chore(deps): bump fastmcp from 3.4.7 to 4.0.3 by dependabot[bot] · Pull Request #752 · FalkorDB/QueryWeaver

dependabot · 2026-09-08T13:13:27Z

Bumps fastmcp from 3.4.7 to 4.0.3.

Release notes

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨

ci: deploy docs through Mintlify's admin API and wait for a verdict by @zzstoatzz in PrefectHQ/fastmcp#4996

perf: avoid duplicate startup for mixed-era backends by @ningmao-hlyz in PrefectHQ/fastmcp#4971

docs: clarify release title history lookup by @zzstoatzz in PrefectHQ/fastmcp#5006

Fixes 🐞

fix: don't infer an output schema for unconstrained sequences by @fsecada01 in PrefectHQ/fastmcp#4999

Clean up unfinished Monty callbacks by @zzstoatzz in PrefectHQ/fastmcp#5005

Fix task timing field serialization by @LarryHu0217 in PrefectHQ/fastmcp#5003

Docs 📚

docs: point What's New at the changelog for later releases by @zzstoatzz in PrefectHQ/fastmcp#4992

docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @zzstoatzz in PrefectHQ/fastmcp#4988

docs: add v4.0.3 changelog entries by @zzstoatzz in PrefectHQ/fastmcp#5007

New Contributors

@fsecada01 made their first contribution in PrefectHQ/fastmcp#4999

@ningmao-hlyz made their first contribution in PrefectHQ/fastmcp#4971

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨

Expose ClientGroup from package root by @jlowin in PrefectHQ/fastmcp#4987

skills: add release skill with changelog entry helper by @zzstoatzz in PrefectHQ/fastmcp#4982

Fixes 🐞

docs: escape <1 in changelog so MDX parses by @zzstoatzz in PrefectHQ/fastmcp#4978

Docs 📚

docs: note the 4.0.1 floor for ClientGroup reentrancy by @zzstoatzz in PrefectHQ/fastmcp#4980

docs: link the GA announcement and blog from What's New by @zzstoatzz in PrefectHQ/fastmcp#4984

Other Changes 🦾

docs: add v4.0.2 changelog entries by @zzstoatzz in PrefectHQ/fastmcp#4990

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

Enhancements ✨

ci: deploy docs through Mintlify's admin API and wait for a verdict by @zzstoatzz in #4996

perf: avoid duplicate startup for mixed-era backends by @ningmao-hlyz in #4971

docs: clarify release title history lookup by @zzstoatzz in #5006

Fixes 🐞

fix: don't infer an output schema for unconstrained sequences by @fsecada01 in #4999

Clean up unfinished Monty callbacks by @zzstoatzz in #5005

Fix task timing field serialization by @LarryHu0217 in #5003

Docs 📚

docs: point What's New at the changelog for later releases by @zzstoatzz in #4992

docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @zzstoatzz in #4988

New Contributors

@fsecada01 made their first contribution in #4999

@ningmao-hlyz made their first contribution in #4971

Full Changelog: v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

Expose ClientGroup from package root by @jlowin in #4987

skills: add release skill with changelog entry helper by @zzstoatzz in #4982

Fixes 🐞

docs: escape <1 in changelog so MDX parses by @zzstoatzz in #4978

Docs 📚

docs: note the 4.0.1 floor for ClientGroup reentrancy by @zzstoatzz in #4980

docs: link the GA announcement and blog from What's New by @zzstoatzz in #4984

Full Changelog: v4.0.1...v4.0.2

... (truncated)

Commits

7129236 Add v4.0.3 changelog entries (#5007)
f79bc82 chore: Update SDK documentation (#4945)
6e0859f fix task timing field serialization (#5003)
855cb7a Clarify release title history lookup (#5006)
6236ac1 Clean up unfinished Monty callbacks (#5005)
6c2fbe7 docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 (#4988)
e68bacc perf: avoid duplicate startup for mixed-era backends (#4971)
032b9f6 fix: don't infer an output schema for unconstrained sequences (#4999)
75d50ff ci: deploy docs through Mintlify's admin API and wait for a verdict (#4996)
a338cfb docs: point What's New at the changelog for later releases (#4992)
Additional commits viewable in compare view

github-actions · 2026-09-08T13:13:39Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
uncalled-for	0.4.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/fastmcp	4.0.3	Unknown	Unknown
pip/fastmcp-slim	4.0.3	Unknown	Unknown
pip/httpcore2	2.12.0	Unknown	Unknown
pip/httpx2	2.12.0	Unknown	Unknown
pip/httpx2-jsfetch	1.0	Unknown	Unknown
pip/idna	3.19	Unknown	Unknown
pip/mcp	2.2.0	Unknown	Unknown
pip/mcp-types	2.2.0	Unknown	Unknown
pip/truststore	0.10.4	Unknown	Unknown
pip/uncalled-for	0.4.0	Unknown	Unknown

Scanned Files

uv.lock

coderabbitai · 2026-09-12T10:36:52Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5a33e40b-ec8d-4b8a-becb-febe6156bd1b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.7 to 4.0.3. - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.4.7...v4.0.3) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

gkorland · 2026-09-14T19:29:32Z

@dependabot rebase

dependabot · 2026-09-14T19:29:37Z

Looks like this PR is already up-to-date with staging! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

gkorland

Automated approval: dependency bump, CI green, rebased (user-requested override for this specific PR).

Copilot

🟡 Changes recommended

Add MCP-enabled and disabled smoke/integration coverage for the mounted /mcp app and handshake.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates FastMCP from 3.4.7 to 4.0.3 and refreshes the locked dependency tree.

Changes:

Expands the FastMCP constraint to <5.0.0.
Locks FastMCP 4.0.3, MCP SDK 2.2.0, and refreshed transitive dependencies.

File summaries

File	Summary
`pyproject.toml`	Updates the FastMCP dependency range.
`uv.lock`	Records FastMCP 4.0.3 and refreshed dependencies.

Review details

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    "python-multipart~=0.0.32",
    "jinja2~=3.1.4",
-    "fastmcp>=3.4.4,<4.0.0",
+    "fastmcp>=3.4.4,<5.0.0",


dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 8, 2026

barakb mentioned this pull request Sep 8, 2026

chore(deps): combine Dependabot updates across uv and npm #762

Closed

dependabot Bot force-pushed the dependabot/uv/staging/fastmcp-4.0.3 branch from c0d3a69 to 2164019 Compare September 12, 2026 10:36

dependabot Bot force-pushed the dependabot/uv/staging/fastmcp-4.0.3 branch from 2164019 to 173ab81 Compare September 12, 2026 19:41

dependabot Bot force-pushed the dependabot/uv/staging/fastmcp-4.0.3 branch from 173ab81 to 80a8572 Compare September 14, 2026 04:12

gkorland requested a lite review from Copilot September 14, 2026 19:29

Copilot started reviewing on behalf of gkorland September 14, 2026 19:29 View session

gkorland approved these changes Sep 14, 2026

View reviewed changes

gkorland merged commit 9b4134d into staging Sep 14, 2026
9 checks passed

gkorland deleted the dependabot/uv/staging/fastmcp-4.0.3 branch September 14, 2026 19:32

Copilot AI reviewed Sep 14, 2026

View reviewed changes

Comment thread pyproject.toml

"python-multipart~=0.0.32",

"jinja2~=3.1.4",

"fastmcp>=3.4.4,<4.0.0",

"fastmcp>=3.4.4,<5.0.0",

Navigation Menu

chore(deps): bump fastmcp from 3.4.7 to 4.0.3 - #752

chore(deps): bump fastmcp from 3.4.7 to 4.0.3#752
gkorland merged 1 commit into
stagingfrom
dependabot/uv/staging/fastmcp-4.0.3

dependabot Bot commented on behalf of github Sep 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading

Review skipped

Uh oh!

gkorland commented Sep 14, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

gkorland left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.0.3: Once Is Enough

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

v4.0.2: Root Access

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

Other Changes 🦾

v4.0.1: Come Back Any Time

title: "Changelog" icon: "list-check" rss: true tag: NEW

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

Enhancements ✨

Fixes 🐞

Docs 📚

Uh oh!

github-actions Bot commented Sep 8, 2026

Dependency Review

License Issues

uv.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

coderabbitai Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

gkorland commented Sep 14, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

gkorland left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Sep 8, 2026 •

edited

Loading

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading