Skip to content

fix(document-understanding): align OCI SDK and FastMCP dependencies - #457

Merged
gebhardtr merged 3 commits into
oracle:mainfrom
dustin-sale:codex/document-understanding-sdk-2185
Oct 1, 2026
Merged

gebhardtr merged 3 commits into
oracle:mainfrom
dustin-sale:codex/document-understanding-sdk-2185

Conversation

@dustin-sale

Copy link
Copy Markdown
Contributor

Description

Fix locked dependency sync for Document Understanding by pinning OCI SDK to
2.185.0, matching oracle-mcp-common's minimum, and requiring FastMCP

=3.4.5,<4.0.0.

Refresh vulnerable locked dependencies to address 20 Dependabot alerts:
PyJWT 2.15.1, urllib3 2.8.0, cryptography 50.0.2, and compatible
PyOpenSSL 26.4.0.

Review OCI SDK compatibility and add a test that builds extraction and
classification requests with real SDK models. Update the changelog with
dependency, security, and platform compatibility changes.

The cryptography update removes upstream support for Intel macOS and
32-bit Windows.

Type of change

  • Breaking change: dependency security updates remove upstream support
    for Intel macOS and 32-bit Windows.

How Has This Been Tested?

  • Original locked sync command succeeds.
  • 52 server tests pass with 93.99% coverage.
  • 7 FastMCP tool tests pass with minimum version 3.4.5.
  • Lock check, source/wheel build, and install check pass.
  • pip-audit reports zero known vulnerabilities across 86 packages.
  • Updated versions fall outside all 20 reported vulnerable ranges.
  • Local OCI API-key/security-token request signing and RS256 JWT
    encode/decode pass.

Tested on macOS ARM64 with Python 3.14.7, OCI SDK 2.185.0, and FastMCP
3.4.7. Live OCI requests were not run.

Checklist

  • Changes follow project style guidelines.
  • Completed self-review.
  • Updated the changelog.
  • Added SDK compatibility test coverage.
  • New and existing unit tests pass locally.

Signed-off-by: Dustin Sale <dustin.sale@oracle.com>
Signed-off-by: Dustin Sale <dustin.sale@oracle.com>
@oracle-contributor-agreement oracle-contributor-agreement Bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Oct 1, 2026
@gebhardtr
gebhardtr merged commit 52ea016 into oracle:main Oct 1, 2026
3 checks passed
@dustin-sale
dustin-sale deleted the codex/document-understanding-sdk-2185 branch October 5, 2026 17:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants