fix(deps): raise mcp floor past session-auth and websocket advisories

mcp 1.26.0 has GHSA-hvrp-rf83-w775 and GHSA-jpw9-pfvf-9f58 (fixed in
1.27.2) plus GHSA-vj7q-gjh5-988w (fixed in 1.28.1); the ~=1.26.0 pin
blocked all three patches. Raise to >=1.28.1,<2 (locks 1.28.1) and
extend the pin guardrail tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/crewai/pyproject.toml

@@ -40,7 +40,7 @@ dependencies = [
     "portalocker~=2.7.0",
     "pydantic-settings>=2.10.1,<3",
     "httpx~=0.28.1",
-    "mcp~=1.26.0",
+    "mcp>=1.28.1,<2",
     "aiosqlite~=0.21.0",
     "pyyaml~=6.0",
     "aiofiles~=24.1.0",

lib/crewai/tests/security/test_dependency_pins.py

@@ -25,6 +25,27 @@ def _get_requirement(name: str) -> Requirement:
     raise AssertionError(f"{name} not found in [project.dependencies]")
 
 
+class TestMcpPin:
+    """GHSA-hvrp-rf83-w775 / GHSA-jpw9-pfvf-9f58 (fixed in mcp 1.27.2) and
+    GHSA-vj7q-gjh5-988w (fixed in 1.28.1): session/task-handler auth gaps and
+    missing WebSocket Host/Origin validation in the MCP Python SDK. A
+    compatible-release pin on 1.26.x blocks all three patches."""
+
+    def test_requirement_excludes_vulnerable_range(self) -> None:
+        requirement = _get_requirement("mcp")
+        for vulnerable in ("1.26.0", "1.27.2", "1.28.0"):
+            assert not requirement.specifier.contains(vulnerable), (
+                f"mcp requirement '{requirement}' admits {vulnerable}, which "
+                "is vulnerable to GHSA-vj7q-gjh5-988w (fixed in 1.28.1)"
+            )
+
+    def test_requirement_admits_patched_releases(self) -> None:
+        requirement = _get_requirement("mcp")
+        assert requirement.specifier.contains("1.28.1"), (
+            f"mcp requirement '{requirement}' blocks patched version 1.28.1"
+        )
+
+
 class TestJsonRepairPin:
     """GHSA-xf7x-x43h-rpqh: json-repair < 0.60.1 has an unbounded-CPU DoS on
     circular JSON Schema $ref structures. crewai feeds LLM output to