Skip to content

deps(python): update fastmcp requirement from >=3.3.1 to >=4.1.1 in /mcp_server - #139

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/mcp_server/fastmcp-gte-4.1.1
Open

dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/mcp_server/fastmcp-gte-4.1.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v4.1.1: Regex Marks the Spot

Regex tool search now rejects patterns over 1,000 characters and stops after about a second, and SkillsDirectoryProvider discovers skill folders that are links again, including links to folders outside the skills root; a skill's own files must still resolve inside the folder it links to. All 4.x users are encouraged to upgrade. Thanks to our 4 contributors, including 1 first-time contributor.

What's Changed

Security 🔒

Fixes 🐞

Examples & Contrib 💡

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.1.0...v4.1.1

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in #5945.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

Security 🔒

Enhancements ✨

... (truncated)

Commits
  • 7f3c53e docs: add v4.1.1 changelog entries (#5796)
  • fb52bd3 Bound regex tool search by pattern length and time (#5771)
  • 307aa56 Keep the JWKS refresh lock clear of subclass attributes (#5770)
  • 564d8b6 Keep linked skill folders discoverable (#5766)
  • e2fcc41 Keep an unparseable proxy setting from aborting the update check (#5639)
  • 9c4a0b9 Convert the component manager's version query param to a VersionSpec (#5575)
  • 51b618f Merge pull request #5635 from PrefectHQ/docs/changelog-4.1.0
  • e8327ee docs: structure v4.1.0 release notes
  • d7186ba docs: exclaim v4.1.0 contributor thanks
  • d87d171 docs: add v4.1.0 changelog entries
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp) to permit the latest version.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.3.1...v4.1.1)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.1.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants