Skip to content

chore(deps):(deps): bump fastmcp from 3.4.7 to 3.4.10 - #6383

Merged
daggerstuff merged 1 commit into
stagingfrom
dependabot/uv/fastmcp-3.4.10
Oct 26, 2026
Merged

daggerstuff merged 1 commit into
stagingfrom
dependabot/uv/fastmcp-3.4.10

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Bumps fastmcp from 3.4.7 to 3.4.10.

Release notes

Sourced from fastmcp's releases.

v3.4.10: Back in Check

This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.

What's Changed

Security 🔒

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.9...v3.4.10

v3.4.9: Contain Yourself

This release backports security fixes from 4.1: OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.

What's Changed

Security 🔒

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.8...v3.4.9

v3.4.8: Long Arm of the Patch

This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 2 contributors.

What's Changed

Security 🔒

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.10: Back in Check

This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.

Security 🔒

New Contributors

Full Changelog: v3.4.9...v3.4.10

v3.4.9: Contain Yourself

This release backports security fixes from 4.1: OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.

Security 🔒

Fixes 🐞

Docs 📚

  • docs: credit contributors in v3.4.8 changelog entries by @​jlowin in #5450

New Contributors

Full Changelog: v3.4.8...v3.4.9

v3.4.8: Long Arm of the Patch

... (truncated)

Commits
  • 1ea6f96 docs: add v3.4.10 changelog entries (#5935)
  • 8649ba5 [3.x] Enforce component authorization after transforms and on resource reads ...
  • 83c9764 docs: add v3.4.9 changelog entries (#5772)
  • eddc780 [3.x] Bound regex tool search with Pydantic's regex engine and a time budget ...
  • bcdb86c [3.x] Share JWKS refreshes across key lookups (#5769)
  • 4183eea [3.x] Backport OpenAPI dot-segment and skill containment fixes (#5765)
  • 8d71296 docs: credit contributors in v3.4.8 changelog entries (#5450)
  • 12c7e2e docs: add v3.4.8 changelog entries (#5445)
  • 4bacc9e [3.x] OpenAPI components send only declared arguments and keep configured hea...
  • 0a6a3a3 [3.x] Inline schemas whose pointers pass through alias definitions (#5439)
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from daggerstuff as a code owner October 24, 2026 01:36
@vercel

vercel Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
pixelated Ignored Ignored Preview Oct 26, 2026 5:59am UTC

Request Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: uv. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@daggerstuff

Copy link
Copy Markdown
Owner

@dependabot rebase

Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.7 to 3.4.10.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/v3.4.10/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.7...v3.4.10)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/uv/fastmcp-3.4.10 branch from 2ac07ab to 73a3487 Compare October 26, 2026 05:58
@github-actions

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@daggerstuff
daggerstuff merged commit 027c012 into staging Oct 26, 2026
30 of 32 checks passed
@daggerstuff
daggerstuff deleted the dependabot/uv/fastmcp-3.4.10 branch October 26, 2026 06:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant