# Positive fixture for CVE-2026-73296: UFO pinned at 3.0.7, the release line
# before the 3.0.8 fix for the unauthenticated mobile MCP servers.
git+https://github.com/microsoft/UFO@3.0.7
mcp>=1.28.1
