build(deps): bump mcp from 1.28.1 to 1.30.0

[dependabot]

Bumps mcp from 1.28.1 to 1.30.0.

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

• streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's client does) are not affected.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

• Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
• Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
• Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
• session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

• [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in modelcontextprotocol/python-sdk#3396
• [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in modelcontextprotocol/python-sdk#3426
• [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in modelcontextprotocol/python-sdk#3431
• [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in modelcontextprotocol/python-sdk#3448
• [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

• [v1.x] Complete the FastMCP Settings model at import time by @​maxisbey in modelcontextprotocol/python-sdk#3352
• [v1.x] Apply the request body limit to the SSE and OAuth endpoints by @​maxisbey in modelcontextprotocol/python-sdk#3344

... (truncated)

Commits

• 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
• 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
• 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
• 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
• 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
• b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
• 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
• ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
• 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
• c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[guima-why]

iac-code E2E 报告

提交：84d77cf44543911a2a9d48457ec10abd4c4ed585 · 状态：符合免测规则

链路阶段进展

时间为 UTC+8；预计完成时间为估算，运行中计数尚未作为通过证据。

环节	状态	开始	完成	已耗时	预计完成	最近更新	当前说明
PR 身份与触发条件核对	已完成	10-20 11:57:00	10-20 11:57:00	0s	—	10-20 11:57:00	—
改动材料采集	已完成	10-20 11:58:31	10-20 11:58:37	6s	—	10-20 11:58:37	完成 1；总数 1
Agent 安全与影响分析	已完成	10-20 11:58:39	10-20 11:58:40	1s	—	10-20 11:58:40	—
测试计划确定 / 维护者授权	已完成	10-20 11:58:41	10-20 11:58:43	2s	—	10-20 11:58:43	—
源码包准备与摘要计算	无需执行	—	10-20 12:07:29	—	—	10-20 12:07:29	前置失败
源码上传及读回校验	无需执行	—	10-20 12:07:30	—	—	10-20 12:07:30	前置失败
full 触发与排队	无需执行	—	10-20 12:07:30	—	—	10-20 12:07:30	前置失败
full 环境准备	无需执行	—	10-20 12:07:31	—	—	10-20 12:07:31	前置失败
full 用例执行	无需执行	—	10-20 12:07:32	—	—	10-20 12:07:32	前置失败
full 结果核验	无需执行	—	10-20 12:07:32	—	—	10-20 12:07:32	前置失败
live 触发与排队	无需执行	—	10-20 12:07:33	—	—	10-20 12:07:33	前置失败
live 环境准备	无需执行	—	10-20 12:07:33	—	—	10-20 12:07:33	前置失败
live 用例执行	无需执行	—	10-20 12:07:34	—	—	10-20 12:07:34	前置失败
资源清理（随用例并行）	无需执行	—	10-20 12:07:35	—	—	10-20 12:07:35	前置失败
live 结果核验	无需执行	—	10-20 12:07:35	—	—	10-20 12:07:35	前置失败
失败复盘	无需执行	—	10-20 11:58:45	—	—	10-20 12:07:15	—
最终 GitHub 报告发布	已完成	10-20 11:58:45	10-20 12:07:28	523s	—	10-20 12:07:28	网络请求等待重试
GitHub 卡点回写与请求收尾	已完成	10-20 11:58:46	10-20 12:07:29	523s	—	10-20 12:07:29	—

最近网络尝试（仅操作枚举和错误类别，不含请求地址或响应内容）：

• github.pr.get：尝试 2 次，32.13s；timeout
• github.status.write：尝试 1 次，30.02s；timeout
• github.pr.get：尝试 2 次，32.08s；timeout

用例集	结果	耗时	重跑 / 重跑通过	清理异常
full	免测	—	—	—
live	免测	—	—	—

说明：每个失败用例最多重跑一次；任一次资源清理失败或未验证均不能判通过。
复盘是待核实建议；报告只展示固定安全字段，不含内部链接或原始云日志。