Skip to content

Bump fastmcp from 3.1.1 to 3.4.2 in /app - #3

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/app/fastmcp-3.4.2
Closed

Bump fastmcp from 3.1.1 to 3.4.2 in /app#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/app/fastmcp-3.4.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 24, 2026

Copy link
Copy Markdown

Bumps fastmcp from 3.1.1 to 3.4.2.

Release notes

Sourced from fastmcp's releases.

v3.4.2: Heads Up

FastMCP 3.4.2 restores JWT compatibility for providers that include private, non-critical JWS header parameters. Tokens from providers like Clerk can carry header metadata such as cat without being rejected before signature and claim validation, while unsupported critical headers are still rejected.

What's Changed

Fixes 🐞

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.1...v3.4.2

v3.4.1: Floor It

FastMCP 3.4.1 floors Starlette at >=1.0.1 so installs can no longer resolve to a version affected by CVE-2026-48710 — previously the dependency was only constrained transitively through mcp, which allowed vulnerable versions. It also makes OAuthProxy log refresh-token cache misses instead of failing silently.

What's Changed

Enhancements ✨

Security 🔒

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.0...v3.4.1

v3.4.0: Remote Control

FastMCP 3.4 is about reaching servers that live somewhere else. The headline is fastmcp-remote, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, this release hardens the proxy layer those remote connections depend on — making bridges fail loudly instead of silently, and keeping authenticated sessions alive across the long idle periods that remote clients are prone to.

fastmcp-remote

Some MCP hosts still insist on launching a local stdio command, even when the server you want is already running over HTTP. FastMCP could already proxy a remote URL through fastmcp run, but that pulls in the full server-runner surface. fastmcp-remote is the small, single-purpose version: one URL in, one local stdio proxy out.

{
  "mcpServers": {
    "linear": {
      "command": "uvx",
      "args": ["fastmcp-remote", "https://mcp.linear.app/mcp"]
    }
  }
}

OAuth is enabled automatically for HTTPS servers, with support for explicit bearer tokens and custom headers when you need them. The implementation stays on FastMCP primitives — Client, OAuth, create_proxy, and stdio — and credits the original npm mcp-remote project for the command shape.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump fastmcp from 3.1.1 to 3.4.2 in /app
bc3bf5f 
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.1.1 to 3.4.2.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.1.1...v3.4.2)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Author

Superseded by #15.

@dependabot dependabot Bot closed this Jul 8, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/app/fastmcp-3.4.2 branch July 8, 2026 20:05
calreynolds pushed a commit that referenced this pull request Jul 27, 2026
Quentin Ambard
Arch diagram: extract Canvas hooks + stop per-node data churn
6c0217c 
Phase 3 of the review follow-up. Canvas.tsx 1098→827 lines.

Hooks (platform-diagram/hooks/):
  - use-diagram-history: undo/redo + burst snapshots; owns all history
    refs internally (breaks the scheduleSave↔restore cycle via an
    internal ref + setScheduleSave) so Canvas needs none.
  - use-node-mutations: onResize/onRename/onAnnotate (the three
    setNodesRef/scheduleSaveRef/edgesRef hacks now live inside the hook).
  - use-edge-mutations: every edge mutator incl. setEdgeCenterX, so
    edgeOps gets it directly (no setEdgeCenterXRef).
  - use-paste-image: Ctrl/Cmd+V paste (takes addAnnotation as an arg, no
    addAnnotationRef).

All 8 use-before-define refs removed from Canvas (5 gone entirely, 3
encapsulated in use-node-mutations).

Perf (review finding #3): the effect that rewrote EVERY node's data
object on each selection/editMode change is deleted. `selected` now
comes only from ReactFlow's NodeProp (removed from data + schemaToFlow),
editMode flows via a new EditModeContext, draggability via the
<ReactFlow nodesDraggable> prop. Node data identity stays stable across
selection/mode changes → React.memo holds.

tsc + bun build clean. Verified live before commit: render, select
(grips + ring), View/Edit toggle hides/shows grips, real drag enables
Undo. (A backend dev-server 500 later blocked further UI checks — env
issue, unrelated to this frontend-only change.)

Co-authored-by: Isaac
calreynolds pushed a commit that referenced this pull request Jul 27, 2026
Quentin Ambard
Arch diagram: performance pass (review findings #1, #3-ish, #4, #5)
82962e6 
- Particle/flow edges (biggest win): key EdgeFlow by edge id, not path,
  so a drag/resize updates the `path` attribute instead of unmounting +
  remounting the whole SMIL subtree every frame. Cut particle count
  22→8. Suppress the animation entirely below 35% zoom (glyphs are
  sub-pixel there) via a primitive useStore(transform[2]) gate; the base
  line carries the edge. Total animated SVG elements ~halved.
- Stabilise edgeOps (review #5): nodeRect/nodeAt/portsOf now read nodes
  from a nodesRef ([] deps) instead of closing over the live array, and
  use-edge-mutations takes nodesRef too — so the EdgeOpsContext value no
  longer churns every drag frame (was re-rendering every FlowEdge).
- Memoise componentLookup(schema) once (review #4): the render-path
  `selected` lookup + the add/change-type callbacks reused it, rebuilding
  the whole catalog Map per frame.
- Folded in nodeAt z-order tie-break (review nit): hit-test picks the
  topmost node by zIndex, not array order.

O(E^2) fan-out hoist (review #2) left as documented backlog — negligible
at the diagram's realistic edge counts and a riskier refactor.

tsc + build clean. Verified live: 8 particles, dot=1 motion, zoom-out
drops all flow then restores on zoom-in, no new console errors.

Co-authored-by: Isaac
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants