Skip to content

deps(deps): bump fastmcp from 3.4.7 to 4.0.2 in /mcp-server - #350

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/mcp-server/fastmcp-4.0.2
Open

deps(deps): bump fastmcp from 3.4.7 to 4.0.2 in /mcp-server#350
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/mcp-server/fastmcp-4.0.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps fastmcp from 3.4.7 to 4.0.2.

Release notes

Sourced from fastmcp's releases.

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

What's Changed

Fixes 🐞

Docs 📚

Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.0...v4.0.1

v4.0.0: Four Real

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

  • Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
  • Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
  • Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

Enhancements ✨

Fixes 🐞

Docs 📚

  • docs: point What's New at the changelog for later releases by @​zzstoatzz in #4992
  • docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @​zzstoatzz in #4988

New Contributors

Full Changelog: v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

Fixes 🐞

Docs 📚

Full Changelog: v4.0.1...v4.0.2

... (truncated)

Commits
  • 8d52974 docs: add v4.0.2 changelog entries (#4990)
  • 07659a0 skills: add release skill with changelog entry helper (#4982)
  • fbe04c7 Expose ClientGroup from package root (#4987)
  • 07d7c54 docs: link the FastMCP 4 GA announcement and blog from What's New and Updates...
  • 94078f1 docs: note the 4.0.1 floor for ClientGroup reentrancy (#4980)
  • c4d9b68 docs: escape <1 in changelog so MDX parses (#4978)
  • b46cd58 docs: add v4.0.1 changelog entries (#4976)
  • 5c679ba client: make ClientGroup context reentrant (#4975)
  • 62ef226 docs: refresh sidebar tags and fix audit findings across servers/clients page...
  • 4f33763 docs: drop prerelease install framing from installation and SDK migration gui...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.7 to 4.0.2.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.7...v4.0.2)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@sonarqubecloud

sonarqubecloud Bot commented Sep 7, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants