fix: update vulnerable dependencies without changing SDK APIs

[jbeckwith-oai]

Summary

Update vulnerable dependencies and published security minimums to address 73 of the 92 open dependency alerts. Apply the requirements to the owning core dependencies, optional extras, and standalone Twilio examples. A typing-only Cloudflare WebSocket cast accommodates the updated aiohttp annotations without changing SDK APIs or runtime behavior.

The updated async test runner exposed implicit exception-context retention on Python 3.10. Clear that context in the existing MCP mapped-error helper after raising, preserving the approved explicit cause and the existing credential-redaction contract. The five failing CI assertions pass without weakening tests.

19 alerts remain (3 critical, 10 high, 4 medium, 2 low):

• LiteLLM: 12 alerts. The patched releases require openai<3, which conflicts with this SDK's openai>=3,<4 requirement.
• Cryptography: 7 alerts. Fixing all alerts requires version 50 or later; version 49 removed Intel macOS and 32-bit Windows support. Retain the existing cap to preserve supported platforms.

Per Seratch’s review request, python-dotenv is no longer a mandatory core SDK dependency. Its patched lockfile version and direct Twilio example requirements remain. The published dotenv security minimum for consumers choosing MCP 1.x is deferred.

These remaining updates need compatible upstream releases or a separate compatibility decision. Alert closure is projected from the dependency changes and will be confirmed by GitHub after merge.

Compatibility evidence

Rebased onto main at fbd2dbcaaf74a2c447c6d3fa9d5645d83fd7e292 without conflicts; all three task commits retain identical patches. Seratch’s mandatory-core-dotenv removal and the Python 3.10 correction are preserved.

All 23 CI checks passed on commit cad6c4f4c7b359ac21e16cfae13ac8e3ec6049ae. Complete CI run.

Compatibility boundary	Evidence and result
Released public API	The existing released API contract passes against installed wheel and source distributions, including policy-declared optional surfaces. Python 3.10 artifact checks, Python 3.14 artifact checks.
Previously serialized state	Historical RunState fixtures load and rewrite successfully, including semantic checks for historical features. Artifact compatibility log.
Supported Python and Windows configurations	Tests pass on Linux Python 3.10–3.14 and Windows Python 3.10/3.13. The previously failing Python 3.10 jobs now pass on Linux and Windows.
MCP 1.x and 2.x compatibility	Clean-wheel tests pass with the supported MCP 1.x floor and latest tested 1.x release; the regular suite exercises locked MCP 2.x. MCP 1.x job.
Packaged Windows imports and API surface	The prospective package-contract smoke test passes on Windows. Windows artifact job.
Sandbox and service integrations	Native macOS sandbox tests and container integration tests pass.
Static validation and docs	Formatting, lint, mypy, pyright, Windows mypy, documentation build, and CodeQL analysis jobs pass in the PR checks. Successful analysis execution does not assert that all security findings are cleared.

Additional local validation:

• The complete repository verification script passes: 9,660 tests passed, 60 skipped, with no lint or type-check errors. An initial local subprocess-runner test encountered a macOS setpgid permission failure; its focused rerun and the full stack rerun passed in the same sandbox without code or test changes. The native macOS cases skipped locally under the Codex sandbox setting passed in CI as linked above.
• The Python 3.10 MCP suite passes: 473 passed, 24 skipped. All 119 MCP error-handling tests pass on both Python 3.10 and 3.14, preserving approved explicit causes and credential-redaction assertions without weakening tests.
• Fresh Python 3.10 all-extras resolution and both standalone Twilio requirement resolutions pass. Vulnerable-version rejection checks for the retained security floors pass, while patched Protobuf 5.x and 6.x remain installable. Built wheel/source/installed metadata agree on all 56 requirements and Requires-Python: >=3.10.
• Two fresh, consecutive independent security/compatibility review rounds on the rebased branch found no in-scope blockers. The reviewed files remained unchanged through final verification and push.

These results found no regressions in the tested API, persistence, packaging, and runtime contracts. The incompatible LiteLLM/Cryptography upgrades remain deferred, and the requested python-dotenv core-dependency removal is implemented.

Checks

• Existing regression coverage and focused dependency-resolution checks exercise the changes; public APIs are unchanged.
• I've run .agents/skills/code-change-verification/scripts/run.sh.
• All applicable local verification steps pass.
• Independent adversarial review completed before submission.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T02:04:56.395949Z	cad6c4f	New commits
🔒 Security Review	✅ Completed 2026-09-12T02:06:12.442271Z	cad6c4f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seratch]

I'd like to minimize new required deps. Also, it seems the tests are failing only with Python 3.10 but I haven't checked what's the cause yet.

[HAYDEN-OAI]

Reviewed all six changed files at 51f2cd5 against actual merge base 1705dd6, with released compatibility baseline v0.22.2. No substantive introduced issues found.

Checked manifest/lock agreement, optional-extra and standalone-example ownership, Python 3.10 compatibility of the new floors, provider requirement intersections, and changed artifact metadata against PyPI. The Cloudflare cast is runtime-neutral. The MCP mapped-error change preserves the explicit-cause/None contract while clearing implicit context after raising.

I favor retaining the python-dotenv floor while MCP 1.x remains supported: its pydantic-settings dependency still permits affected dotenv versions, and the repository lockfile does not constrain published SDK consumers. The added footprint for MCP 2-only installations is real; this approval does not resolve or override the maintainer discussion about that choice.

Projected alert closures and the deferred LiteLLM/Cryptography remediation status were not independently verified. This review is not an accepted-risk waiver or a claim of repository-wide security compliance. No tests, installations, builds, lint, CI status, coverage, or mergeability were run or assessed.

[HAYDEN-OAI]

Reviewed the complete six-file diff at 0d869d36b22cde66a4fdcc30a0ca8bd7ef001089 against actual merge base 1705dd62509ebfb3e85e26baedbe43e9f183580f, including the new delta from my previous review. No substantive introduced defects found.

The update consistently removes the mandatory python-dotenv requirement from pyproject.toml and both root lock-metadata entries. All locked package versions/artifacts, direct Twilio example floors, retained dependency minimums, and runtime changes are unchanged from the previously reviewed head. The Cloudflare cast remains runtime-neutral, and the MCP mapped-error change preserves the approved explicit-cause contract while clearing implicit context.

Seratch's requested core-dependency removal is implemented. The published security floor for consumers selecting supported MCP 1.x remains unimplemented, as the PR now explicitly documents; the patched repository lockfile does not constrain those consumers. The same residual floor gap applies to existing LiteLLM/Vercel extra paths: LiteLLM 1.83.0 metadata permits python-dotenv>=0.2.0, and Vercel 0.5.6 metadata leaves it unversioned. These gaps were already present at the merge base, so this is scoped partial remediation, not an equivalent dotenv fix or a newly introduced regression. My earlier floor recommendation is not a claim that ordinary MCP settings reads reach the advisory's file-writing operation.

Projected alert closures and the remaining remediation status were not independently verified. This approval is not an accepted-risk waiver or a claim of repository-wide security compliance. No tests, installations, builds, lint, CI status, coverage, or mergeability were run or assessed.