Bumps fastmcp from 3.2.0 to 3.4.7.

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

• Backport CIMD assertion audience fix to v3 by @​jlowin in PrefectHQ/fastmcp#4799

Docs 📚

• Docs: add v3.4.7 changelog entries by @​jlowin in PrefectHQ/fastmcp#4810

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in PrefectHQ/fastmcp#4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in PrefectHQ/fastmcp#4761

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

... (truncated)

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.0b3: Fast Fourward

FastMCP 4 beta 3 moves the v4 line toward general availability with Prefect Horizon authentication, CallArgument and Depends bindings for tools and background tasks, and a round of OAuth, proxy, OpenAPI, and Python 3.14 compatibility hardening.

Enhancements ✨

• Add Prefect Horizon authentication client and local state by @​parkedwards in #4785
• Clarify auto-closed PR message by @​jlowin in #4820
• Support CallArgument and Depends bindings from uncalled-for 0.4.0 by @​chrisguidry in #4802
• Fix static analysis under newer ty releases by @​zzstoatzz in #4831
• Cover CallArgument resolution in background tasks by @​zzstoatzz in #4833
• Scalekit issuer updates backward compatibility by @​AkshayParihar33 in #4798

Security 🔒

• Add audience pinning to GoogleTokenVerifier by @​zzstoatzz in #4827
• Bump cryptography to 50.0.0 by @​zzstoatzz in #4836

Fixes 🐞

• Fix partial parameter hints on Python 3.14 by @​zzstoatzz in #4796
• fix(openapi): extract parameter-level example and examples by @​doneman536 in #4793
• Keep earlier consent CSRF tokens valid within a transaction by @​trevhud in #4818
• Fix StatefulProxyClient reconnection after session failure by @​jlowin in #4829

Docs 📚

• Docs language dropdown by @​znicholasbrown in #4801
• Docs: mirror v3.4.7 release notes by @​jlowin in #4811
• docs: prepare FastMCP 4 beta 3 by @​jlowin in #4840
• docs: add FastMCP 4 beta 3 release entries by @​jlowin in #4841

New Contributors

• @​parkedwards made their first contribution in #4785
• @​trevhud made their first contribution in #4818

Full Changelog: v4.0.0b2...v4.0.0b3

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

... (truncated)

• 758397e Docs: add v3.4.7 changelog entries (#4810)
• 538611b Backport CIMD assertion audience fix to v3 (#4799)
• c587bdd Docs: add v3.4.6 changelog entries (#4761)
• fcdf422 Backport #4412 to 3.x: support trusted SSRF proxies (#4755)
• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)