Skip to content

build(deps): bump fastmcp from 2.10.4 to 3.0.1 - #32

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/fastmcp-3.0.1
Closed

build(deps): bump fastmcp from 2.10.4 to 3.0.1#32
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/fastmcp-3.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 22, 2026

Copy link
Copy Markdown
Contributor

Bumps fastmcp from 2.10.4 to 3.0.1.

Release notes

Sourced from fastmcp's releases.

v3.0.1: Threecovery Mode

First patch after 3.0 — mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, Tool.from_tool() accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. Also adds verify_id_token to OIDCProxy for providers (like some Azure AD configs) that issue opaque access tokens but standard JWT id_tokens.

What's Changed

Enhancements 🔧

Fixes 🐞

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.0.0...v3.0.1

v3.0.0: Three at Last

FastMCP 3.0 is stable. Two betas, two release candidates, 21 new contributors, and more than 100,000 pre-release installs later — the architecture held up, the upgrade path was smooth, and we're shipping it.

The surface API is largely unchanged — @mcp.tool() still works exactly as before. What changed is everything underneath: a provider/transform architecture that makes FastMCP extensible, observable, and composable in ways v2 couldn't support. If we did our jobs right, you'll barely notice the redesign. You'll just notice that more is possible.

This is also the release where FastMCP moves from jlowin/fastmcp to PrefectHQ/fastmcp. GitHub forwards all links, PyPI is the same, imports are the same. A major version felt like the right moment to make it official.

Build servers from anything

🔌 Components no longer have to live in one file with one server. FileSystemProvider discovers tools from directories with hot-reload. OpenAPIProvider wraps REST APIs. ProxyProvider proxies remote MCP servers. SkillsProvider delivers agent skills as resources. Write your own provider for whatever source makes sense. Compose multiple providers into one server, share one across many, or chain them with transforms that rename, namespace, filter, version, and secure components as they flow to clients. ResourcesAsTools and PromptsAsTools expose non-tool components to tool-only clients.

Ship to production

🔐 Component versioning: serve @tool(version="2.0") alongside older versions from one codebase. Granular authorization on individual components with async auth checks, server-wide policies via AuthMiddleware, and scope-based access control. OAuth gets CIMD, Static Client Registration, Azure OBO via dependency injection, JWT audience validation, and confused-deputy protections. OpenTelemetry tracing with MCP semantic conventions. Response size limiting. Background tasks with distributed Redis notification and ctx.elicit() relay. Security fixes include dropping diskcache (CVE-2025-69872) and upgrading python-multipart and protobuf for additional CVEs.

Adapt per session

💾 Session state persists across requests via ctx.set_state() / ctx.get_state(). ctx.enable_components() and ctx.disable_components() let servers adapt dynamically per client — show admin tools after authentication, progressively reveal capabilities, or scope access by role.

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.0.1: Three-covery Mode

First patch after 3.0 — mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, Tool.from_tool() accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. Also adds verify_id_token to OIDCProxy for providers (like some Azure AD configs) that issue opaque access tokens but standard JWT id_tokens.

Enhancements 🔧

Fixes 🐞

Docs 📚

Full Changelog: v3.0.0...v3.0.1

v3.0.0: Three at Last

FastMCP 3.0 is stable. Two betas, two release candidates, 21 new contributors, and more than 100,000 pre-release installs later — the architecture held up, the upgrade path was smooth, and we're shipping it.

The surface API is largely unchanged — @mcp.tool() still works exactly as before. What changed is everything underneath: a provider/transform architecture that makes FastMCP extensible, observable, and composable in ways v2 couldn't support. If we did our jobs right, you'll barely notice the redesign. You'll just notice that more is possible.

This is also the release where FastMCP moves from jlowin/fastmcp to PrefectHQ/fastmcp. GitHub forwards all links, PyPI is the same, imports are the same. A major version felt like the right moment to make it official.

... (truncated)

Commits
  • bb3e159 Fix decorator overload return types for function mode (#3258)
  • 43e9cdd Fix ty compatibility with upgraded deps (#3257)
  • 2218a6f Use max_completion_tokens instead of deprecated max_tokens in OpenAI handler ...
  • 1d7e92e Fix ty ignore syntax in OpenAPI provider (#3253)
  • f84b2da Add verify_id_token option to OIDCProxy (#3248)
  • 7e0eb2f Update Marvin workflow models to claude-sonnet-4-6 (#3250)
  • fc62904 Fix Marvin app token to use PrefectHQ org installation (#3249)
  • ea13286 Fix NameError with future annotations and Context/Depends parameters (#3243)
  • 1caf40e Fix circular reference crash in OpenAPI schemas (#3245)
  • 5e2d698 Fix dedupe bot labeling pipeline (#3244)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump fastmcp from 2.10.4 to 3.0.1
9cd4433 
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 2.10.4 to 3.0.1.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v2.10.4...v3.0.1)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Feb 22, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: area/python, type/dependency. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Feb 23, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #39.

@dependabot dependabot Bot closed this Feb 23, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/fastmcp-3.0.1 branch February 23, 2026 03:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/config

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants