chore: relax OpenAI and FastMCP dependency pins

[wey-gu]

Summary

• relax Kosong's OpenAI SDK constraint from a narrow 2.14.x pin to a recent tested 2.x range
• bump Kimi CLI's FastMCP pin from 3.2.4 to 3.3.1 and refresh the lockfile
• add changelog notes for both Kimi CLI and Kosong

Why

The current Kosong OpenAI range forces downstream apps to stay on openai 2.14.x, which was released on Dec 2025.

Verification

• uv run --package kosong --group dev pytest packages/kosong/tests/test_openai_common.py packages/kosong/tests/api_snapshot_tests/test_openai_legacy.py packages/kosong/tests/api_snapshot_tests/test_openai_responses.py packages/kosong/tests/test_kimi_stream_usage.py -q
• uv run --group dev pytest tests/core/test_create_llm.py tests/cli/test_mcp_oauth.py tests/core/test_shell_mcp_status.py tests/tools/test_mcp_tool_result.py -q
• uv run --group dev pytest tests/utils/test_pyinstaller_utils.py -q
• uv lock --check
• uv build --package kosong --wheel
• uv build --package kimi-cli --wheel

Resolved versions after the lock refresh:

• openai 2.37.0
• fastmcp 3.3.1
• kimi-cli 1.46.0
• kosong 0.53.0

---

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Bumps FastMCP to 3.3.1 in the main project and relaxes the OpenAI SDK constraint in the kosong package to allow any 2.x release, with corresponding changelog entries.

Changes:

• Upgrade fastmcp from 3.2.4 to 3.3.1.
• Relax openai constraint from <2.15.0 to <3.0.0 in kosong.
• Add changelog notes for both updates.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Bumps fastmcp dependency to 3.3.1
packages/kosong/pyproject.toml	Widens openai version range to all 2.x
CHANGELOG.md	Notes the FastMCP bump
packages/kosong/CHANGELOG.md	Notes the OpenAI dependency relaxation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.