Skip to content

chore(deps): Update fastmcp requirement from >=3.4.4 to >=3.4.7 in /mcp/shopping_tool - #790

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mcp/shopping_tool/fastmcp-gte-3.4.7
Open

chore(deps): Update fastmcp requirement from >=3.4.4 to >=3.4.7 in /mcp/shopping_tool#790
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mcp/shopping_tool/fastmcp-gte-3.4.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

Security 🔒

Docs 📚

Full Changelog: v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

Docs 📚

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

  • Migrate to MCP Python SDK v2 by @​jlowin in #4437
  • Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
  • Forward-port Hugging Face auth provider by @​jlowin in #4475
  • Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): Update fastmcp requirement in /mcp/shopping_tool
7e08d5e 
Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp) to permit the latest version.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.4...v3.4.7)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 14, 2026
@dependabot dependabot Bot mentioned this pull request Aug 14, 2026
Closed
@clawgenti clawgenti mentioned this pull request Aug 17, 2026
Closed
@clawgenti clawgenti mentioned this pull request Sep 1, 2026
Open
@clawgenti

clawgenti commented Sep 1, 2026

Copy link
Copy Markdown

Dependency Update Analysis

Package: Update fastmcp requirement from >=3.4.4 to >=3.4.7 in /mcp/shopping_tool ((grouped update))
Ecosystem: pip | Age: 17 days (SLA: 14 days)
CI Status: passing

Changelog Summary

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

Risk Assessment

  • Breaking changes: None detected
  • Recommendation: Safe to merge (minor/patch, CI passing, no breaking changes detected)

Automated analysis by Rossoctl Dep Bump Fixer (scan 2026-09-01-002)

@clawgenti

clawgenti commented Sep 15, 2026

Copy link
Copy Markdown

Dependency Update Analysis

Package: Update fastmcp requirement from >=3.4.4 to >=3.4.7 in /mcp/shopping_tool ((grouped update))
Ecosystem: pip | Age: 17 days (SLA: 14 days)
CI Status: passing

Changelog Summary

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

Risk Assessment

  • Breaking changes: None detected
  • Recommendation: Safe to merge (minor/patch, CI passing, no breaking changes detected)

Automated analysis by Rossoctl Dep Bump Fixer (scan 2026-09-15-002)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

Rossoctl Issue Prioritization
Status: New/ToDo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@clawgenti @rubambiza