Skip to content

fix(deps): update fastmcp to v4 - #1011

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fastmcp-4.x
Closed

fix(deps): update fastmcp to v4#1011
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fastmcp-4.x

Conversation

@renovate

@renovate renovate Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fastmcp >=3.4.7,<4 → >=4.0.3,<5 age confidence

Release Notes

PrefectHQ/fastmcp (fastmcp)

v4.0.3: : Once Is Enough

Compare Source

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨
Fixes 🐞
Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

v4.0.2: : Root Access

Compare Source

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨
Fixes 🐞
Docs 📚
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: : Come Back Any Time

Compare Source

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

What's Changed

Fixes 🐞
Docs 📚
Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.0...v4.0.1

v4.0.0: : Four Real

Compare Source

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

  • Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
  • Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
  • Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.
  • Argument completion for prompt and resource-template inputs, with already-supplied arguments visible to the handler.
  • Auth for agents and services: identity assertion (SEP-990, beta), provider-neutral role checks, insufficient-scope challenges that name the missing scopes, and client-credentials auth.
  • Infrastructure hooks: server-level cache hints, and Mcp-Method/Mcp-Name routing headers so gateways can route without parsing JSON-RPC.

The framework grew alongside the protocol: dependency injection can bind a dependency to arguments of the call it serves (Depends(get_account, user_id=CallArgument("owner"))) while keeping it out of the tool schema, and ClientGroup manages one client per server with collision-checked namespacing — each member negotiating its own protocol version.

The beta period motivated a bunch of correctness work. Most of it was auth: hardened OAuth consent flows, issuer validation, and JWT verification, plus proxies that strip cookies and connection-owned headers at trust boundaries. The rest was durability and compatibility — encrypted task snapshots, serialized event-store writes, response caching handling empty results, errors, and versioned components, and dozens of smaller fixes from CodeMode to Python 3.14 compat.

Breaking changes: server-initiated sampling and roots are removed (no live connection exists to call back into mid-request), ctx.elicit() is old-protocol-only, FastMCP 3's deprecated APIs are gone, MCP model fields are snake_case (with a warning compatibility bridge for the old names), and background tasks moved to fastmcp-tasks. Passing a bare string like Client("server.py") to run local code is deprecated in favor of Path, for removal in FastMCP 5.

The upgrade guide covers every change and includes a copyable prompt for auditing an application with a coding agent.

Happy (context) engineering!

What's Changed

New Features 🎉
Breaking Changes ⚠️
Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Ho_Chi_Minh)

  • Branch creation
    • "before 5am"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from n24q02m as a code owner September 4, 2026 21:31
@renovate renovate Bot added the dependencies Dependency updates label Sep 4, 2026
@renovate

renovate Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock
Command failed: uv lock --upgrade-package fastmcp
Using CPython 3.13.15 interpreter at: /opt/containerbase/tools/python/3.13.15/bin/python3
  × No solution found when resolving dependencies:
  ╰─▶ Because fastmcp-slim[client]>=4.0.3 depends on mcp>=2.0.0,<3.0.0 and
      fastmcp>=4.0.3 depends on fastmcp-slim[client]==4.0.3, we can conclude
      that fastmcp>=4.0.3 depends on mcp>=2.0.0,<3.0.0.
      And because your project depends on fastmcp>=4.0.3, we can conclude that
      your project depends on mcp>=2.0.0,<3.0.0.
      And because your project depends on mcp>=1.30.0,<2 and your project
      requires better-code-review-graph[security], we can conclude that your
      project's requirements are unsatisfiable.

@github-actions

github-actions Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/fastmcp >= 4.0.3,< 5 UnknownUnknown

Scanned Files

  • pyproject.toml

@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch 2 times, most recently from 26ea59f to 9fc0db6 Compare September 8, 2026 00:35
@renovate
renovate Bot force-pushed the renovate/fastmcp-4.x branch from 9fc0db6 to 3600043 Compare September 10, 2026 15:06
@n24q02m

n24q02m commented Sep 11, 2026

Copy link
Copy Markdown
Owner

Closing: fastmcp 4.x requires mcp>=2.0.0,<3.0.0 (via fastmcp-slim[client]) while this repository pins mcp>=1.30.0,<2, so resolution is unsatisfiable. Taking fastmcp 4 means widening the direct mcp constraint and migrating any direct mcp client usage (e.g. tests driving the server over stdio) to mcp 2.x in the same change. This must land as one grouped fastmcp-4+mcp-2 wave; renovate will recreate the bump afterwards.

@n24q02m n24q02m closed this Sep 11, 2026
@renovate

renovate Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/fastmcp-4.x branch September 11, 2026 00:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@n24q02m n24q02m Awaiting requested review from n24q02m n24q02m is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@n24q02m