Merge branch 'main' into add/public-docs

mirnawong1 · web-flow · commit 404d61e05d73 · 2026-03-05T16:08:56.000Z
diff --git a/.changes/unreleased/Under the Hood-20260303-071210.yaml b/.changes/unreleased/Under the Hood-20260303-071210.yaml
@@ -0,0 +1,3 @@
+kind: Under the Hood
+body: Add dependabot YML config
+time: 2026-03-03T07:12:10.394855-08:00
diff --git a/.changes/unreleased/Under the Hood-20260303-194726.yaml b/.changes/unreleased/Under the Hood-20260303-194726.yaml
@@ -0,0 +1,3 @@
+kind: Under the Hood
+body: Loosen version pin to dbt-protos>=1.0.431
+time: 2026-03-03T19:47:26.544664-08:00
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    # Ignore version update PRs - security updates remain active
+    open-pull-requests-limit: 0
+    exclude-paths:
+      - "examples/**"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/ui"
+    # Ignore version update PRs - security updates remain active
+    open-pull-requests-limit: 0
+    schedule:
+      interval: "weekly"
diff --git a/README.md b/README.md
@@ -104,6 +104,10 @@ The dbt MCP server architecture allows for your agent to connect to a variety of
 
 Commonly, you will connect the dbt MCP server to an agent product like Claude or Cursor. However, if you are interested in creating your own agent, check out [the examples directory](https://github.com/dbt-labs/dbt-mcp/tree/main/examples) for how to get started.
 
+## Dependencies
+
+Dependencies are pinned to specific versions and are not updated automatically. Only security-related dependency updates are submitted via automated pull requests.
+
 ## Contributing
 
 Read `CONTRIBUTING.md` for instructions on how to get involved!
diff --git a/pyproject.toml b/pyproject.toml
@@ -28,8 +28,8 @@ classifiers = [
   "Typing :: Typed",
 ]
 dependencies = [
-  "authlib==1.6.6",
-  "dbt-protos==1.0.382",
+  "authlib==1.6.7",
+  "dbt-protos>=1.0.431",
   "dbt-sl-sdk[sync]>=0.13.2",
   "dbtlabs-vortex==0.2.0",
   "fastapi>=0.116.1",
diff --git a/uv.lock b/uv.lock

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+kind: Under the Hood`
	`2`	`+body: Add dependabot YML config`
	`3`	`+time: 2026-03-03T07:12:10.394855-08:00`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+kind: Under the Hood`
	`2`	`+body: Loosen version pin to dbt-protos>=1.0.431`
	`3`	`+time: 2026-03-03T19:47:26.544664-08:00`