fix: require sdk-python 1.5.0 for tolerant response DTOs

pyproject.toml

@@ -19,11 +19,11 @@ classifiers = [
 ]
 
 dependencies = [
-    # Floor bumped to 1.3.0: first SDK release with the full
-    # `client.services` catalog resource and the extended
-    # `client.dependencies` (component-level track + alert sensitivity)
-    # that the services/dependencies tool modules call directly.
-    "devhelm>=1.4.0",
+    # Floor bumped to 1.5.0: first SDK release whose *Dto / *Response
+    # models use extra='ignore' (Postel's Law). MCP 1.4.0 + sdk-python
+    # 1.4.0 rejected additive API fields such as StatusPageDto.openIncident
+    # and StatusPageComponentDto.serviceSubscriptionId as extra_forbidden.
+    "devhelm>=1.5.0",
     "fastmcp>=3.2.3,<4",
 ]
 

tests/test_sdk_response_tolerance.py

@@ -0,0 +1,28 @@
+"""MCP inherits sdk-python's response-decoder tolerance (Postel's Law).
+
+Published MCP 1.4.0 wrapped sdk-python 1.4.0, whose response models used
+``extra='forbid'``. Additive API fields (``StatusPageDto.openIncident``,
+``StatusPageComponentDto.serviceSubscriptionId``, subscriber ``channel``)
+then crashed every matching tool with ``extra_forbidden``.
+
+This pins the floor: the installed SDK's status-page response DTOs must
+ignore unknown keys. Request models stay strict.
+"""
+
+from __future__ import annotations
+
+from devhelm._generated import (
+    CreateStatusPageRequest,
+    StatusPageComponentDto,
+    StatusPageDto,
+    StatusPageSubscriberDto,
+)
+
+
+def test_status_page_response_dtos_ignore_unknown_fields() -> None:
+    for model in (StatusPageDto, StatusPageComponentDto, StatusPageSubscriberDto):
+        assert model.model_config.get("extra") == "ignore", model.__name__
+
+
+def test_status_page_request_models_still_forbid_unknown_fields() -> None:
+    assert CreateStatusPageRequest.model_config.get("extra") == "forbid"