 39 packages the canary floats — to current versions and leaves test/docs tooling (pytest, ruff, pyright, coverage, inline-snapshot, zensical, ...) exactly where it was, so the diff carries no lint or snapshot churn; Dependabot keeps owning those. Every bumped version was published at least 14 days ago, matching the Dependabot cooldown. Notable moves: anyio 4.10.0 → 4.14.2, starlette 0.49.1 → 1.3.1, uvicorn 0.35.0 → 0.52.0, sse-starlette 3.0.2 → 3.4.6, pydantic 2.12.5 → 2.13.4, pyjwt 2.10.1 → 2.13.0, cryptography 46 → 50, typer 0.17.4 → 0.27.0, rich 14 → 15, httpx2 2.5.0 → 2.9.1. logfire/opentelemetry-sdk (dev) move too because opentelemetry-api drags them.

Three typing adjustments come with the newer stubs; none changes behaviour:

• anyio 4.12+ types TaskGroup.start_soon as taking a coroutine function (it always required one at runtime), so JSONRPCDispatcher._spawn and _contained_notify are annotated with Coroutine[...] instead of Awaitable[...]. OnNotify itself is untouched.
• Starlette 0.52 made Request generic over its state type; the one test that reads request attributes off ServerRequestContext.request pins the parameter so strict pyright stays happy.
• start_soon now returns a task handle, so a stdio test callback typed () -> None wraps the call.

How Has This Been Tested?

./scripts/test (full suite, 100% coverage, strict-no-cover) and pyright pass locally on 3.14 against the refreshed lock; CI covers the rest of the matrix. Also drove a real stdio and streamable-HTTP client/server round trip (initialize, list/call tool, progress + log notifications, a validation-error call) and the mcp CLI against the new versions by hand.

Breaking Changes

None. Only the lockfile and annotations change; the published dependency specifiers are untouched.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

(Maintenance: lockfile refresh.)

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

If you would rather take the whole tree forward (tooling included) that is a one-line uv lock --upgrade on top, but it pulls in ruff 0.16 / pyright 1.1.411 / inline-snapshot 0.35 and whatever they flag, so it seemed better reviewed separately.

_{AI Disclaimer}