Bump python-dotenv from 1.1.1 to 1.2.2#3114
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine dependabot lockfile bump of python-dotenv 1.1.1 → 1.2.2.
What was reviewed:
uv.lockis the only changed file; thepyproject.tomlconstraint (python-dotenv>=1.0.0, cli extra) is unchanged and satisfied by 1.2.2.- Checked the upstream breaking changes (
set_key/unset_keysymlink and file-mode behavior) against SDK usage — the SDK only callsdotenv.dotenv_values()insrc/mcp/cli/cli.py, so it is unaffected. - Upstream dropped Python 3.9, which is below this SDK's 3.10 floor, so the supported-version matrix is unaffected.
Extended reasoning...
Overview
Dependabot PR bumping python-dotenv from 1.1.1 to 1.2.2 in uv.lock only. No source code, dependency constraints, or CI configuration are modified. python-dotenv is an optional dependency of the cli extra with a >=1.0.0 floor, which 1.2.2 satisfies.
Security risks
None introduced by the SDK side of this change. The new upstream release actually tightens security posture (symlinks are no longer followed by set_key/unset_key by default). The sdist/wheel hashes in the lockfile pin the exact artifacts, so there is no supply-chain ambiguity beyond trusting PyPI's published release.
Level of scrutiny
Low. This is a mechanical lockfile update with no code changes. The main thing worth verifying was whether the upstream breaking changes affect the SDK: they are confined to set_key/unset_key and the dotenv CLI, while the SDK only uses dotenv.dotenv_values() (read-only) in src/mcp/cli/cli.py. The upstream drop of Python 3.9 support is also irrelevant since this SDK requires Python 3.10+.
Other factors
The bug hunting system found no issues, and there are no reviewer comments or prior reviews on the timeline. CI runs the full test matrix (3.10–3.14 across platforms) against the locked versions, which exercises the CLI import path. This fits squarely in the approve category: simple, mechanical, self-contained.
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from 1.1.1 to 1.2.2. - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.1.1...v1.2.2) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
c56f5b2 to
8c4f82b
Compare
There was a problem hiding this comment.
LGTM — routine Dependabot lockfile-only bump of python-dotenv 1.1.1 → 1.2.2.
What was reviewed
- Only
uv.lockchanges; thepython-dotenv>=1.0.0constraint (cli extra) already allows 1.2.2, so nopyproject.tomlchange is needed. - Checked the 1.2.x breaking changes (
set_key/unset_keysymlink and file-mode behavior) against SDK usage — the SDK only callsdotenv.dotenv_values(), which is unaffected. - 1.2.2 drops Python 3.9, which is below this repo's 3.10 floor, so the support matrix is unaffected.
Extended reasoning...
Overview
This is a Dependabot PR that bumps python-dotenv from 1.1.1 to 1.2.2 in uv.lock only. No source code, pyproject.toml, or CI configuration is touched. The dependency is an optional one, pulled in via the cli extra with constraint python-dotenv>=1.0.0, which 1.2.2 satisfies.
Security risks
None specific to this change. The lockfile entry pins new sdist/wheel URLs and SHA-256 hashes from PyPI, which uv verifies at install time. The upstream 1.2.2 release actually tightens security-relevant behavior (no longer following symlinks in set_key/unset_key), but the SDK does not use those APIs.
Level of scrutiny
Low. This is a mechanical lockfile bump of an optional CLI dependency. The only compatibility concerns in the 1.1.1 → 1.2.2 range are the set_key/unset_key symlink/file-mode breaking changes and the Python 3.9 support drop. I grepped the SDK: the only usage is dotenv.dotenv_values() in src/mcp/cli/cli.py (guarded by an optional import), which is unaffected. The repo's minimum Python is 3.10, so the 3.9 drop is irrelevant.
Other factors
The bug hunting system found no issues, and there are no prior reviews or unresolved comments on the PR. CI runs the test matrix against the locked resolution, which exercises the CLI path. The repo's guideline about not raising dependency floors for CVEs is not implicated — the >=1.0.0 floor is unchanged; only the locked resolution moves.
Bumps python-dotenv from 1.1.1 to 1.2.2.
Release notes
Sourced from python-dotenv's releases.
... (truncated)
Changelog
Sourced from python-dotenv's changelog.
Commits
36004e0Bump version: 1.2.1 → 1.2.2eb20252docs: update changelog for v1.2.2790c5c0Merge commit from fork43340daRemove the use ofshin tests (#612)09d7ceedocs: clarify override behavior and document FIFO support (#610)c8de288ci: improve workflow efficiency with best practices (#609)7bd9e3dAdd Windows testing to CI (#604)1baaf04Drop Python 3.9 support and update to PyPy 3.11 (#608)4a22cf8ci: enable testing on Python 3.14t (free-threaded) (#588)e2e8e77Fix license specifier (#597)