fix: require mcp 1.30.0 for CVE-2026-59951

[nabinchha]

📋 Summary

Require MCP 1.30.0 or later to address CVE-2026-59951, which allows unbounded session retention in stateful Streamable HTTP servers. Raising the direct dependency floor also excludes affected versions from published engine installs.

🔗 Related Issue

N/A — vulnerability report CVE-2026-59951.
Upstream advisory: GHSA-84m7-p3x7-pcfv

🔄 Changes

• Raise the engine dependency from mcp>=1.29.0,<2 to mcp>=1.30.0,<2.
• Refresh uv.lock to MCP 1.30.0; all other dependency versions are unchanged.

🧪 Testing

• make test passes: config 659 passed; engine 2,481 passed; interface 1,165 passed, 1 skipped.
• make check-all passes.
• uv lock --check passes.
• Verified installed MCP is 1.30.0 and built engine metadata rejects MCP 1.29.0.
• Self-review completed with no findings.
• Unit tests added/updated: N/A — dependency-only change; existing MCP tests pass.
• E2E tests added/updated: N/A — no application logic changes.

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• External contributor issue requirement: N/A — repository collaborator.
• Architecture docs updated: N/A — no architectural changes.

[greptile-apps]

Confidence Score: 5/5

[High impact] This dependency-only change appears safe to merge.

Summary

Raises the engine’s minimum MCP version to 1.30.0 for the reported CVE-2026-59951 fix.

• The engine now requires MCP 1.30.0 or newer.

_{Reviews (3) · Last reviewed commit: "Merge branch 'main' into codex/fix-mcp-c..." · Reviewed by Greptile}

[github-actions]

Review could not be completed

The automated review for PR #1053 (fix: require mcp 1.30.0 for CVE-2026-59951) did not run. The review-code skill is set with disable-model-invocation, so the CI agent cannot invoke it, and it is reserved for explicit user invocation. No structural impact analysis (/tmp/structural-impact-1053.md) was available.

For reference, the PR changes 2 files (+5/−5): packages/data-designer-engine/pyproject.toml and uv.lock.

To get a review, a maintainer can run /review-code 1053 interactively, or the recipe/skill configuration can be updated to allow model invocation in CI.