Skip to content

chore: update fastmcp requirement from <3,>=2.2.0 to >=2.2.0,<5 in /packages/mcp-hmr - #135

Open
dependabot[bot] wants to merge 1 commit into
readmefrom
dependabot/pip/packages/mcp-hmr/fastmcp-gte-2.2.0-and-lt-5
Open

chore: update fastmcp requirement from <3,>=2.2.0 to >=2.2.0,<5 in /packages/mcp-hmr#135
dependabot[bot] wants to merge 1 commit into
readmefrom
dependabot/pip/packages/mcp-hmr/fastmcp-gte-2.2.0-and-lt-5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v4.0.0: Four Real

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

  • Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
  • Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
  • Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.
  • Argument completion for prompt and resource-template inputs, with already-supplied arguments visible to the handler.
  • Auth for agents and services: identity assertion (SEP-990, beta), provider-neutral role checks, insufficient-scope challenges that name the missing scopes, and client-credentials auth.
  • Infrastructure hooks: server-level cache hints, and Mcp-Method/Mcp-Name routing headers so gateways can route without parsing JSON-RPC.

The framework grew alongside the protocol: dependency injection can bind a dependency to arguments of the call it serves (Depends(get_account, user_id=CallArgument("owner"))) while keeping it out of the tool schema, and ClientGroup manages one client per server with collision-checked namespacing — each member negotiating its own protocol version.

The beta period motivated a bunch of correctness work. Most of it was auth: hardened OAuth consent flows, issuer validation, and JWT verification, plus proxies that strip cookies and connection-owned headers at trust boundaries. The rest was durability and compatibility — encrypted task snapshots, serialized event-store writes, response caching handling empty results, errors, and versioned components, and dozens of smaller fixes from CodeMode to Python 3.14 compat.

Breaking changes: server-initiated sampling and roots are removed (no live connection exists to call back into mid-request), ctx.elicit() is old-protocol-only, FastMCP 3's deprecated APIs are gone, MCP model fields are snake_case (with a warning compatibility bridge for the old names), and background tasks moved to fastmcp-tasks. Passing a bare string like Client("server.py") to run local code is deprecated in favor of Path, for removal in FastMCP 5.

The upgrade guide covers every change and includes a copyable prompt for auditing an application with a coding agent.

Happy (context) engineering!

What's Changed

New Features 🎉

Breaking Changes ⚠️

Enhancements ✨

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

Fixes 🐞

Docs 📚

Full Changelog: v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

Fixes 🐞

Docs 📚

Full Changelog: v4.0.0...v4.0.1

v4.0.0: Four Real

... (truncated)

Commits
  • 7e51c1d docs: add v4.0.0 changelog and updates entries (#4955)
  • aeb98e1 chore: add zzstoatzz alongside jlowin in maintainer references (#4953)
  • 3685866 client: deprecate inferring stdio transports from str, prefer Path (#4941)
  • 977ba66 Fix response cache partitioning for versioned components (#4948)
  • 125717d Accept any issuer scoped to the Descope project (#4909)
  • 1f02114 docs: transport inference trust contract; trim SDK session-group comparison (...
  • 92669e4 chore: Update SDK documentation (#4938)
  • 6182642 docs: cover list_tools and restore client modules in the SDK reference (#4936)
  • 89a7d7a docs: prepare FastMCP 4 beta 5 (#4934)
  • 2a2080c add independent client groups (#4904)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore: update fastmcp requirement in /packages/mcp-hmr
0fc5856 
Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp) to permit the latest version.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v2.2.0...v4.0.0)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 4, 2026
@dependabot dependabot Bot mentioned this pull request Sep 4, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants