[nklip]

Summary

Every locked package in every project moves to its newest release. Every declared floor in pyproject.toml moves with it, runtime and tooling alike, as AGENTS.md requires. All 80 locked packages now match the latest version on PyPI.

This covers everything in the three open Dependabot pull requests, at or past each version they propose, so Dependabot should close them once this merges:

Dependabot PR	Proposed	Here
#11	mcp[cli] >=2.3.0	mcp 2.3.0, floor >=2.3.0
#12	setup-uv 10.3.0	setup-uv v10.3.3 (tag resolved against the remote)
#15	fastapi 0.162.0, pydantic 2.14.1, pydantic-settings 2.16.1, websockets 17.3, httpx2 2.16.0, ruff 0.17.2, django 6.1.2, markdown 3.11.2, python-dotenv, djangorestframework 3.18.3, djoser 2.3.5	fastapi 0.162.0, pydantic 2.14.2, pydantic-settings 2.16.2, websockets 17.4, httpx2 2.16.0, ruff 0.17.3, django 6.1.2, markdown 3.11.2, python-dotenv 1.2.4 (DRF and djoser already landed in #16)

actions/checkout@v7 is a moving major tag that already points at v7.0.1, the newest release, so it stays.

Declared floors raised

• chatbot: anthropic 2.3.0, fastapi 0.162.0, pydantic 2.14.2, pydantic-settings 2.16.2, websockets 17.4, httpx2 2.16.0, pytest 9.2.0, ruff 0.17.3
• lemon: django 6.1.2, markdown 3.11.2, pytest 9.2.0, ruff 0.17.3
• mathparser: pytest 9.2.0, ruff 0.17.3
• mcp: anthropic 2.3.0, mcp[cli] 2.3.0, pydantic 2.14.2, python-dotenv 1.2.4, pytest 9.2.0, pytest-asyncio 1.4.1.post1, ruff 0.17.3

The one major: anthropic 1.9.0 → 2.3.0 (chatbot, mcp)

anthropic 2.0.0 is the first release that sends API version 2026-10-21 instead of 2023-06-01, so both projects move to the new API version. The changes follow the 2026-10-21 migration guide:

• Sampling parameters removed (mcp). 2026-10-21 rejects a Messages request that carries temperature, top_p or top_k with a 400, even at the default value. mcp's Claude.chat() sent temperature=1.0 on every request, so every chat turn would have failed. The field and the temperature parameter are removed; nothing passed it. A new test asserts that no sampling parameter goes out, and it fails with temperature put back.
• MessageParam is a union with one TypedDict per role (mcp). Annotations keep working. cli_chat.py built its dicts from a role variable, which matches none of the per-role types, so each role now gets its own literal.
• Key sent as Authorization: Bearer, one credential per client. Neither project sets a base URL, a proxy, X-Api-Key or a second credential, so nothing changes. chatbot needed no code change at all.
• License. The SDK is Apache 2.0 from 2.0.0 (MIT before). No code change; worth noting if you track dependency licenses.
• Out of scope: notebooks/ holds its own anthropic snippets outside any lock, so it isn't covered here.

Test plan

• make check from the repository root: all four projects pass (141 tests, one new), lint clean on ruff 0.17.3. lemon's tests ran against MySQL from its compose.yaml.
• uv lock --check passes in every project.
• Security re-scan of the new locks: zero advisories in both the PyPI vulnerability feed and the full GitHub-reviewed advisory database.
• Both projects ran through the real anthropic 2.3.0 client, with only the HTTP transport mocked:
  • Requests carry anthropic-version: 2026-10-21 and a bearer key, with no X-Api-Key and no sampling fields.
  • chatbot complete() returned a reply and a refusal, and mapped 401, 403, 404, 429, 500 and a connection failure exactly as before.
  • mcp's chat loop ran end to end, which no check had done before: question → tool_use → a real read from the document server over stdio → tool_result → answer, plus a /format prompt.
• chatbot under uvicorn: page and assets served, WebSocket replied.
• lemon: the browsable API's markdown rendered through markdown 3.11.2; djoser's social views and simplejwt behave as before. That includes the known single-use-state limitation of social login on social-auth-core 6.2, recorded next to the djoser dependency. Lemon doesn't use social login.
• Not run: a live request to the Claude API. No API key was available in the session that made this change. One chat turn in each app with a real key would confirm it end to end.

---

Generated by Claude Code