Skip to content

chore: bump fastmcp from 3.4.5 to 3.4.6 in the patch-updates group - #235

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/patch-updates-6782707b39
Closed

chore: bump fastmcp from 3.4.5 to 3.4.6 in the patch-updates group#235
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/patch-updates-6782707b39

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch-updates group with 1 update: fastmcp.

Updates fastmcp from 3.4.5 to 3.4.6

Release notes

Sourced from fastmcp's releases.

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

Docs 📚

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

  • Migrate to MCP Python SDK v2 by @​jlowin in #4437
  • Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
  • Forward-port Hugging Face auth provider by @​jlowin in #4475
  • Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483
  • Add guard-mode multi-round-trip tools (SEP-2322) by @​jlowin in #4544
  • Add FastMCP-native server extension API (SEP-2133) by @​jlowin in #4602
  • Add stateless session state (UserSession / SessionId) by @​jlowin in #4604
  • Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by @​jlowin in #4603

Breaking Changes ⚠️

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-updates group with 1 update: [fastmcp](https://github.com/PrefectHQ/fastmcp).


Updates `fastmcp` from 3.4.5 to 3.4.6
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.5...v3.4.6)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions github-actions Bot added the ignore-for-release Do not highlight this change in a release label Aug 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Coverage

Coverage Report •
FileStmtsMissCoverMissing
TOTAL172914891% 
report-only-changed-files is enabled. No files were changed during this commit :)

Tests Skipped Failures Errors Time
244 1 💤 0 ❌ 0 🔥 9.840s ⏱️

@github-actions github-actions Bot added ignore-for-release Do not highlight this change in a release and removed ignore-for-release Do not highlight this change in a release labels Aug 17, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like fastmcp is updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 17, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/patch-updates-6782707b39 branch August 17, 2026 06:35
@github-actions github-actions Bot added ignore-for-release Do not highlight this change in a release and removed ignore-for-release Do not highlight this change in a release labels Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies ignore-for-release Do not highlight this change in a release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants