Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

tests/test_dependency_security_lock.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _version_tuple(version: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in version.split("."))
+
+
+def test_mcp_http_transport_dependencies_are_locked_at_fixed_versions() -> None:
+    pyproject = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
+    constraints = pyproject["tool"]["uv"]["constraint-dependencies"]
+    assert "httpcore2>=2.10.0" in constraints
+    assert "httpx2>=2.12.0" in constraints
+
+    lock = tomllib.loads((ROOT / "uv.lock").read_text(encoding="utf-8"))
+    packages = {package["name"]: package for package in lock["package"]}
+
+    mcp_dependencies = {dependency["name"] for dependency in packages["mcp"]["dependencies"]}
+    httpx2_dependencies = {dependency["name"] for dependency in packages["httpx2"]["dependencies"]}
+    assert "httpx2" in mcp_dependencies
+    assert "httpcore2" in httpx2_dependencies
+    assert _version_tuple(packages["httpcore2"]["version"]) >= (2, 10, 0)
+    assert _version_tuple(packages["httpx2"]["version"]) >= (2, 12, 0)
+
+    requirements = {}
+    for line in (ROOT / "requirements.lock").read_text(encoding="utf-8").splitlines():
+        if "==" in line:
+            name, version = line.split("==", maxsplit=1)
+            requirements[name] = version
+    assert requirements["httpcore2"] == packages["httpcore2"]["version"]
+    assert requirements["httpx2"] == packages["httpx2"]["version"]