Skip to content

Upgrade AAZ Flow to FastMCP 3 - #33945

Closed
Aditya Pujara (a0x1ab) wants to merge 1 commit into
Azure:devfrom
a0x1ab:apujara/fix-aaz-flow-dependencies
Closed

Upgrade AAZ Flow to FastMCP 3#33945
Aditya Pujara (a0x1ab) wants to merge 1 commit into
Azure:devfrom
a0x1ab:apujara/fix-aaz-flow-dependencies

Conversation

@a0x1ab

@a0x1ab Aditya Pujara (a0x1ab) commented Aug 21, 2026

Copy link
Copy Markdown
Member

🤖 PR Validation — 🔄 Running

Breaking Changes Tests
️✔️ None 🔄 65/65

Description

Upgrade AAZ Flow from FastMCP 2.x to the patched FastMCP 3.x line and refresh its lockfile. This remediates the 25 High-risk S360/Component Governance findings in the shared AAZ Flow dependency graph (KPI [SFI-ES5.2] 1ES Open Source Vulnerabilities (Operational), governed repository 203152), including Task 39343286 / alert 16424008.

Dependency remediation

  • FastMCP 3.4.7 (minimum fixed version: 3.2.0)
  • MCP 1.29.0 (minimum fixed version: 1.28.1)
  • Starlette 1.6.0 (minimum fixed version: 1.3.1)
  • Authlib 1.7.2 (minimum fixed version: 1.6.9)
  • cryptography 50.0.0
  • PyJWT 2.13.0
  • python-multipart 0.0.32
  • Removes urllib3 from the AAZ Flow dependency graph

Validation

  • uv lock --check
  • Compiled all AAZ Flow Python modules
  • Imported the server under FastMCP 3.4.7 and verified all six MCP tools register
  • Started the server successfully with the stdio transport

Upgrade FastMCP to the patched 3.x line and refresh the AAZ Flow lockfile to remediate the shared Component Governance vulnerability cluster.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 03142bcc-29be-45db-99de-296c4cc6c839
Copilot AI lite review requested due to automatic review settings August 21, 2026 02:49
@a0x1ab
Aditya Pujara (a0x1ab) requested review from a team as code owners August 21, 2026 02:49
@azure-client-tools-bot-prd

Copy link
Copy Markdown

Hi Aditya Pujara (@a0x1ab),
Since the current milestone time is less than 7 days, this pr may not catch up with this release.

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the AAZ Flow MCP server’s declared dependency constraint to allow FastMCP 3.x, aligning the project’s dependency policy with the FastMCP 3.x remediation line described in the PR.

Changes:

  • Bumps fastmcp dependency constraint from <3.0.0 to <4.0.0 with a minimum of 3.2.0.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@coopercox-ms

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).

@a0x1ab

Copy link
Copy Markdown
Member Author

Superseded by #33947, which removes the unused AAZ Flow server and its vulnerable dependency graph entirely.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants