Upgrade AAZ Flow to FastMCP 3 - #33945
Closed
Aditya Pujara (a0x1ab) wants to merge 1 commit into
Closed
Conversation
Upgrade FastMCP to the patched 3.x line and refresh the AAZ Flow lockfile to remediate the shared Component Governance vulnerability cluster. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03142bcc-29be-45db-99de-296c4cc6c839
|
Hi Aditya Pujara (@a0x1ab), |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Cooper Cox (coopercox-ms)
approved these changes
Aug 21, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the AAZ Flow MCP server’s declared dependency constraint to allow FastMCP 3.x, aligning the project’s dependency policy with the FastMCP 3.x remediation line described in the PR.
Changes:
- Bumps
fastmcpdependency constraint from<3.0.0to<4.0.0with a minimum of3.2.0.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Seb C (Sebby37)
approved these changes
Aug 21, 2026
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Member
Author
|
Superseded by #33947, which removes the unused AAZ Flow server and its vulnerable dependency graph entirely. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation — 🔄 Running
Description
Upgrade AAZ Flow from FastMCP 2.x to the patched FastMCP 3.x line and refresh its lockfile. This remediates the 25 High-risk S360/Component Governance findings in the shared AAZ Flow dependency graph (KPI [SFI-ES5.2] 1ES Open Source Vulnerabilities (Operational), governed repository 203152), including Task 39343286 / alert 16424008.
Dependency remediation
Validation
uv lock --check