fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx (modelcontextprotocol#1505)

Author: cclauss

.github/workflows/shared.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-          version: 0.7.2
+          version: 0.9.5
 
       - name: Install dependencies
         run: uv sync --frozen --all-extras --python 3.10
@@ -46,7 +46,7 @@ jobs:
         uses: astral-sh/setup-uv@v3
         with:
           enable-cache: true
-          version: 0.7.2
+          version: 0.9.5
 
       - name: Install the project
         run: uv sync --frozen --all-extras --python ${{ matrix.python-version }} --resolution ${{ matrix.dep-resolution }}
@@ -62,7 +62,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-          version: 0.7.2
+          version: 0.9.5
 
       - name: Install dependencies
         run: uv sync --frozen --all-extras --python 3.10

pyproject.toml

@@ -45,7 +45,7 @@ mcp = "mcp.cli:app [cli]"
 
 [tool.uv]
 default-groups = ["dev", "docs"]
-required-version = ">=0.7.2"
+required-version = ">=0.9.5"
 
 [dependency-groups]
 dev = [