Publish curated ITWorx_MCP_Hub source from 3237e4d8aec312d63d13b4e80664422a7520b5f9

scripts/contextforge_candidate_recipe.py

@@ -28,7 +28,14 @@ UV_VERSION = "0.12.10"
 LOCK_TIMESTAMP = "2026-10-02T00:00:00Z"
 GLOBAL_LOCK_CUTOFF = "2026-09-22T00:00:00Z"
 EXTRAS = ("redis", "postgres", "observability", "granian", "plugins", "llmchat")
-CONSTRAINTS = ("mcp==1.30.0", "PyJWT==2.15.0", "urllib3==2.8.0")
+SECURITY_LOCK_CUTOFF = "2026-10-14T00:00:00Z"
+SECURITY_CONSTRAINTS = (
+    "anyio==4.14.2",
+    "cryptography==50.0.0",
+    "langgraph-sdk==0.4.4",
+    "langgraph==1.2.3",
+)
+CONSTRAINTS = ("mcp==1.30.0", "PyJWT==2.15.0", "urllib3==2.8.0", *SECURITY_CONSTRAINTS)
 BUILD_TOOLS = ("pip==26.2.1", "setuptools==82.0.1", "wheel==0.46.2")
 
 SOURCE_HASHES = {
@@ -125,6 +132,24 @@ def binary_postgres_pyproject(source_text: str) -> str:
     return source_text.replace(original, '"psycopg[binary]>=3.3.4"', 1)
 
 
+def runtime_pyproject(source_text: str) -> str:
+    """Preserve upstream metadata except the reviewed binary and SDK compatibility fixes."""
+    import tomllib
+
+    text = binary_postgres_pyproject(source_text)
+    llmchat = tomllib.loads(text).get("project", {}).get("optional-dependencies", {}).get("llmchat")
+    if llmchat is not None:
+        original = '"langgraph<=1.2.0"'
+        if (
+            not isinstance(llmchat, list)
+            or llmchat.count("langgraph<=1.2.0") != 1
+            or text.count(original) != 1
+        ):
+            raise CandidateRecipeError("upstream LangGraph compatibility contract changed")
+        text = text.replace(original, '"langgraph==1.2.3"', 1)
+    return text
+
+
 def candidate_pyproject(source_text: str) -> str:
     """Apply the narrowly scoped candidate-only dependency resolution policy."""
     try:
@@ -149,7 +174,7 @@ def candidate_pyproject(source_text: str) -> str:
     }:
         raise CandidateRecipeError("upstream uv source override shape changed")
 
-    text = binary_postgres_pyproject(source_text).replace("\r\n", "\n")
+    text = runtime_pyproject(source_text).replace("\r\n", "\n")
     source_start, source_end, source_table = _table_range(text, "tool.uv.sources")
     source_lines = source_table.strip().splitlines()
     expected_source_lines = [
@@ -171,7 +196,7 @@ def candidate_pyproject(source_text: str) -> str:
     text = text.replace(
         uv_anchor,
         f'exclude-newer = "{GLOBAL_LOCK_CUTOFF}"\n'
-        + 'constraint-dependencies = ["mcp==1.30.0", "PyJWT==2.15.0", "urllib3==2.8.0"]\n',
+        + f"constraint-dependencies = {json.dumps(list(CONSTRAINTS))}\n",
         1,
     )
 
@@ -182,6 +207,10 @@ def candidate_pyproject(source_text: str) -> str:
         f'{name.lower()} = "{LOCK_TIMESTAMP}"\n'
         for name in ("mcp", "pyjwt", "urllib3", "pip", "setuptools", "wheel")
     )
+    package_overrides += "".join(
+        f'{requirement.split("==", 1)[0]} = "{SECURITY_LOCK_CUTOFF}"\n'
+        for requirement in SECURITY_CONSTRAINTS
+    )
     text = text.replace(package_table, package_table + package_overrides, 1)
 
     text = text.rstrip() + "\n\n[dependency-groups]\nbuild-tools = [\n"
@@ -298,6 +327,7 @@ def _make_manifest(
         "buildTools": list(BUILD_TOOLS),
         "globalExcludeNewerUtc": GLOBAL_LOCK_CUTOFF,
         "freshnessOverrideUtc": LOCK_TIMESTAMP,
+        "securityFreshnessOverrideUtc": SECURITY_LOCK_CUTOFF,
         "requirements": {
             "production-requirements.lock": production_hash,
             "build-tools.lock": build_tools_hash,
@@ -459,7 +489,7 @@ def prepare_source(source_dir: Path) -> None:
     manifest = _read_lock_manifest()
     verify_lock_contents(manifest)
     transformed = transform_containerfile(source["Containerfile"])
-    project = binary_postgres_pyproject(source["pyproject.toml"].decode("utf-8"))
+    project = runtime_pyproject(source["pyproject.toml"].decode("utf-8"))
 
     for source_name, target_name in LOCK_OUTPUT_NAMES.items():
         _write_atomic(source_dir / target_name, _require_file(LOCK_DIR / source_name))

scripts/verify.py

@@ -85,6 +85,7 @@ def main() -> int:
         "scripts/promotion_preflight.py",
         "scripts/publish_mcp_hub_ingestion.py",
         "scripts/build_mcp_hub_release_images.py",
+        "scripts/prepare_release_security_bases.py",
         "scripts/package_mcp_hub_release_artifact.py",
         "scripts/export_release.py",
         "scripts/render_release_record.py",
@@ -304,6 +305,7 @@ def main() -> int:
                 "scripts/promotion_preflight.py",
                 "scripts/publish_mcp_hub_ingestion.py",
                 "scripts/build_mcp_hub_release_images.py",
+                "scripts/prepare_release_security_bases.py",
                 "scripts/package_mcp_hub_release_artifact.py",
                 "scripts/discover_unraid.py",
                 "scripts/revoke_demo_token.py",