Three MCP Python SDK Advisories, and the One an Upgrade Will Not Fix

On October 27, 2026, GitHub added three advisories for the MCP Python SDK (the mcp package on PyPI) to its Advisory Database, and one of them is not fixed by running pip install --upgrade. If your tea