Skip to content

chore: update fastmcp requirement from <3,>=2.2.0 to >=2.2.0,<4 in /packages/mcp-hmr#78

Open
dependabot[bot] wants to merge 1 commit intoreadmefrom
dependabot/pip/packages/mcp-hmr/fastmcp-gte-2.2.0-and-lt-4
Open

chore: update fastmcp requirement from <3,>=2.2.0 to >=2.2.0,<4 in /packages/mcp-hmr#78
dependabot[bot] wants to merge 1 commit intoreadmefrom
dependabot/pip/packages/mcp-hmr/fastmcp-gte-2.2.0-and-lt-4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 24, 2026

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v3.1.1: 'Tis But a Patch

Pins pydantic-monty<0.0.8 to fix a breaking change in Monty that affects code mode. Monty 0.0.8 removed the external_functions constructor parameter, causing MontySandboxProvider to fail. This patch caps the version so existing installs work correctly.

What's Changed

Fixes 🐞

Full Changelog: PrefectHQ/fastmcp@v3.1.0...v3.1.1

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.0.2: Threecovery Mode II

Two community-contributed fixes: auth headers from MCP transport no longer leak through to downstream OpenAPI APIs, and background task workers now correctly receive the originating request ID. Plus a new docs example for context-aware tool factories.

Fixes 🐞

  • fix: prevent MCP transport auth header from leaking to downstream OpenAPI APIs by @​stakeswky in #3262
  • fix: propagate origin_request_id to background task workers by @​gfortaine in #3175

Docs 📚

Full Changelog: v3.0.1...v3.0.2

v3.0.1: Three-covery Mode

First patch after 3.0 — mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, Tool.from_tool() accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. Also adds verify_id_token to OIDCProxy for providers (like some Azure AD configs) that issue opaque access tokens but standard JWT id_tokens.

Enhancements 🔧

Fixes 🐞

Docs 📚

  • Sync README with welcome.mdx, fix install count by @​jlowin in #3224
  • Document dict-to-Message prompt migration in upgrade guides by @​jlowin in #3225
  • Fix v2 upgrade guide: remove incorrect v1 import advice by @​jlowin in #3226

... (truncated)

Commits
  • 53dab03 Pin pydantic-monty<0.0.8 to fix code mode (#3497)
  • 8bc3136 Restructure docs navigation: CLI section, Composition, More (#3361)
  • 8a356ad Add include_unversioned option to VersionFilter (#3349)
  • fccbd43 Add FASTMCP_TRANSPORT setting for default transport selection (#1796)
  • 404b820 Add ListTools, search limit, and catalog size annotation to CodeMode (#3359)
  • 49534ce Add Google GenAI Sampling Handler (#2977)
  • af55738 feat(contrib): auto-sync MCPMixin decorators with from_function signatures (#...
  • 902b63f chore: Update SDK documentation (#3313)
  • f2dd2e5 Fix session persistence across tool calls in multi-server MCPConfigTransport ...
  • 2ab8beb Remove system role references from docs (#3356)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp) to permit the latest version.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v2.2.0...v3.1.1)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.1.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants