chore: finalize v3.0.0 public release prep - #15
Merged
Conversation
Complete the v3.0.0 public-release preparation on top of the src-layout restructure: - Licensing/attribution: Apache-2.0 metadata, NOTICE, SECURITY.md, and fork attribution to upstream GH05TCREW throughout README and LICENSE. - Release flow: tag-driven release.yml (build + PyPI Trusted Publishing + GitHub Release) replacing the auto-bump-on-push workflow; add docs/RELEASING.md and MCP server.json; move pytest config into pyproject.toml. - CI: run the full pytest suite across a Python 3.10-3.13 matrix. - Docs: update all guides and the test-connection script to the new src layout and CLI (metasploit-mcp, tests/harness.py, poetry run pytest); rewrite the stale project-structure tree. - Tests: fix test_force_exploit_autocheck.py, which imported the pre-restructure top-level module and was therefore skipped in every run. It now imports metasploit_mcp.server, restoring 5 tests covering force-option validation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Run `black` (line-length 100, per pyproject) over the entire src/ and tests/ tree, which was not uniformly formatted. Mechanical changes only — no behavior change. Also make one source-text assertion in test_event_loop_monitor.py whitespace-insensitive so it survives line-wrapping by the formatter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Targeted `poetry update` of the packages flagged by Dependabot, refreshing poetry.lock to patched versions while deliberately keeping the framework stack (fastmcp 3.2.4, fastapi 0.136.1) on the versions the suite is tested against — a blanket update pulls fastmcp 3.4.2, which resolves to the broken `fastmcp-slim` variant and breaks `from fastmcp import FastMCP`. Patched: langchain-core (critical serialization advisory), starlette, python-multipart, urllib3, cryptography, requests, idna, pyjwt, msgpack, authlib, joserfc, orjson, langsmith, python-dotenv, pygments, filelock, virtualenv, black, pytest. Clears 46 of the 47 open alerts. Full suite: 370 passed, 39 skipped. The remaining alert is pymetasploit3 (GHSA-qpc3-8vqg-8g6w): the latest published release 1.0.6 has no upstream fix. It is a required runtime dependency and the command-injection path is inherent to the tool's purpose (executing operator- chosen Metasploit modules); documented as a known, accepted advisory in SECURITY.md. Also applies black 26's stable-style reformat to two test files (consequence of the black bump in this update). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the v3.0.0 public-release preparation on top of the src-layout restructure. Two commits: functional release-prep changes, then an isolated
blackreformatting pass.Release prep (
0f22077)NOTICE,SECURITY.md, and fork attribution to upstream GH05TCREW acrossREADMEandLICENSE.release.yml(build → PyPI Trusted Publishing → GitHub Release) replacing the auto-bump-on-push workflow; newdocs/RELEASING.mdand MCPserver.json; pytest config moved intopyproject.toml.scripts/test_mcp_connection.pyupdated to the new src layout and CLI (metasploit-mcp,tests/harness.py,poetry run pytest); stale project-structure tree rewritten.test_force_exploit_autocheck.pyimported the pre-restructure top-level module and was therefore skipped in every run. It now importsmetasploit_mcp.server, restoring 5 tests covering force-option validation.Reformatting (
a3e6055)black(line-length 100, perpyproject) applied across all ofsrc/andtests/(26 files). Mechanical only, kept in a separate commit for reviewability. One source-text assertion intest_event_loop_monitor.pymade whitespace-insensitive so it survives formatter line-wrapping.Verification
black --check src testsclean.Before tagging a release (not blocking this PR)
3.0.0date inCHANGELOG.md(currently2026-04-29) to the actual release date.cbdmaul/MetasploitMCP, workflowrelease.yml, environmentpypi) and a matching GitHubpypienvironment before the firstv*tag, or the publish job will fail. Seedocs/RELEASING.md.🤖 Generated with Claude Code