[anniewn]

Fixes

Summary

Changes

dnspython 2.9.0 fixes GHSA-45c3-73f7-pv4m and needs Python 3.11 or later. While this server allows 3.10, uv.lock keeps a python_full_version < '3.11' branch that can only resolve dnspython 2.8.x, and CI tests that branch because .python-version is 3.10. Python 3.10 reached end of life on 2026-10-01.

This raises the minimum for this server only, the same way s3-tables did in #2368:

• pyproject.toml: requires-python = ">=3.11"; drop the Python :: 3.10 classifier.
• .python-version: 3.11, so CI tests the new minimum.
• README.md: install Python 3.11 or newer.
• uv.lock: re-locked with uv 0.13.6, upgrading dnspython, authlib, certifi, joserfc, pyjwt, urllib3, virtualenv, anyio and typing-extensions:
  • dnspython 2.7.0 -> 2.9.1, authlib 1.7.2 -> 1.9.2, certifi 2025.6.15 -> 2026.10.23, joserfc 1.7.2 -> 1.7.7, pyjwt 2.13.0 -> 2.15.1, urllib3 2.6.3 -> 2.8.0, virtualenv 20.36.1 -> 21.15.2, anyio 4.9.0/4.14.2 -> 4.16.0, typing-extensions 4.15.0 -> 4.16.0.
  • The other version changes are the ones those upgrades require. virtualenv 21 (dev only, via pre-commit) moves filelock 3.20.3 -> 4.2.7, distlib 0.3.9 -> 0.4.4, packaging 25.0 -> 26.3 and platformdirs 4.3.8 -> 4.14.3, and adds python-discovery 1.9.1. packaging and platformdirs stay within fastmcp's constraints.
  • anyio 4.16 drops sniffio, and the 3.10-only aiofile 3.9.0 is removed. The lock has 3 resolution forks instead of 6, and none is for Python 3.10.

uv-requirements.txt and other servers are unchanged.

User experience

Before: the server installs on Python 3.10, and the lock pins dnspython 2.7.0.

After: the server needs Python 3.11 or newer. On Python 3.10, pip and uvx pick the last release that supports 3.10, so nothing fails to install. The Docker image already uses Python 3.13 and is unaffected apart from the refreshed lock.

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Tested on Python 3.11 in src/billing-cost-management-mcp-server: uv lock --check, uv sync --frozen --all-extras --dev, uv run --frozen pytest (4437 passed), uv run --frozen pyright (0 errors), uv run --frozen ruff format --check ., uv run --frozen ruff check . and uv build all pass.

Is this a breaking change? (Y/N) N

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.79%. Comparing base (69e2666) to head (ce091fa).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4995      +/-   ##
==========================================
- Coverage   93.79%   93.79%   -0.01%     
==========================================
  Files        1080     1080              
  Lines       94712    94712              
  Branches    15442    15442              
==========================================
- Hits        88833    88832       -1     
  Misses       3505     3505              
- Partials     2374     2375       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.