**Found in:** pre-shipment review 2026-06-30 **Parent:** https://github.com/hrco/xbridge-mcp/issues/7 **File:** `pyproject.toml:28-29` `mcp>=1.0.0`, `httpx>=0.27.0` — no lockfile. A breaking upstream release could silently break production. **Recommendation:** Pin to exact versions or generate a lockfile.
Found in: pre-shipment review 2026-06-30
Parent: #7
File:
pyproject.toml:28-29mcp>=1.0.0,httpx>=0.27.0— no lockfile. A breaking upstream release could silently break production.Recommendation: Pin to exact versions or generate a lockfile.