Bump fastmcp from 3.4.0 to 3.4.10 in /workflows
Bumps fastmcp from 3.4.0 to 3.4.10.
Release notes
Sourced from fastmcp's releases.
v3.4.10: Back in Check
This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.
What's Changed
Security 🔒
- Backport authorization of transformed components and prevent denied-resource template fallback by
@zzstoatzzand@rishidin PrefectHQ/fastmcp#5934New Contributors
@rishidmade their first contribution in PrefectHQ/fastmcp#5934Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.9...v3.4.10
v3.4.9: Contain Yourself
This release backports security fixes from 4.1: OpenAPI path parameters reject
.and..segments, a skill'sSKILL.mdmust stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.What's Changed
Security 🔒
- [3.x] Backport OpenAPI dot-segment and skill containment fixes by
@zzstoatzz,@GEONWOOHAN, and@avrlab233in PrefectHQ/fastmcp#5765- [3.x] Bound regex tool search with Pydantic's regex engine and a time budget by
@zzstoatzzand@SAYUTIMin PrefectHQ/fastmcp#5768Fixes 🐞
- [3.x] Share JWKS refreshes across key lookups by
@zzstoatzzand@YuvalElbar6in PrefectHQ/fastmcp#5769Docs 📚
- docs: credit contributors in v3.4.8 changelog entries by
@jlowinin PrefectHQ/fastmcp#5450- docs: add v3.4.9 changelog entries by
@zzstoatzzin PrefectHQ/fastmcp#5772New Contributors
@avrlab233made their first contribution in PrefectHQ/fastmcp#5765@SAYUTIMmade their first contribution in PrefectHQ/fastmcp#5768@YuvalElbar6made their first contribution in PrefectHQ/fastmcp#5769Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.8...v3.4.9
v3.4.8: Long Arm of the Patch
This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 2 contributors.
What's Changed
Security 🔒
- [3.x] Apply Host/Origin protection settings to the SSE transport by
@jlowinin PrefectHQ/fastmcp#5428- [3.x] Exclude Cookie from forwarded HTTP headers by
@jlowinin PrefectHQ/fastmcp#5429- [3.x] Pass client CLI arguments literally to Windows .cmd wrappers by
@jlowinand@strawgatein PrefectHQ/fastmcp#5420- [3.x] Use the server's auth provider for component manager routes by
@jlowinand@strawgatein PrefectHQ/fastmcp#5426- [3.x] Bound CIMD cache growth by
@jlowinin PrefectHQ/fastmcp#5430- [3.x] Include resource metadata in component manager auth challenges by
@jlowinin PrefectHQ/fastmcp#5435- [3.x] Apply transforms, enabled state, and auth to hashed tool lookups by
@jlowinand@strawgatein PrefectHQ/fastmcp#5416- [3.x] Build client schema types with create_model and bounded caches by
@jlowinand@strawgatein PrefectHQ/fastmcp#5414
... (truncated)
Changelog
Sourced from fastmcp's changelog.
title: "Changelog" icon: "list-check" rss: true tag: NEW
This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.
Security 🔒
- Backport authorization of transformed components and prevent denied-resource template fallback by
@zzstoatzzand@rishidin #5934New Contributors
Full Changelog: v3.4.9...v3.4.10
This release backports security fixes from 4.1: OpenAPI path parameters reject
.and..segments, a skill'sSKILL.mdmust stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.Security 🔒
- [3.x] Backport OpenAPI dot-segment and skill containment fixes by
@zzstoatzz,@GEONWOOHAN, and@avrlab233in #5765- [3.x] Bound regex tool search with Pydantic's regex engine and a time budget by
@zzstoatzzand@SAYUTIMin #5768Fixes 🐞
- [3.x] Share JWKS refreshes across key lookups by
@zzstoatzzand@YuvalElbar6in #5769Docs 📚
New Contributors
@avrlab233made their first contribution in #5765@SAYUTIMmade their first contribution in #5768@YuvalElbar6made their first contribution in #5769Full Changelog: v3.4.8...v3.4.9
... (truncated)
Commits
1ea6f96docs: add v3.4.10 changelog entries (#5935)8649ba5[3.x] Enforce component authorization after transforms and on resource reads ...83c9764docs: add v3.4.9 changelog entries (#5772)eddc780[3.x] Bound regex tool search with Pydantic's regex engine and a time budget ...bcdb86c[3.x] Share JWKS refreshes across key lookups (#5769)4183eea[3.x] Backport OpenAPI dot-segment and skill containment fixes (#5765)8d71296docs: credit contributors in v3.4.8 changelog entries (#5450)12c7e2edocs: add v3.4.8 changelog entries (#5445)4bacc9e[3.x] OpenAPI components send only declared arguments and keep configured hea...0a6a3a3[3.x] Inline schemas whose pointers pass through alias definitions (#5439)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Bumps fastmcp from 3.4.0 to 3.4.10 in /workflows, pulling in the security and bug fixes backported across the 3.4.x line.
Changes
- Enforces component authorization after transforms, blocks denied resources served by matching templates, rejects OpenAPI
..path segments, keepsSKILL.mdinside its skill folder, bounds regex tool search, and shares JWKS refreshes. - Applies Host/Origin protection to the SSE transport, stops forwarding the
Cookieheader, and uses the server's auth provider for component manager routes. fastmcpnow declaresstarletteas a direct dependency; the lockfile also includes unrelated churn from a uv revision bump (pyobjc marker rewrites and the newpyobjc-framework-pubsub).