deps: bump the production-version-updates group with 2 updates

[dependabot]

Bumps the production-version-updates group with 2 updates: fastmcp and mutmut.

Updates fastmcp from 3.4.4 to 3.4.5

Release notes

Sourced from fastmcp's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in #4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in #4761

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

• Migrate to MCP Python SDK v2 by @​jlowin in #4437
• Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
• Forward-port Hugging Face auth provider by @​jlowin in #4475
• Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483
• Add guard-mode multi-round-trip tools (SEP-2322) by @​jlowin in #4544
• Add FastMCP-native server extension API (SEP-2133) by @​jlowin in #4602
• Add stateless session state (UserSession / SessionId) by @​jlowin in #4604
• Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by @​jlowin in #4603

Breaking Changes ⚠️

• Emit one SERVER span per request and adopt spec-correct error codes by @​jlowin in #4445
• Remove 3.x deprecated module shims and dead parameters by @​jlowin in #4447
• Remove 3.0-deprecated FastMCP server methods by @​jlowin in #4451
• Remove 3.x deprecated parameters and object-mode decorators by @​jlowin in #4453
• Migrate to MCP SDK v2.0.0b2 (httpx2) by @​jlowin in #4503
• Fix typos by @​szepeviktor in #4498
• Stop proxies from validating backend results or mutating shared transports by @​jlowin in #4552
• Surface resource, prompt, and proxy errors on the modern protocol by @​jlowin in #4579
• Negotiate the best mutual protocol era by default by @​jlowin in #4572
• Remove server-initiated sampling and roots from the server API by @​jlowin in #4648
• Remove 3.x-era compatibility shims by @​jlowin in #4661

... (truncated)

Commits

• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• See full diff in compare view

Updates mutmut from 3.6.0 to 3.7.0

Changelog

Sourced from mutmut's changelog.

3.7.0

* Fix the trampoline dropping a generator's return value, so ``yield from`` on a mutated generator no longer yields ``None`` instead of its result


Fix async generators, so that aclose()/athrow() are handled by the except/finally blocks of the mutated function instead of being swallowed by the trampoline


Fix max_stack_depth when a test changes the working directory (for example via a tmpdir fixture)


Fix type_check_command reporting type errors in copied files that have no mutants


Per-function source hashing for incremental cache invalidation — only re-test mutants in functions that changed


Cross-call dependency tracking — invalidate mutants in callers when a called function changes


Use git to detect non-Python dependency file changes; falls back to a curated file list when git is unavailable


Add cache_invalidation_exclude config to suppress noisy files from change detection


Add use_git_change_detection config (default true) to opt out of git-based detection


Add uv.lock, poetry.lock, Pipfile.lock, and pdm.lock to the list of files copied by default


Invalidate cached results automatically when result-affecting config fields change


Make mutmut browse, show and apply much faster and use far less memory, by storing where each mutant is in the mutated file instead of parsing the whole file to find it

Commits

• 4f12080 Release 3.7.0
• f5156fd Updated authors
• 0092be2 fix: forward generator return value through the trampoline (#542)
• 9e4af73 Read mutants from a line span index instead of parsing the mutated file (#543)
• 32f0b42 chore(readme): fix typo (#537)
• 523a19c update changelog
• 70b26ff lockfiles
• 1d11c1b misc: update authors (#532)
• 8799708 fix(#525): implement full async-gen wrapper (#530)
• c01561b fix record_trampoline_hit when tmpdir changed working directory
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.