[ayhammouda]

Summary

Refresh the dependency versions proposed by nine Dependabot PRs, add the MCPRush README badge, and patch the vulnerable Certifi lock. MCP remains at 1.30.0; the MCP v2 migration in #123 is separate.

Dependency	Before → after
Click	8.4.2 → 8.5.0
Platformdirs	4.11.0 → 4.12.2
Pydantic / pydantic-core	2.13.4 / 2.46.4 → 2.13.5 / 2.46.5
Ruff	0.16.0 → 0.16.10
Certifi	2026.4.22 → 2026.10.23
setup-uv	10.2.0 → 10.3.0
actions/cache	5.1.0 → 6.1.0
CodeQL init, analyze, upload-sarif	7999b86 → 2892aa5

Refs #121, #124, #125, #126, #141, #142, #143, #144, #155.

Acceptance criteria

• Include the nine compatible Dependabot upgrades using their proposed versions and immutable action pins.
• Keep the MCP v1 dependency range and runtime code unchanged.
• Add the supplied MCPRush badge and record maintenance/security changes in the changelog.
• Patch Certifi after the locked dependency audit identified PYSEC-2026-4320.

Validation gate output

Local validation on macOS / Python 3.13.10:

uv lock --check                                           PASS
uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/
                                                         All checks passed
uv run --locked pyright src/ benchmarks/                  0 errors, 0 warnings
uv run --locked pytest --tb=short -q                       644 passed, 1 skipped
uv run --locked python -m benchmarks validate-corpus \
  --corpus docs/benchmarks/corpus.yml \
  --schema docs/benchmarks/corpus.schema.json              PASS: 50 questions
uv build                                                 PASS: sdist and wheel
Installed-wheel stdio smoke outside the checkout          4 passed
pip-audit on locked all-group/all-extra dependencies      No known vulnerabilities found
git diff --check                                         PASS

All workflows parse as YAML; workflow edits only replace dependency pins. The lock retains the same package set. Before the Certifi update, the audit reported one vulnerability; afterward it reported none.

doctor cannot pass in the default local cache because no documentation index exists there. The local corpus schema check is not a full-index retrieval run. Hosted CI subsequently passed the six Linux/macOS Python 3.12–3.14 jobs, installed-package smoke, dependency audit, Analyze and CodeQL. The full-index regression passed against 1,603 pages across Python 3.11–3.13 with the unchanged 65-case corpus. Manual MCP-client checks remain unverified. Pytest reports one class-fixture deprecation warning.

Hosted evidence: CI, Product quality, Security audit, CodeQL.

CodeRabbit review

Skipped: CodeRabbit excluded all ten changed paths; its successful status is not a substantive review. The separate Codex CLI review found no actionable regressions. The required verifier App check is blocked by infrastructure. The first attempt stopped at OpenClaw startup admission. After the full broker cooldown and a successful agent-specific session-readiness probe, one justified retry stopped on an SSH transport failure while reading the installed verifier instructions. Its incomplete command record caused command_evidence_assembly_failed; repository review and verifier product checks were not reached. The broker now records three infrastructure failures and closes further retries pending recovery. The existing standalone CLI review and green hosted CI do not replace the required App check.

Why this approach

Apply the existing Dependabot proposals together without broad dependency resolution or runtime edits. Include the additional Certifi security patch discovered by the audit; keep the breaking MCP v2 migration separate as requested.

Why this triggered supervisor review

README hero and CI/release workflow dependency pins changed; actions/cache crosses a major version. The existing cache inputs and output remain supported by the pinned v6.1.0 action. This is a user-requested maintenance PR; merging still requires independent verification and required hosted checks.

Product decision and independent evidence

• Kind: maintenance.
• Baseline → target: nine open upgrade proposals and a vulnerable Certifi lock → the proposed versions plus patched Certifi; no tool/schema or runtime source changes.
• Head: e5282048e7166653636db3b69d1e1ec5b13e6805.
• Base: e4f8b717d8b0c14c68fd3069efc64330985ab0e1.
• Independent review: Separate Codex CLI review of the exact commit found no actionable regressions and independently reran lock validation, lint, typecheck, tests (644 passed, 1 skipped), and corpus validation. It also checked the pinned action metadata and workflow compatibility; hosted execution remains pending..
• Limitations are recorded above; the user authorized merging after required checks and independent verification pass. No release is requested.

Merge danger

Door: two-way; revert this maintenance commit.
Blast radius: dependency installation and CI jobs. The README badge is served by MCPRush.

[coderabbiteu]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: ayhammouda/python-docs-mcp-server
• Branch: feat/minors-fixes
• File: .coderabbit.yaml
• Commit: e528204
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 750c1116-28ba-42e3-ae31-67f9c784d0b2

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 10

• .github/workflows/ci.yml is excluded by none and included by none
• .github/workflows/codeql.yml is excluded by none and included by none
• .github/workflows/e2e.yml is excluded by none and included by none
• .github/workflows/product-quality.yml is excluded by none and included by none
• .github/workflows/release.yml is excluded by none and included by none
• .github/workflows/scorecard.yml is excluded by none and included by none
• .github/workflows/security.yml is excluded by none and included by none
• CHANGELOG.md is excluded by none and included by none
• README.md is excluded by none and included by none
• uv.lock is excluded by !**/*.lock and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: ayhammouda/python-docs-mcp-server
• Branch: feat/minors-fixes
• File: .coderabbit.yaml
• Commit: e528204
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 42e5e18a-f9fe-403f-82e8-8fd24719c38e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}