deps: bump fastmcp from 3.4.2 to 3.4.4 in the production-version-updates group across 1 directory by dependabot[bot] · Pull Request #299 · millsymills-com/unraid-mcp

dependabot · 2026-07-13T08:26:11Z

Bumps the production-version-updates group with 1 update in the / directory: fastmcp.

Updates fastmcp from 3.4.2 to 3.4.4

Release notes

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

Hugging Face Auth Integration by @evalstate in PrefectHQ/fastmcp#4385

Fixes 🐞

Relax host origin guard defaults by @jlowin in PrefectHQ/fastmcp#4439

Restore HTTP host guard compatibility by @jlowin in PrefectHQ/fastmcp#4472

Docs 📚

Docs: add v3.4.4 changelog entries by @jlowin in PrefectHQ/fastmcp#4473

New Contributors

@evalstate made their first contribution in PrefectHQ/fastmcp#4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨

Dedupe discriminator-required helper across schema converters by @jlowin in PrefectHQ/fastmcp#4362

Add real Monty sandbox e2e coverage for CodeMode call_tool by @AlexlaGuardia in PrefectHQ/fastmcp#4274

Switch prettier hook to rbubley/mirrors-prettier by @jlowin in PrefectHQ/fastmcp#4366

feat(remote): add --verify flag for TLS certificate verification by @jlowin in PrefectHQ/fastmcp#4369

Security 🔒

fix(deps): clear Dependabot security alerts via lockfile bumps by @jlowin in PrefectHQ/fastmcp#4393

Clarify resource path parameter safety by @jlowin in PrefectHQ/fastmcp#4398

Fix dev apps launch escaping by @jlowin in PrefectHQ/fastmcp#4399

Block NAT64 SSRF bypass by @jlowin in PrefectHQ/fastmcp#4400

[codex] Fix event store replay isolation by @jlowin in PrefectHQ/fastmcp#4402

Fix DCR redirect URI validation by @jlowin in PrefectHQ/fastmcp#4408

Protect streamable HTTP from DNS rebinding by @jlowin in PrefectHQ/fastmcp#4405

Block unsafe OAuth redirect schemes by @jlowin in PrefectHQ/fastmcp#4419

Block IPv6 transition SSRF bypasses by @jlowin in PrefectHQ/fastmcp#4426

Fixes 🐞

fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @gmenziesint in PrefectHQ/fastmcp#4301

Fix: async rate limiting middleware get_client_id callbacks by @Chotom in PrefectHQ/fastmcp#4319

Recognize all GitHub issue-link forms in require-issue-link workflow by @jlowin in PrefectHQ/fastmcp#4359

fix: preserve required discriminator tags by @he-yufeng in PrefectHQ/fastmcp#4297

fix(proxy): shield stateful proxy disconnect during session teardown by @jlowin in PrefectHQ/fastmcp#4363

fix(fs): isolate same-named package imports across providers by @jlowin in PrefectHQ/fastmcp#4361

fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by @tcconnally in PrefectHQ/fastmcp#4328

fix: guard recursive refs in json_schema_to_type by @Epochex in PrefectHQ/fastmcp#4312

Forward IdP auth errors to MCP client instead of showing HTML error page by @bobbyjames839 in PrefectHQ/fastmcp#4293

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line, led by JWTVerifier no longer rejecting every token when an authorization server publishes an unrecognized key type such as Ed25519.

Fixes 🐞

Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @kakiii in #4631

Backport #4469 to release/3.x: fix Azure scope fallback by @jlowin in #4662

Backport #4523 to release/3.x: serialize deep object query parameters by @jlowin in #4664

Backport #4564 to release/3.x: make transformed tool required order deterministic by @jlowin in #4665

Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @jlowin in #4663

New Contributors

@kakiii made their first contribution in #4631

Full Changelog: v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

Hugging Face Auth Integration by @evalstate in #4385

Fixes 🐞

Relax host origin guard defaults by @jlowin in #4439

Restore HTTP host guard compatibility by @jlowin in #4472

New Contributors

@evalstate made their first contribution in #4385

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

... (truncated)

Commits

9138d40 Docs: add v3.4.4 changelog entries (#4473)
d929882 Hugging Face Auth Integration (#4385)
5fe4fae Restore HTTP host guard compatibility (#4472)
400db61 Relax host origin guard defaults (#4439)
1eedd1f Docs: add v3.4.2 and v3.4.3 changelog entries (#4430)
3b1afe6 chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...
874425a chore: Update SDK documentation (#4427)
691766b [codex] Fix OpenAPI resource template requests (#4407)
47907e0 Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)
c1b0396 Block IPv6 transition SSRF bypasses (#4426)
Additional commits viewable in compare view

dependabot · 2026-07-13T08:26:12Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

millsmillsymills · 2026-07-17T06:47:43Z

@dependabot rebase

Clears the pip-audit finding on mcp 1.28.0 that fails the Dependency Audit gate on main and blocks Dependabot #300 and #299. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

millsmillsymills · 2026-07-28T19:57:24Z

@dependabot rebase

Bumps the production-version-updates group with 1 update in the / directory: [fastmcp](https://github.com/PrefectHQ/fastmcp). Updates `fastmcp` from 3.4.2 to 3.4.4 - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.4.2...v3.4.4) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 3.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

…772d445

dependabot Bot requested a review from millsmillsymills as a code owner July 13, 2026 08:26

dependabot Bot changed the title ~~deps: bump fastmcp from 3.4.2 to 3.4.3 in the production-version-updates group~~ deps: bump fastmcp from 3.4.2 to 3.4.4 in the production-version-updates group across 1 directory Jul 17, 2026

dependabot Bot force-pushed the dependabot/uv/production-version-updates-ba2772d445 branch from 93a04d9 to 9539b5b Compare July 17, 2026 06:49

This was referenced Jul 17, 2026

Bump mcp 1.28.0→1.28.1 (CVE-2026-59950) to unblock #300/#299 #302

Open

fix(deps): bump mcp to 1.28.1 (CVE-2026-59950) #303

Merged

dependabot Bot force-pushed the dependabot/uv/production-version-updates-ba2772d445 branch from 9539b5b to 3d1ab49 Compare July 28, 2026 19:58

Merge branch 'main' into dependabot/uv/production-version-updates-ba2…

51ce468

…772d445

millsmillsymills merged commit cf8fca1 into main Jul 28, 2026
11 checks passed

millsmillsymills deleted the dependabot/uv/production-version-updates-ba2772d445 branch July 28, 2026 20:17

Navigation Menu

Uh oh!

deps: bump fastmcp from 3.4.2 to 3.4.4 in the production-version-updates group across 1 directory - #299

deps: bump fastmcp from 3.4.2 to 3.4.4 in the production-version-updates group across 1 directory#299
millsmillsymills merged 2 commits into
mainfrom
dependabot/uv/production-version-updates-ba2772d445

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Uh oh!

millsmillsymills commented Jul 17, 2026

Uh oh!

millsmillsymills commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.4.4: Host in Translation

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

v3.4.3: The Fast and the Secure-ious

What's Changed

Enhancements ✨

Security 🔒

Fixes 🐞

title: "Changelog" icon: "list-check" rss: true tag: NEW

Fixes 🐞

New Contributors

Enhancements ✨

Fixes 🐞

New Contributors

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Labels

Uh oh!

millsmillsymills commented Jul 17, 2026

Uh oh!

millsmillsymills commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading