Skip to content

chore(deps): update fastmcp requirement from <3.4.5,>=3.3.1 to >=4.1.3,<4.1.4 - #557

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/fastmcp-gte-4.1.3-and-lt-4.1.4
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/fastmcp-gte-4.1.3-and-lt-4.1.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

What's Changed

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in PrefectHQ/fastmcp#5945.

Enhancements ✨

Fixes 🐞

Documentation 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.1.2...v4.1.3

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.2.0a1: Skill Issue

FastMCP 4.2's first alpha brings code-defined skills, discovery through mounted and proxied servers, and verified downloads into one workflow. Build a Skill in Python or load one from a folder or package, publish it through SkillCatalogProvider, and let clients discover its metadata or download and export its files. Proxy discovery is opt-in with skills=True. Skills support remains experimental; this prerelease is intended for integration testing. It also includes lazy, shared Prefab renderer resources and backend-addressing fixes. Migration: Skill now represents file contents; the wire metadata model is named MCPSkill. Whole-skill downloads require a standard SKILL.md with a name matching its URI and a description. Exports with overwrite=True replace the installed folder, including locally added files. Ordinary resource providers still support their existing document formats. Thanks to our 8 contributors, including 3 first-time contributors.

Breaking Changes ⚠️

  • Make Skill a storage-neutral object with folders as one loader by @​zzstoatzz in #6065

Enhancements ✨

Security 🔒

Fixes 🐞

Docs 📚

New Contributors

... (truncated)

Commits
  • aa13708 docs: add v4.1.3 changelog entries (#5948)
  • ec1a8e0 fix: require patched certifi trust stores (#5945)
  • bfe314f Preserve tool-body timeout errors (#5940)
  • 8f0d481 Honor per-server MCP config timeouts (#5758)
  • b918dd9 fix(tools): materialize generator transform_fn results in TransformedTool.run...
  • 0b1a6ba test(mount): make unreachable proxy failures deterministic (#5584)
  • 5910eb2 fix: preserve empty session visibility selections (#5944)
  • ceb465a Default upstream token auth method to none without a client secret (#5879)
  • 75ee327 Chart public backlog counts and closure outcomes (#5942)
  • 0f4674e docs: add v4.1.2 changelog entries (#5936)
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
fastmcp [>= 4.0.dev0, < 4.1]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp) to permit the latest version.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.3.1...v4.1.3)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.1.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants