Skip to content

chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/image_tool in the minor-and-patch group across 1 directory - #748

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mcp/image_tool/minor-and-patch-a92504c772
Open

chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/image_tool in the minor-and-patch group across 1 directory#748
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mcp/image_tool/minor-and-patch-a92504c772

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 1 update in the /mcp/image_tool directory: fastmcp.

Updates fastmcp from 3.4.4 to 3.4.7

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

Security 🔒

Docs 📚

Full Changelog: v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

Docs 📚

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

  • Migrate to MCP Python SDK v2 by @​jlowin in #4437
  • Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
  • Forward-port Hugging Face auth provider by @​jlowin in #4475
  • Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 31, 2026
Bumps the minor-and-patch group with 1 update in the /mcp/image_tool directory: [fastmcp](https://github.com/PrefectHQ/fastmcp).


Updates `fastmcp` from 3.4.4 to 3.4.7
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.4...v3.4.7)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): Bump fastmcp from 3.4.4 to 3.4.5 in /mcp/image_tool in the minor-and-patch group chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/image_tool in the minor-and-patch group across 1 directory Aug 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/mcp/image_tool/minor-and-patch-a92504c772 branch from fcf3449 to d94dd73 Compare August 14, 2026 05:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

Status: New/ToDo

Development

Successfully merging this pull request may close these issues.

1 participant