Skip to content

Repository navigation

fix(deps): update dependency fastmcp to v4 - autoclosed - #721

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fastmcp-4.x
Closed

fix(deps): update dependency fastmcp to v4 - autoclosed#721
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fastmcp-4.x

Conversation

@renovate

@renovate renovate Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fastmcp >=3.2.0,<4 → >=3.2.0,<5 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

PrefectHQ/fastmcp (fastmcp)

v4.1.0: : Fourth and One

Compare Source

FastMCP 4.1.0 is a maintenance release at heart: a broad sweep of fixes across OpenAPI, proxies, auth, tasks, and the CLI, plus full Python 3.15 support. It doesn't change how most servers behave. A few security fixes do tighten inputs that FastMCP previously accepted, though, and our versioning policy keeps breaking changes out of patch releases, so this ships as a point-one release.

Check these before upgrading:

  • MultiAuth now qualifies client IDs by source, so existing MultiAuth sessions and tasks start new ownership scopes. Finish pending tasks before upgrading.
  • Regex tool search uses Pydantic's regex engine, which doesn't support lookarounds or backreferences.
  • Skill files must resolve inside their configured directories.
  • OpenAPI path parameters reject . and .. segments.
  • HTTP sessions now expire after the MCP SDK's 30-minute idle default instead of never.
  • CodeMode requires Monty 1.1, which renames max_duration_secs to max_feed_duration_secs.

Thanks to our 48 contributors, including 21 first-time contributors!

What's Changed

Breaking Changes ⚠️
Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Examples & Contrib 💡
Dependencies 📦

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.11...v4.1.0

v4.0.11: : Fort Knocks

Compare Source

This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 10 contributors, including 6 first-time contributors.

What's Changed

Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.10...v4.0.11

v4.0.10: : Inside Job

Compare Source

Task-enabled tools now work behind search transforms and CodeMode: they're registered with the task backend even when hidden, and a tool, resource, or prompt that calls one through ctx.fastmcp.call_tool() (including the search call_tool proxy and CodeMode's execute) now gets its result instead of an empty task receipt.

What's Changed

Fixes 🐞
Docs 📚
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.9...v4.0.10

v4.0.9: : Cache and Release

Compare Source

ResourceTemplate now keeps its compiled URI pattern for its own lifetime while
the shared cache is bounded again, preventing dynamic proxies from growing
process memory without restoring the 4,096-template performance cliff.

What's Changed

Fixes 🐞
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.8...v4.0.9

v4.0.8: : Take Three

Compare Source

Completion goes back to its 4.0.5 behavior. The visibility check added in 4.0.6 and reworked in 4.0.7 simulated list requests through middleware, and in 4.0.7 that could let a response cache serve hidden prompts to other clients. New tests pin both problems, and withholding suggestions for hidden references will return with a proper design. Resource template patterns are now cached without a size limit, so servers with thousands of templates read fast again, and OAuthProxy revokes the upstream refresh token instead of sending its own token upstream.

What's Changed

Security 🔒
Fixes 🐞
Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.7...v4.0.8

v4.0.7: : Double Take

Compare Source

Fixes two regressions from 4.0.6. The completion visibility check runs only the list-specific middleware hooks, so rate limits, logging, and metrics see a single request per completion again. Resource template patterns are cached, which makes template reads faster than in 4.0.5.

What's Changed

Fixes 🐞
Docs 📚

Full Changelog: PrefectHQ/fastmcp@v4.0.6...v4.0.7

v4.0.6: : Comma Chameleon

Compare Source

Resource templates now match what clients actually send: literals raw or percent-encoded, and list query parameters exploded or comma-joined. A Client whose exit is cancelled releases its session instead of leaking it, completion no longer answers for prompts and templates the caller can't see, and JSON schemas with float or oversized length limits load instead of failing. The auth fixes cache OIDC discovery and keep Google tokens out of request URLs.

What's Changed

Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.5...v4.0.6

v4.0.5: : No Country for Loose Ints

Compare Source

Tool parameters declared strict with Field(strict=True), StrictInt, or a strict model config are honored again, on both direct calls and task submission. Since the SDK v2 migration the server's lax default overrode them and silently coerced values.

What's Changed
Security 🔒
  • Add regression test for the unconfigured ID-JAG guard by [

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 05:59 AM (* 0-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 14, 2026 23:11
@renovate renovate Bot added bot Automated pull requests or issues dependencies Pull requests that update a dependency file renovate Pull requests from Renovate skip:codecov Skip Codecov reporting and check skip:test:long_running Skip long-running tests (≥5min) labels Sep 14, 2026
@renovate

renovate Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml
Artifact update for fastmcp resolved to version 4.1.3, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 4.1.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 3 times, most recently from 0bcd2ea to 817595c Compare September 22, 2026 12:38
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from eb187a3 to be1168b Compare September 30, 2026 02:03
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from 2edfa7f to d3c789d Compare October 7, 2026 23:19
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from cbc20d2 to cb7eefc Compare October 13, 2026 13:51
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from 5d9c551 to dfd4dc4 Compare October 20, 2026 10:04
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch from dfd4dc4 to cb86d59 Compare October 23, 2026 02:51
@sonarqubecloud

sonarqubecloud Bot commented Oct 23, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot changed the title fix(deps): update dependency fastmcp to v4 fix(deps): update dependency fastmcp to v4 - autoclosed Oct 24, 2026
@renovate renovate Bot closed this Oct 24, 2026
@renovate
renovate Bot deleted the renovate/fastmcp-4.x branch October 24, 2026 02:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bot Automated pull requests or issues dependencies Pull requests that update a dependency file renovate Pull requests from Renovate skip:codecov Skip Codecov reporting and check skip:test:long_running Skip long-running tests (≥5min)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants