From e9ae7a03ec29666609921bbb36dc2e0882a0d750 Mon Sep 17 00:00:00 2001 From: Andrey Fedorov Date: Thu, 1 Oct 2026 11:04:32 -0400 Subject: [PATCH 1/4] chore(release): 3.0.0b4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump-and-curate commit for the release, per dev/deployment.md § Cutting a release. Ships the dependency security updates (PyJWT CVE-2026-102274). Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 11 ++++++++++- pyproject.toml | 2 +- uv.lock | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cff056d..7e11ed4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,14 @@ Refactors, CI, and formatting land in the git history, not here. ## [Unreleased] +## [3.0.0b4] — 2026-10-01 + +Security-maintenance release; no API or MCP contract changes. + +### Security + +- Dependency updates, including PyJWT 2.13.0 → 2.15.1 (CVE-2026-102274). + ## [3.0.0b3] — 2026-08-10 Beta iteration: one shape for every cohort filter, and no request that silently answers with the @@ -109,7 +117,8 @@ served by a different backend and v3 lives only under `/v3/*`. (NCI security policy). Max-age is configurable via `IDC_API_HSTS_MAX_AGE` — default one year; dev/test deploys use 3600. -[Unreleased]: https://github.com/ImagingDataCommons/IDC-REST-MCP/compare/v3.0.0b3...HEAD +[Unreleased]: https://github.com/ImagingDataCommons/IDC-REST-MCP/compare/v3.0.0b4...HEAD +[3.0.0b4]: https://github.com/ImagingDataCommons/IDC-REST-MCP/compare/v3.0.0b3...v3.0.0b4 [3.0.0b3]: https://github.com/ImagingDataCommons/IDC-REST-MCP/compare/v3.0.0b2...v3.0.0b3 [3.0.0b2]: https://github.com/ImagingDataCommons/IDC-REST-MCP/compare/v3.0.0b1...v3.0.0b2 [3.0.0b1]: https://github.com/ImagingDataCommons/IDC-REST-MCP/releases/tag/v3.0.0b1 diff --git a/pyproject.toml b/pyproject.toml index cdcde15..b234177 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "idc-api" -version = "3.0.0b3" +version = "3.0.0b4" description = "LLM-first REST API and MCP server for NCI Imaging Data Commons, backed by idc-index Parquet + DuckDB." readme = "README.md" requires-python = ">=3.11" diff --git a/uv.lock b/uv.lock index 2e8726a..e59e989 100644 --- a/uv.lock +++ b/uv.lock @@ -513,7 +513,7 @@ wheels = [ [[package]] name = "idc-api" -version = "3.0.0b3" +version = "3.0.0b4" source = { editable = "." } dependencies = [ { name = "duckdb" }, From 50a6dac82ea55622396fa7891a4f8d363b656ae1 Mon Sep 17 00:00:00 2001 From: Andrey Fedorov Date: Thu, 1 Oct 2026 11:06:54 -0400 Subject: [PATCH 2/4] fix(deps): bump urllib3 2.7.0 -> 2.8.0 (CVE-2026-97687/97688/97689) Fixes the pip-audit failure on the release PR. Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 3 ++- uv.lock | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e11ed4..168198b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,7 +19,8 @@ Security-maintenance release; no API or MCP contract changes. ### Security -- Dependency updates, including PyJWT 2.13.0 → 2.15.1 (CVE-2026-102274). +- Dependency updates for known vulnerabilities: PyJWT 2.13.0 → 2.15.1 (CVE-2026-102274) and + urllib3 2.7.0 → 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689). ## [3.0.0b3] — 2026-08-10 diff --git a/uv.lock b/uv.lock index e59e989..fbf82b9 100644 --- a/uv.lock +++ b/uv.lock @@ -1745,11 +1745,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.7.0" +version = "2.8.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, + { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" }, ] [[package]] From 79751e327ce13aa62f507e94baf8f7f4f24070b7 Mon Sep 17 00:00:00 2001 From: Andrey Fedorov Date: Thu, 1 Oct 2026 11:08:11 -0400 Subject: [PATCH 3/4] docs(changelog): note runtime dependency refreshes in 3.0.0b4 Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 168198b..2ba56b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,7 +20,8 @@ Security-maintenance release; no API or MCP contract changes. ### Security - Dependency updates for known vulnerabilities: PyJWT 2.13.0 → 2.15.1 (CVE-2026-102274) and - urllib3 2.7.0 → 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689). + urllib3 2.7.0 → 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689). Also refreshed: MCP SDK + 1.29 → 1.30, pydantic 2.13.5, pyarrow 25.0.1. ## [3.0.0b3] — 2026-08-10 From db09ee0071abdf4c9262e2df97ef23f8659146a0 Mon Sep 17 00:00:00 2001 From: Andrey Fedorov Date: Thu, 1 Oct 2026 11:09:39 -0400 Subject: [PATCH 4/4] docs(changelog): mention anyio refresh in 3.0.0b4 Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ba56b4..d043576 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,7 +21,7 @@ Security-maintenance release; no API or MCP contract changes. - Dependency updates for known vulnerabilities: PyJWT 2.13.0 → 2.15.1 (CVE-2026-102274) and urllib3 2.7.0 → 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689). Also refreshed: MCP SDK - 1.29 → 1.30, pydantic 2.13.5, pyarrow 25.0.1. + 1.29 → 1.30, anyio 4.14.2, pydantic 2.13.5, pyarrow 25.0.1. ## [3.0.0b3] — 2026-08-10