[dependabot]

Bumps fastmcp from 4.1.1 to 4.1.2.

Release notes

Sourced from fastmcp's releases.

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

• Authorize transformed components and prevent denied-resource template fallback by @​zzstoatzz and @​rishid in PrefectHQ/fastmcp#5933
• Bind OAuth client credentials to a configured issuer, including cached-token renewal, by @​zzstoatzz and @​LHMisme420 in PrefectHQ/fastmcp#5933

Enhancements ✨

• Add SEP-2640 Skills extension foundation by @​strawgate in PrefectHQ/fastmcp#5057
• Write down triage and merge norms in docs/development by @​zzstoatzz in PrefectHQ/fastmcp#5872
• Add experimental Skills discovery to SkillsDirectoryProvider by @​zzstoatzz in PrefectHQ/fastmcp#5704

Fixes 🐞

• Do not require websockets for the OAuth callback server by @​asasemahmed in PrefectHQ/fastmcp#5693
• Keep fastmcp.json resolvable when deployment.cwd changes the working directory by @​asasemahmed in PrefectHQ/fastmcp#5700
• Fix ctx.log() failing when extra contains LogRecord attribute names by @​asasemahmed in PrefectHQ/fastmcp#5688
• Use a monotonic clock in the rate limiters by @​asasemahmed in PrefectHQ/fastmcp#5689
• Escape server metadata in the fastmcp inspect text summary by @​asasemahmed in PrefectHQ/fastmcp#5701
• Respect an explicit is_binary=False on FileResource by @​asasemahmed in PrefectHQ/fastmcp#5696
• Follow pagination in the MCP format of fastmcp inspect by @​asasemahmed in PrefectHQ/fastmcp#5691
• Visit each reference once when finding access-restricted properties by @​AarnavNoble in PrefectHQ/fastmcp#5751
• Run sync resource templates in the threadpool by @​hardness1020 in PrefectHQ/fastmcp#5742
• Require openapi-pydantic 0.6.0 so OpenAPI 3.1.2 specs load by @​jsphbtst in PrefectHQ/fastmcp#5647
• Scope FileUpload and session visibility to a stable client on MCP 2026-07-28 by @​zzstoatzz in PrefectHQ/fastmcp#5651
• fix(auth): accept private_key_jwt without form client_id by @​HootRock and @​imranq2 in PrefectHQ/fastmcp#5832
• fix(cli): honor explicit URL transport by @​mikamikasuki in PrefectHQ/fastmcp#5529
• Remove legacy logging state when HTTP sessions close by @​mikamikasuki in PrefectHQ/fastmcp#5539
• Name data-backed File resources consistently with their MIME subtype by @​nandanadileep in PrefectHQ/fastmcp#5568
• fix(client): run Python stdio children in UTF-8 mode by @​ningmao-hlyz in PrefectHQ/fastmcp#5642
• Report an unbindable OAuth callback port instead of SystemExit by @​asasemahmed in PrefectHQ/fastmcp#5692
• Accept ES256 and other RSA/EC algorithms for CIMD private_key_jwt assertions by @​asasemahmed in PrefectHQ/fastmcp#5695
• Preserve icons on transformed tools by @​asasemahmed in PrefectHQ/fastmcp#5702
• Hydrate valid schema defaults while preserving invalid defaults by @​nandanadileep in PrefectHQ/fastmcp#5738
• fix(resources): preserve public metadata in built-in read contents by @​HootRock in PrefectHQ/fastmcp#5778
• Preserve shared dependency scopes without optional task dependencies by @​HootRock and @​BlueX888 in PrefectHQ/fastmcp#5817
• fix: treat non-string skill frontmatter descriptions as absent by @​BlueX888 in PrefectHQ/fastmcp#5823
• fix(resources): preserve component meta for list[ResourceContent] returns by @​BlueX888 in PrefectHQ/fastmcp#5843
• Fall back to the client timeout when resolving claimed results by @​marcinbelczewski in PrefectHQ/fastmcp#5190
• Discover Goose Streamable HTTP extensions by @​jiuyueQ and @​ch-z-hc in PrefectHQ/fastmcp#5582
• Raise ToolError when a tool with an output schema returns an unserializable value by @​massimiliano1991 in PrefectHQ/fastmcp#5063
• Stop deploy tests from spawning PowerShell on every state access by @​zzstoatzz in PrefectHQ/fastmcp#5874
• Give the timeout-override test headroom for the follow-up tools/list by @​zzstoatzz in PrefectHQ/fastmcp#5875
• Keep disabled resources from being served by matching templates by @​zzstoatzz in PrefectHQ/fastmcp#5876

Docs 📚

• Fix codespell typo in v4.1.1 changelog by @​zzstoatzz in PrefectHQ/fastmcp#5818
• context: stop documenting session_id as a cross-request key by @​zzstoatzz in PrefectHQ/fastmcp#5862

Examples & Contrib 💡

• fix(contrib): preserve BulkToolCaller tool prefixes by @​mikamikasuki in PrefectHQ/fastmcp#5555

Other Changes 🦾

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

Security 🔒

• Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in #5945.

Enhancements ✨

• Chart public backlog counts and closure outcomes by @​zzstoatzz in #5942

Fixes 🐞

• Default the upstream token auth method to none without a client secret by @​asasemahmed in #5879
• fix: preserve empty session visibility selections by @​himanshuchawla0807-gif in #5944
• test(mount): make unreachable proxy failures deterministic by @​CharlesYXW and @​ch-z-hc in #5584
• fix(tools): materialize generator transform_fn results in TransformedTool.run by @​BlueX888 and @​nandanadileep in #5672
• Honor per-server MCP config timeouts by @​atty57, @​phnmn, and @​CRYPTONIKAV in #5758
• fix: don't classify a tool body's own TimeoutError as the tool timeout by @​Wilson0511 in #5940

New Contributors

• @​phnmn made their first contribution in #5758
• @​CRYPTONIKAV made their first contribution in #5758
• @​himanshuchawla0807-gif made their first contribution in #5944
• @​CharlesYXW made their first contribution in #5584
• @​atty57 made their first contribution in #5758
• @​Wilson0511 made their first contribution in #5940

Full Changelog: v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

Security 🔒

• Authorize transformed components and prevent denied-resource template fallback by @​zzstoatzz and @​rishid in #5933
• Bind OAuth client credentials to a configured issuer, including cached-token renewal, by @​zzstoatzz and @​LHMisme420 in #5933

Enhancements ✨

• Add SEP-2640 Skills extension foundation by @​strawgate in #5057
• Write down triage and merge norms in docs/development by @​zzstoatzz in #5872
• Add experimental Skills discovery to SkillsDirectoryProvider by @​zzstoatzz in #5704

... (truncated)

Commits

• 0f4674e docs: add v4.1.2 changelog entries (#5936)
• 85df42f Enforce component authorization and bind OAuth credentials to an issuer (#5933)
• 535a3e1 Remove stray logo.py and unused CodeRabbit config (#5873)
• 49858c3 Keep disabled resources from being served by matching templates (#5876)
• 9921d5e Add experimental Skills discovery to SkillsDirectoryProvider (#5704)
• cb20ad6 Give the timeout-override test headroom for the follow-up tools/list (#5875)
• 623590a Stop deploy tests from spawning PowerShell on every state access (#5874)
• 70ac0ce context: stop documenting session_id as a cross-request key (#5862)
• e1b3e57 Write down triage and merge norms in docs/development (#5872)
• 78e1256 Raise ToolError when a tool with an output schema returns an unserializable v...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.