Skip to content

chore(deps-dev): bump fastmcp from 4.1.0 to 4.1.3 - #86

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/fastmcp-4.1.3
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/fastmcp-4.1.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps fastmcp from 4.1.0 to 4.1.3.

Release notes

Sourced from fastmcp's releases.

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

What's Changed

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in PrefectHQ/fastmcp#5945.

Enhancements ✨

Fixes 🐞

Documentation 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

Enhancements ✨

Fixes 🐞

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in #5945.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

Security 🔒

Enhancements ✨

... (truncated)

Commits
  • aa13708 docs: add v4.1.3 changelog entries (#5948)
  • ec1a8e0 fix: require patched certifi trust stores (#5945)
  • bfe314f Preserve tool-body timeout errors (#5940)
  • 8f0d481 Honor per-server MCP config timeouts (#5758)
  • b918dd9 fix(tools): materialize generator transform_fn results in TransformedTool.run...
  • 0b1a6ba test(mount): make unreachable proxy failures deterministic (#5584)
  • 5910eb2 fix: preserve empty session visibility selections (#5944)
  • ceb465a Default upstream token auth method to none without a client secret (#5879)
  • 75ee327 Chart public backlog counts and closure outcomes (#5942)
  • 0f4674e docs: add v4.1.2 changelog entries (#5936)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 4.1.0 to 4.1.3.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v4.1.0...v4.1.3)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 22, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants