[Draft] Fix lowest-direct dependency tests to actually test minimum versions

[Copilot]

The run_tests_lowest_direct CI job was running uv sync --resolution lowest-direct but then executing uv run pytest, which used the committed lockfile instead of resolving to true minimum versions. This allowed code requiring py-key-value-aio>=0.2.8 to pass tests when pyproject.toml specified >=0.2.6.

Changes

• Workflow: Added --resolution lowest-direct to uv run commands in run_tests_lowest_direct job to bypass lockfile
• Dev dependencies: Pinned pre-commit, psutil, pytest-flakefinder, ruff to prevent resolution failures
• pdbpp: Bumped minimum from 0.10.3 to 0.11.7 (0.10.3 incompatible with fancycompleter in lowest-direct mode)

# Before
- name: Run tests
  run: uv run pytest --inline-snapshot=disable tests -m "not integration"

# After  
- name: Run tests
  run: uv run --resolution lowest-direct pytest --inline-snapshot=disable tests -m "not integration"

This ensures tests actually run against specified minimums (e.g., mcp==1.17.0) rather than lockfile versions (e.g., mcp==1.19.0).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.example.com
  • Triggering command: /home/REDACTED/work/fastmcp/fastmcp/.venv/bin/python -u -c import sys;exec(eval(sys.stdin.readline())) (dns block)
• astral.sh
  • Triggering command: curl -LsSf REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Fix lowest-direct dependency tests to actually test minimum versions</issue_title>
<issue_description>## Problem

The run_tests_lowest_direct CI job doesn't actually test against minimum dependency versions. It runs uv sync --resolution lowest-direct but uses the committed lockfile, which may already contain higher versions than the specified minimums.

This allowed us to specify py-key-value-aio>=0.2.6 in pyproject.toml when the code actually requires 0.2.8+ (for FernetEncryptionWrapper), because the lockfile already had 0.2.8 committed.

Solution

Update .github/workflows/run-tests.yml to use uv run --resolution lowest-direct when running pytest in the run_tests_lowest_direct job, which will ignore the lockfile and resolve to true minimum versions.

Change:

- name: Run tests (excluding integration and client_process)
  run: uv run pytest --inline-snapshot=disable tests -m "not integration and not client_process" --numprocesses auto --maxprocesses 4 --dist worksteal

- name: Run client process tests separately
  run: uv run pytest --inline-snapshot=disable tests -m "client_process" -x

To:

- name: Run tests (excluding integration and client_process)
  run: uv run --resolution lowest-direct pytest --inline-snapshot=disable tests -m "not integration and not client_process" --numprocesses auto --maxprocesses 4 --dist worksteal

- name: Run client process tests separately
  run: uv run --resolution lowest-direct pytest --inline-snapshot=disable tests -m "client_process" -x

This ensures tests actually run against the minimum specified dependency versions.

Related

• from key_value.aio.wrappers.encryption import FernetEncryptionWrapper Does not exist #2284 - Import error that would have been caught by proper lowest-direct testing</issue_description>

Comments on the Issue (you are @copilot in this section)

@jlowin note: a few unpinned dev dependencies will need to be pinned or this will break

• Fixes Fix lowest-direct dependency tests to actually test minimum versions #2290

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}