fix: [AI-0000] relax mcp pin to >=1.9.0,<2.0.0 (release 0.3.1)

[kulvirgit]

What

Relax the mcp dependency pin from ~=1.9.0 (i.e. >=1.9.0,<1.10.0) to >=1.9.0,<2.0.0, and release as 0.3.1.

Why

The <1.10.0 upper cap blocks downstream consumers (e.g. altimate-backend) from upgrading claude-agent-sdk to 0.2.x, which requires mcp>=1.23.0. datapilot only uses the stable mcp client API — ClientSession, StdioServerParameters, stdio_client — which is unchanged across mcp 1.x, so the tight upper bound is unnecessary. With the range widened, downstream resolvers pick the latest mcp (currently 1.28.1) on py3.10+, while py3.8/3.9 standalone installs still resolve to an older valid mcp 1.x.

Changes

• setup.py: mcp~=1.9.0 → mcp>=1.9.0,<2.0.0 (sqlglot untouched — stays sqlglot[c]==30.7.0)
• Version bump 0.3.0 → 0.3.1 across the 4 bump2version-tracked files
• CHANGELOG.rst: add 0.3.1 entry

Verification

Locked + installed the downstream chain in altimate-backend against the relaxed pin: resolves to mcp 1.28.1 + claude-agent-sdk 0.2.110; datapilot's mcp client imports work on mcp 1.28.1; 890 claude_code backend tests pass.

The version-bump label is set so merge auto-tags v0.3.1 and publishes to PyPI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W3g8dnag4tFQ6EfPRSMFwQ

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (5 files)

• .bumpversion.cfg
• CHANGELOG.rst
• docs/conf.py
• setup.py
• src/datapilot/__init__.py

Notes: The substantive change is the mcp dependency pin relaxation in setup.py (~=1.9.0 → >=1.9.0,<2.0.0). The <2.0.0 upper bound correctly preserves SemVer protection against a potential breaking 2.x release while unblocking downstream consumers. Verified datapilot consumes only the stable mcp client API (ClientSession, StdioServerParameters, stdio_client, session.initialize(), session.list_tools()) in src/datapilot/core/mcp_utils/mcp.py, consistent with the PR's compatibility rationale. The version bump 0.3.0 → 0.3.1 is consistent across all 4 bump2version-tracked files, python_requires=">=3.8" aligns with the py3.8/3.9 fallback rationale, and the CHANGELOG.rst 0.3.1 (2026-07-01) entry is well-formed with a correct date.

Previous Review Summary (commit eef730a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit eef730a)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (5 files)

• .bumpversion.cfg
• CHANGELOG.rst
• docs/conf.py
• setup.py
• src/datapilot/__init__.py

Notes: The substantive change is the mcp dependency pin relaxation in setup.py (~=1.9.0 → >=1.9.0,<2.0.0). Verified that datapilot only consumes the stable mcp client API (ClientSession, StdioServerParameters, stdio_client, session.initialize(), session.list_tools()) in src/datapilot/core/mcp_utils/mcp.py, consistent with the PR's compatibility rationale. The version bump to 0.2.4 is consistent across all 4 bump2version-tracked files, and the CHANGELOG.rst entry is well-formed.

---

_{Reviewed by glm-5.2 · Input: 32.1K · Output: 5.4K · Cached: 226.8K}

[kulvirgit]

⚠️ DO NOT MERGE TO main. This is a backport of the mcp pin relaxation onto the 0.2.x line (based on v0.2.3, keeps sqlglot~=25.30.0) so that altimate-backend can adopt it without the sqlglot 30.7.0 major bump that main (0.3.0) carries.

Merging this into main would revert main's sqlglot[c]==30.7.0 and lower current_version 0.3.0→0.2.4. The version-bump label has been removed and the PR set to draft to prevent accidental auto-publish + main clobber.

Release path: publish 0.2.4 out-of-band from this branch via ./release.sh (needs PYPI_API_TOKEN), no main merge. This PR stays open only as the review surface for the diff.

Separately, the pin relaxation should also land on main as a 0.3.1 (keeping sqlglot 30.7.0) so the 0.3.x line isn't stuck on mcp<1.10 — tracked as a follow-up.

[kulvirgit]

✅ Rebased onto main — the earlier do-not-merge note is obsolete. This is now the main-line fix: base 0.3.0, keeps sqlglot[c]==30.7.0, bumps to 0.3.1. Merge auto-publishes v0.3.1 to PyPI via the version-bump label.