Update dependency fastmcp to v4 - #14552
Open
renovate-bot wants to merge 1 commit into
Open
Conversation
trusted-contributions-gcf
Bot
added
the
kokoro:force-run
product-auto-label
Bot
added
the
samples
trusted-contributions-gcf
Bot
added
the
owlbot:run
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
kokoro-team
removed
the
kokoro:force-run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.4.3→==4.0.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
PrefectHQ/fastmcp (fastmcp)
v4.0.0: : Four RealCompare Source
FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.
This is the FastMCP release for the new MCP. On July 28, MCP released the
2026-07-28protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, andClient(url)does the same negotiation from the other side.The new protocol's capabilities come through FastMCP's usual high-level surfaces:
@mcp.tool(task=True)) run outside the request path via theio.modelcontextprotocol/tasksextension, shipped in the optionalfastmcp-taskspackage on the same Docket engine as FastMCP 3.add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.Mcp-Method/Mcp-Namerouting headers so gateways can route without parsing JSON-RPC.The framework grew alongside the protocol: dependency injection can bind a dependency to arguments of the call it serves (
Depends(get_account, user_id=CallArgument("owner"))) while keeping it out of the tool schema, andClientGroupmanages one client per server with collision-checked namespacing — each member negotiating its own protocol version.The beta period motivated a bunch of correctness work. Most of it was auth: hardened OAuth consent flows, issuer validation, and JWT verification, plus proxies that strip cookies and connection-owned headers at trust boundaries. The rest was durability and compatibility — encrypted task snapshots, serialized event-store writes, response caching handling empty results, errors, and versioned components, and dozens of smaller fixes from CodeMode to Python 3.14 compat.
Breaking changes: server-initiated sampling and roots are removed (no live connection exists to call back into mid-request),
ctx.elicit()is old-protocol-only, FastMCP 3's deprecated APIs are gone, MCP model fields are snake_case (with a warning compatibility bridge for the old names), and background tasks moved tofastmcp-tasks. Passing a bare string likeClient("server.py")to run local code is deprecated in favor ofPath, for removal in FastMCP 5.The upgrade guide covers every change and includes a copyable prompt for auditing an application with a coding agent.
Happy (context) engineering!
What's Changed
New Features 🎉
Breaking Changes⚠️
Enhancements ✨
valid_scopesparameter to OIDC proxy valid scopes by @Educg550 in #4660Security 🔒
Fixes 🐞
requiredorder deterministic by @Kludex in #4564Docs 📚
Dependencies 📦
Other Changes 🦾
New Contributors
Full Changelog: PrefectHQ/fastmcp@v3.4.7...v4.0.0
v3.4.7: : Know Your AudienceCompare Source
FastMCP 3.4.7 restores CIMD
private_key_jwtauthentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.What's Changed
Security 🔒
Docs 📚
Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7
v3.4.6: : Trust, but ProxyCompare Source
FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.
What's Changed
Fixes 🐞
Docs 📚
Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6
v3.4.5: : Key ChangeCompare Source
FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single
Ed25519key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — madeJWTVerifierreject every token, including ones correctly signed by supported keys in the same set.What's Changed
Fixes 🐞
Docs 📚
New Contributors
Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5
v3.4.4: : Host in TranslationCompare Source
FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.
What's Changed
Enhancements ✨
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.