uv.lock had not moved for most runtime dependencies since mid-2025, so
the `locked` CI leg was certifying anyio 4.10 / starlette 0.49 /
uvicorn 0.35 / pyjwt 2.10 while a fresh install of the SDK gets
releases a year newer. Re-resolve the runtime closure of mcp[cli,rich]
(the same set the dependency canary floats) to current versions; test
and docs tooling are left where they were for Dependabot to move.
Every bumped version is at least two weeks old.
Newer stubs need three typing adjustments, none of which change
behaviour: anyio 4.12+ types `TaskGroup.start_soon` as taking a
coroutine function (which it always required at runtime), so `_spawn`
and `_contained_notify` say so; Starlette 0.52 made `Request` generic
over its state type, so the one test that reads request attributes
pins the parameter; and `start_soon` now returns a handle, so a test
callback that must return None wraps it.
Max Isbey
0be8852f45