The lock file contains an outdated MCP version which contains multiple CVEs. This is updated in the upstream fastmcp dependency, and needs a lock resync.
Fix:
Run uv sync on the project
Happy to PR if you accept lock update PR's from contributors
https://github.com/jlowin/fastmcp/blob/8f6850819844144a028f9a1e78c4b5cc31e771eb/examples/smart_home/uv.lock#L250
https://nvd.nist.gov/vuln/detail/CVE-2025-53365
The lock file contains an outdated MCP version which contains multiple CVEs. This is updated in the upstream fastmcp dependency, and needs a lock resync.
Fix:
Run uv sync on the project
Happy to PR if you accept lock update PR's from contributors
https://github.com/jlowin/fastmcp/blob/8f6850819844144a028f9a1e78c4b5cc31e771eb/examples/smart_home/uv.lock#L250
https://nvd.nist.gov/vuln/detail/CVE-2025-53365