René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Pin `httpx\u003c1.0` (or similar upper bound) — `pip install --pre` resolves `httpx 1.0.dev3` and breaks `httpx-sse`","articleBody":"## Problem\n\n`mcp 1.27.0`'s declared dep is `httpx\u003e=0.27.1` with no upper bound. When a downstream package is alpha (and so its users `pip install --pre`), pip's resolver picks `httpx 1.0.dev3` — a real published pre-release on PyPI — which breaks `httpx-sse` and the MCP transport layer.\n\n## Reproduction\n\n```bash\npython -m venv /tmp/repro \u0026\u0026 source /tmp/repro/bin/activate\npip install --pre 'mcp==1.27.0'\npip show httpx | grep Version\n# Version: 1.0.dev3\npython -c \"from mcp.client.stdio import stdio_client\"\n# (depending on httpx_sse version, this either raises or silently mis-routes SSE)\n```\n\nThe path: `--pre` makes `httpx 1.0.dev*` eligible → pip picks the highest matching version → `httpx-sse 0.4.x` (mcp's own dep at `httpx-sse\u003e=0.4`) is incompatible with httpx 1.x's API changes.\n\n## Evidence\n\nPyPI [confirms `httpx 1.0.dev1`, `1.0.dev2`, `1.0.dev3`](https://pypi.org/project/httpx/#history) are real published pre-releases. They show up automatically under `--pre`.\n\n`mcp`'s [pyproject.toml](https://github.com/modelcontextprotocol/python-sdk/blob/main/pyproject.toml) currently declares:\n```toml\n\"httpx\u003e=0.27.1\",\n\"httpx-sse\u003e=0.4\",\n```\n\nNo upper bound on either.\n\n## Why this matters for downstream\n\nAnyone shipping an alpha or beta library on top of mcp instructs their users to `pip install --pre \u003clibrary\u003e`. That `--pre` flag propagates through pip's resolution to all transitive deps. So every alpha-stage MCP server hits this in production user environments.\n\nWe caught this in the pre-publish smoke for [simdrive 1.0.0a4](https://pypi.org/project/simdrive/1.0.0a4/) and shipped a defensive `httpx\u003c1.0` pin in our own deps in [1.0.0a5](https://pypi.org/project/simdrive/1.0.0a5/). It works, but every downstream library having to do this independently is the wrong fix.\n\n## Proposed fix\n\nAdd an upper bound to mcp's own `httpx` constraint. Two reasonable options:\n\n```toml\n# Option A — strict, breaks at any 1.x:\n\"httpx\u003e=0.27.1,\u003c1.0\",\n\n# Option B — accommodate when httpx-sse adds 1.x support:\n\"httpx\u003e=0.27.1,\u003c2.0\",\n```\n\nOption A is safer until `httpx-sse` ships explicit httpx 1.x support; option B is forward-leaning. Either is better than the current unbounded constraint.\n\nSame treatment for `httpx-sse\u003e=0.4` would also be defensive (e.g., `httpx-sse\u003e=0.4,\u003c1.0`).\n\n## Removal trigger\n\nOnce mcp adds the bound, downstream defensive pins (like simdrive's) can be dropped in a future release.\n\nHappy to send a PR if a maintainer confirms which bound is preferred.","author":{"url":"https://github.com/SyncTekLLC","@type":"Person","name":"SyncTekLLC"},"datePublished":"2026-05-05T03:13:44.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/2543/python-sdk/issues/2543"}