fix(cli): widen mcp extra cryptography upper bound to <51.0 - #3652
fix(cli): widen mcp extra cryptography upper bound to <51.0#3652Dipika Ranabhat (qubeena07) wants to merge 1 commit into
Conversation
The cli package's mcp extra still pinned cryptography below 49.0, disjoint from the agent mesh and agent os bounds raised to below 51.0 in pull request 3615 and pull request 3621. Installing the cli mcp extra together with agent mesh or agent os in one environment asked pip to satisfy cryptography below 49.0 and 50.0 or higher at once, which has no solution. Fixes microsoft#3651 Signed-off-by: qubeena07 <qubeena7@gmail.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
github-actions
Bot
added
dependencies
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
Prayag (prayagupa)
left a comment
Prayag (prayagupa)
left a comment
There was a problem hiding this comment.
Verified: widening the cli mcp extra crypto cap to <51.0 matches core and resolves the disjoint-range conflict with agent-mesh/os. gitleaks red is a transient install flake (download failed; passes on every other PR) — just re-run it. LGTM.
Imran Siddique (imran-siddique)
left a comment
Imran Siddique (imran-siddique)
left a comment
There was a problem hiding this comment.
Correct, and the failure it fixes is worse than a warning: the two ranges are disjoint, so cryptography>=46.0.7,<49.0 in the CLI's mcp extra and <51.0 in agent-mesh and agent-os cannot both be satisfied. That is not a suboptimal resolution, it is no resolution, and pip's backtracking output on a conflict like that rarely points at the extra that caused it.
Matching the core package bound rather than picking a new ceiling is the right call. A pin that is merely different from its siblings reproduces this the next time anything moves.
Worth noting a second thing this buys, which the description does not claim: <49.0 also held the resolution below 50.0.0, which is where PYSEC-2026-3552 is fixed. So the old bound was simultaneously making installs impossible and holding anyone who did install it beneath the patched release. Widening to <51.0 clears both.
For context from outside this repo: that same cryptography<49.0 cap propagated through agt-core 4.1.0 and has been failing Security scan on several downstream projects, which end up carrying CI workarounds to force the resolver past it. Fixing the bound at the source is the durable version of those workarounds.
Your gitleaks red is the platform 503 that hit this repo today fetching the gitleaks binary, not your diff. A re-run clears it.
No approve bit on this repo, so a comment, but I would merge it.
3 participants
Summary
The mcp extra in agent-governance-toolkit-cli still pinned cryptography below 49.0. That range is disjoint from the bound now required by agent mesh and agent os, which was raised to below 51.0 in pull request 3615 and pull request 3621. Installing the cli mcp extra together with agent mesh or agent os in one environment asked pip to satisfy cryptography below 49.0 and cryptography 50.0 or higher at the same time, which has no solution.
Change
One line in agent-governance-python/agent-governance-toolkit-cli/pyproject.toml, raising the mcp extra bound from cryptography>=46.0.7,<49.0 to cryptography>=46.0.7,<51.0, matching the core package bound.
Fixes #3651