chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/reservation_tool in the minor-and-patch group across 1 directory by dependabot[bot] · Pull Request #753 · rossoctl/examples

dependabot · 2026-07-31T05:08:26Z

Bumps the minor-and-patch group with 1 update in the /mcp/reservation_tool directory: fastmcp.

Updates fastmcp from 3.4.4 to 3.4.7

Release notes

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

Backport CIMD assertion audience fix to v3 by @jlowin in PrefectHQ/fastmcp#4799

Docs 📚

Docs: add v3.4.7 changelog entries by @jlowin in PrefectHQ/fastmcp#4810

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

Backport #4412 to 3.x: support trusted SSRF proxies by @jlowin in PrefectHQ/fastmcp#4755

Docs 📚

Docs: add v3.4.6 changelog entries by @jlowin in PrefectHQ/fastmcp#4761

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @kakiii in PrefectHQ/fastmcp#4631

Backport #4469 to release/3.x: fix Azure scope fallback by @jlowin in PrefectHQ/fastmcp#4662

Backport #4523 to release/3.x: serialize deep object query parameters by @jlowin in PrefectHQ/fastmcp#4664

Backport #4564 to release/3.x: make transformed tool required order deterministic by @jlowin in PrefectHQ/fastmcp#4665

Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @jlowin in PrefectHQ/fastmcp#4663

Docs 📚

Docs: add v3.4.5 changelog entries by @jlowin in PrefectHQ/fastmcp#4673

New Contributors

@kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

Security 🔒

Backport CIMD assertion audience fix to v3 by @jlowin in #4799

Docs 📚

Docs: add v3.4.7 changelog entries by @jlowin in #4810

Full Changelog: v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

Backport #4412 to 3.x: support trusted SSRF proxies by @jlowin in #4755

Docs 📚

Docs: add v3.4.6 changelog entries by @jlowin in #4761

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

Migrate to MCP Python SDK v2 by @jlowin in #4437

Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @jlowin in #4450

Forward-port Hugging Face auth provider by @jlowin in #4475

Add server-side identity assertion (SEP-990 ID-JAG) by @jlowin in #4483

... (truncated)

Commits

758397e Docs: add v3.4.7 changelog entries (#4810)
538611b Backport CIMD assertion audience fix to v3 (#4799)
c587bdd Docs: add v3.4.6 changelog entries (#4761)
fcdf422 Backport #4412 to 3.x: support trusted SSRF proxies (#4755)
8de0c94 Docs: add v3.4.5 changelog entries (#4673)
5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
87ba18c Serialize deep object query parameters (#4523) (#4664)
aa8ab1e Fix Azure scope fallback (#4469) (#4662)
93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
See full diff in compare view

Bumps the minor-and-patch group with 1 update in the /mcp/reservation_tool directory: [fastmcp](https://github.com/PrefectHQ/fastmcp). Updates `fastmcp` from 3.4.4 to 3.4.7 - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.4.4...v3.4.7) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 3.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

clawgenti · 2026-08-18T16:01:26Z

Dependency Update Analysis

Package: fastmcp (3.4.4 -> 3.4.7)
Ecosystem: pip | Age: 17 days (SLA: 14 days)
CI Status: passing

Changelog Summary

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

Backport CIMD assertion audience fix to v3 by @jlowin in PrefectHQ/fastmcp#4799

Docs 📚

Docs: add v3.4.7 changelog entries by @jlowin in PrefectHQ/fastmcp#4810

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of ris...
Risk Assessment

Breaking changes: None detected

Recommendation: Safe to merge (minor/patch, CI passing, no breaking changes detected)

Automated analysis by Rossoctl Dep Bump Fixer (scan 2026-08-18-002)

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 31, 2026

rubambiza added this to Rossoctl Issue Prioritization Jul 31, 2026

github-project-automation Bot moved this to New/ToDo in Rossoctl Issue Prioritization Jul 31, 2026

dependabot Bot changed the title ~~chore(deps): Bump fastmcp from 3.4.4 to 3.4.5 in /mcp/reservation_tool in the minor-and-patch group~~ chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/reservation_tool in the minor-and-patch group across 1 directory Aug 14, 2026

dependabot Bot force-pushed the dependabot/uv/mcp/reservation_tool/minor-and-patch-a92504c772 branch from 20839b4 to ce63f92 Compare August 14, 2026 05:09

This was referenced Aug 18, 2026

Weekly Report 2026-08-18 rossoctl/rossoctl#2390

Closed

[dep-bump] Stale routine bump: fastmcp in examples #808

Open

Navigation Menu

Uh oh!

chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/reservation_tool in the minor-and-patch group across 1 directory - #753

chore(deps): Bump fastmcp from 3.4.4 to 3.4.7 in /mcp/reservation_tool in the minor-and-patch group across 1 directory#753
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mcp/reservation_tool/minor-and-patch-a92504c772

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

Uh oh!

clawgenti commented Aug 18, 2026

v3.4.7: Know Your Audience

What's Changed

Security 🔒

Docs 📚

v3.4.6: Trust, but Proxy

Risk Assessment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.4.7: Know Your Audience

What's Changed

Security 🔒

Docs 📚

v3.4.6: Trust, but Proxy

What's Changed

Fixes 🐞

Docs 📚

v3.4.5: Key Change

What's Changed

Fixes 🐞

Docs 📚

New Contributors

title: "Changelog" icon: "list-check" rss: true tag: NEW

Security 🔒

Docs 📚

Fixes 🐞

Docs 📚

New Features 🎉

Uh oh!

clawgenti commented Aug 18, 2026

Dependency Update Analysis

Changelog Summary

v3.4.7: Know Your Audience

What's Changed

Security 🔒

Docs 📚

v3.4.6: Trust, but Proxy

Risk Assessment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading