Skip to content

Repository navigation

fix(deps): update dependency fastmcp to v4 - #721

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fastmcp-4.x
Open

fix(deps): update dependency fastmcp to v4#721
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fastmcp-4.x

Conversation

@renovate

@renovate renovate Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fastmcp >=3.2.0,<4 → >=3.2.0,<5 age confidence

Release Notes

PrefectHQ/fastmcp (fastmcp)

v4.0.10: : Inside Job

Compare Source

Task-enabled tools now work behind search transforms and CodeMode: they're registered with the task backend even when hidden, and a tool, resource, or prompt that calls one through ctx.fastmcp.call_tool() (including the search call_tool proxy and CodeMode's execute) now gets its result instead of an empty task receipt.

What's Changed

Fixes 🐞
Docs 📚
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.9...v4.0.10

v4.0.9: : Cache and Release

Compare Source

ResourceTemplate now keeps its compiled URI pattern for its own lifetime while
the shared cache is bounded again, preventing dynamic proxies from growing
process memory without restoring the 4,096-template performance cliff.

What's Changed

Fixes 🐞
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.8...v4.0.9

v4.0.8: : Take Three

Compare Source

Completion goes back to its 4.0.5 behavior. The visibility check added in 4.0.6 and reworked in 4.0.7 simulated list requests through middleware, and in 4.0.7 that could let a response cache serve hidden prompts to other clients. New tests pin both problems, and withholding suggestions for hidden references will return with a proper design. Resource template patterns are now cached without a size limit, so servers with thousands of templates read fast again, and OAuthProxy revokes the upstream refresh token instead of sending its own token upstream.

What's Changed

Security 🔒
Fixes 🐞
Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.7...v4.0.8

v4.0.7: : Double Take

Compare Source

Fixes two regressions from 4.0.6. The completion visibility check runs only the list-specific middleware hooks, so rate limits, logging, and metrics see a single request per completion again. Resource template patterns are cached, which makes template reads faster than in 4.0.5.

What's Changed

Fixes 🐞
Docs 📚

Full Changelog: PrefectHQ/fastmcp@v4.0.6...v4.0.7

v4.0.6: : Comma Chameleon

Compare Source

Resource templates now match what clients actually send: literals raw or percent-encoded, and list query parameters exploded or comma-joined. A Client whose exit is cancelled releases its session instead of leaking it, completion no longer answers for prompts and templates the caller can't see, and JSON schemas with float or oversized length limits load instead of failing. The auth fixes cache OIDC discovery and keep Google tokens out of request URLs.

What's Changed

Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.5...v4.0.6

v4.0.5: : No Country for Loose Ints

Compare Source

Tool parameters declared strict with Field(strict=True), StrictInt, or a strict model config are honored again, on both direct calls and task submission. Since the SDK v2 migration the server's lax default overrode them and silently coerced values.

What's Changed

Security 🔒
Fixes 🐞
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.4...v4.0.5

v4.0.4: : Here Be No Dragons

Compare Source

OpenAPI request bodies get most of the attention in this patch: multipart string arrays are sent as repeated fields, whole-body arguments no longer clobber same-named HTTP parameters, dictionary bodies and raw content types survive intact, and JSON scalar bodies are encoded. On the auth side, OAuthProxy rejects ID-JAG tokens unless identity assertion is configured and refuses non-positive upstream token expiries. Clients now follow empty pagination cursors and servers reject malformed ones.

What's Changed

Enhancements ✨
Security 🔒
Fixes 🐞
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.3...v4.0.4

v4.0.3: : Once Is Enough

Compare Source

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨
Fixes 🐞
Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

v4.0.2: : Root Access

Compare Source

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨
Fixes 🐞
Docs 📚
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: : Come Back Any Time

Compare Source

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

What's Changed

Fixes 🐞
Docs 📚
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.0...v4.0.1

v4.0.0: : Four Real

Compare Source

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

  • Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
  • Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
  • Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.
  • Argument completion for prompt and resource-template inputs, with already-supplied arguments visible to the handler.
  • Auth for agents and services: identity assertion (SEP-990, beta), provider-neutral role checks, insufficient-scope challenges that name the missing scopes, and client-credentials auth.
  • Infrastructure hooks: server-level cache hints, and Mcp-Method/Mcp-Name routing headers so gateways can route without parsing JSON-RPC.

The framework grew alongside the protocol: dependency injection can bind a dependency to arguments of the call it serves (Depends(get_account, user_id=CallArgument("owner"))) while keeping it out of the tool schema, and ClientGroup manages one client per server with collision-checked namespacing — each member negotiating its own protocol version.

The beta period motivated a bunch of correctness work. Most of it was auth: hardened OAuth consent flows, issuer validation, and JWT verification, plus proxies that strip cookies and connection-owned headers at trust boundaries. The rest was durability and compatibility — encrypted task snapshots, serialized event-store writes, response caching handling empty results, errors, and versioned components, and dozens of smaller fixes from CodeMode to Python 3.14 compat.

Breaking changes: server-initiated sampling and roots are removed (no live connection exists to call back into mid-request), ctx.elicit() is old-protocol-only, FastMCP 3's deprecated APIs are gone, MCP model fields are snake_case (with a warning compatibility bridge for the old names), and background tasks moved to fastmcp-tasks. Passing a bare string like Client("server.py") to run local code is deprecated in favor of Path, for removal in FastMCP 5.

The upgrade guide covers every change and includes a copyable prompt for auditing an application with a coding agent.

Happy (context) engineering!

What's Changed

New Features 🎉
Breaking Changes ⚠️
Enhancements ✨
Security 🔒
Fixes 🐞

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 05:59 AM (* 0-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 14, 2026 23:11
@renovate renovate Bot added bot Automated pull requests or issues dependencies Pull requests that update a dependency file renovate Pull requests from Renovate skip:codecov Skip Codecov reporting and check skip:test:long_running Skip long-running tests (≥5min) labels Sep 14, 2026
@renovate

renovate Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml
Artifact update for fastmcp resolved to version 4.1.0, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 4.0.10
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 3 times, most recently from 0bcd2ea to 817595c Compare September 22, 2026 12:38
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from eb187a3 to be1168b Compare September 30, 2026 02:03
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from 2edfa7f to d3c789d Compare October 7, 2026 23:19
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch from d3c789d to cbc20d2 Compare October 9, 2026 19:25
@sonarqubecloud

sonarqubecloud Bot commented Oct 9, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bot Automated pull requests or issues dependencies Pull requests that update a dependency file renovate Pull requests from Renovate skip:codecov Skip Codecov reporting and check skip:test:long_running Skip long-running tests (≥5min)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants