fix: remove unused requests dependency from simple-chatbot example
#1959
+0
−3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The simple-chatbot example declared requests>=2.31.0 as a dependency but never imports or uses it — the code uses httpx (via the mcp dependency) instead. This stale dependency pulled urllib3 into the lock file, which triggered three high-severity Dependabot alerts (CVE-2025-66418, CVE-2025-66471, CVE-2026-21441). None of these affect the SDK since it uses httpx/httpcore, not urllib3. Removing requests from the example eliminates urllib3 from the runtime dependency tree. It remains in the lock file only via mkdocs-material (a docs-only dev dependency).
felixweinberger
approved these changes
Jan 26, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport of #1958 to v1.x.
Summary
The
mcp-simple-chatbotexample declaredrequests>=2.31.0as a dependency but never imports or uses it — the code useshttpx(via themcpdependency) instead. This stale dependency pulledurllib3into the lock file, triggering three high-severity Dependabot alerts:Impact
None of these CVEs affect the SDK. The SDK uses
httpx, which has its own HTTP stack (httpcore→h11) and does not depend onurllib3at any point in its transitive dependency tree.Changes
requests>=2.31.0fromexamples/clients/simple-chatbot/pyproject.tomluv.lock—urllib3remains only viamkdocs-material(docs-only dev dependency)AI Disclaimer