Skip to content

chore(deps)(deps): bump fastmcp from 3.4.7 to 4.0.3 in /sdk - #288

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/sdk/fastmcp-4.0.3
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/sdk/fastmcp-4.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •

Copy link
Copy Markdown
Contributor

Bumps fastmcp from 3.4.7 to 4.0.3.

Release notes

Sourced from fastmcp's releases.

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.5: No Country for Loose Ints

Tool parameters declared strict with Field(strict=True), StrictInt, or a strict model config are honored again, on both direct calls and task submission. Since the SDK v2 migration the server's lax default overrode them and silently coerced values.

Security 🔒

Fixes 🐞

Full Changelog: v4.0.4...v4.0.5

v4.0.4: Here Be No Dragons

OpenAPI request bodies get most of the attention in this patch: multipart string arrays are sent as repeated fields, whole-body arguments no longer clobber same-named HTTP parameters, dictionary bodies and raw content types survive intact, and JSON scalar bodies are encoded. On the auth side, OAuthProxy rejects ID-JAG tokens unless identity assertion is configured and refuses non-positive upstream token expiries. Clients now follow empty pagination cursors and servers reject malformed ones.

Enhancements ✨

Security 🔒

Fixes 🐞

... (truncated)

Commits
  • 7129236 Add v4.0.3 changelog entries (#5007)
  • f79bc82 chore: Update SDK documentation (#4945)
  • 6e0859f fix task timing field serialization (#5003)
  • 855cb7a Clarify release title history lookup (#5006)
  • 6236ac1 Clean up unfinished Monty callbacks (#5005)
  • 6c2fbe7 docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 (#4988)
  • e68bacc perf: avoid duplicate startup for mixed-era backends (#4971)
  • 032b9f6 fix: don't infer an output schema for unconstrained sequences (#4999)
  • 75d50ff ci: deploy docs through Mintlify's admin API and wait for a verdict (#4996)
  • a338cfb docs: point What's New at the changelog for later releases (#4992)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file sdk SDK package changes labels Sep 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/sdk/fastmcp-4.0.3 branch 3 times, most recently from c88e788 to 5b46eba Compare September 18, 2026 08:15
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.7 to 4.0.3.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.7...v4.0.3)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@pontino

pontino commented Sep 18, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #291. With extras now installed in CI, this bump fails mypy: the adapter reads the camelCase inputSchema/outputSchema that MCP SDK 2 renamed. #291 reads the schemas from fastmcp's own Tool, which is unchanged across 3.x and 4.x, keeps the >=3,<5 range and adds an adapter test.

@pontino pontino closed this Sep 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/sdk/fastmcp-4.0.3 branch September 18, 2026 10:15
pontino added a commit that referenced this pull request Sep 18, 2026
The adapter converted each fastmcp tool to the MCP protocol Tool and read
inputSchema/outputSchema. MCP SDK 2, pulled in by fastmcp 4, renamed those
fields to snake_case, so mypy fails and every listing warns. fastmcp's own
Tool exposes parameters and output_schema unchanged across both majors, so
read them directly and widen the extra to fastmcp>=3,<5.

The adapter subscriptions never passed data_type, so handlers received raw
dicts and crashed on the first attribute access. Declare the request models
on both subscriptions and add an end-to-end test over the in-memory
transport covering tool listing, a successful call and an error call.

Supersedes #288.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file sdk SDK package changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant