perso/mcp-maildir
4
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

chore(deps): update dependency fastmcp to v3.4.3 #28

Merged
jcabillot merged 1 commits from renovate/fastmcp-3.x into main 2026-07-09 12:22:47 -04:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-07-07 20:05:54 -04:00
Member
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
fastmcp ==3.4.2 → ==3.4.3 age confidence

Release Notes

PrefectHQ/fastmcp (fastmcp)

v3.4.3: : The Fast and the Secure-ious

Compare Source

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fastmcp](https://github.com/PrefectHQ/fastmcp) | `==3.4.2` → `==3.4.3` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/fastmcp/3.4.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/fastmcp/3.4.2/3.4.3?slim=true) | --- ### Release Notes <details> <summary>PrefectHQ/fastmcp (fastmcp)</summary> ### [`v3.4.3`](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.3): : The Fast and the Secure-ious [Compare Source](https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3) FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues. <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### Enhancements ✨ - Dedupe discriminator-required helper across schema converters by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4362](https://github.com/PrefectHQ/fastmcp/pull/4362) - Add real Monty sandbox e2e coverage for CodeMode call\_tool by [@&#8203;AlexlaGuardia](https://github.com/AlexlaGuardia) in [#&#8203;4274](https://github.com/PrefectHQ/fastmcp/pull/4274) - Switch prettier hook to rbubley/mirrors-prettier by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4366](https://github.com/PrefectHQ/fastmcp/pull/4366) - feat(remote): add --verify flag for TLS certificate verification by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4369](https://github.com/PrefectHQ/fastmcp/pull/4369) ##### Security 🔒 - fix(deps): clear Dependabot security alerts via lockfile bumps by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4393](https://github.com/PrefectHQ/fastmcp/pull/4393) - Clarify resource path parameter safety by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4398](https://github.com/PrefectHQ/fastmcp/pull/4398) - Fix dev apps launch escaping by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4399](https://github.com/PrefectHQ/fastmcp/pull/4399) - Block NAT64 SSRF bypass by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4400](https://github.com/PrefectHQ/fastmcp/pull/4400) - \[codex] Fix event store replay isolation by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4402](https://github.com/PrefectHQ/fastmcp/pull/4402) - Fix DCR redirect URI validation by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4408](https://github.com/PrefectHQ/fastmcp/pull/4408) - Protect streamable HTTP from DNS rebinding by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4405](https://github.com/PrefectHQ/fastmcp/pull/4405) - Block unsafe OAuth redirect schemes by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4419](https://github.com/PrefectHQ/fastmcp/pull/4419) - Block IPv6 transition SSRF bypasses by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4426](https://github.com/PrefectHQ/fastmcp/pull/4426) ##### Fixes 🐞 - fix: caching middleware TypeError on cache miss due to mismatched call\_next parameter by [@&#8203;gmenziesint](https://github.com/gmenziesint) in [#&#8203;4301](https://github.com/PrefectHQ/fastmcp/pull/4301) - Fix: async rate limiting middleware get\_client\_id callbacks by [@&#8203;Chotom](https://github.com/Chotom) in [#&#8203;4319](https://github.com/PrefectHQ/fastmcp/pull/4319) - Recognize all GitHub issue-link forms in require-issue-link workflow by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4359](https://github.com/PrefectHQ/fastmcp/pull/4359) - fix: preserve required discriminator tags by [@&#8203;he-yufeng](https://github.com/he-yufeng) in [#&#8203;4297](https://github.com/PrefectHQ/fastmcp/pull/4297) - fix(proxy): shield stateful proxy disconnect during session teardown by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4363](https://github.com/PrefectHQ/fastmcp/pull/4363) - fix(fs): isolate same-named package imports across providers by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4361](https://github.com/PrefectHQ/fastmcp/pull/4361) - fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by [@&#8203;tcconnally](https://github.com/tcconnally) in [#&#8203;4328](https://github.com/PrefectHQ/fastmcp/pull/4328) - fix: guard recursive refs in json\_schema\_to\_type by [@&#8203;Epochex](https://github.com/Epochex) in [#&#8203;4312](https://github.com/PrefectHQ/fastmcp/pull/4312) - Forward IdP auth errors to MCP client instead of showing HTML error page by [@&#8203;bobbyjames839](https://github.com/bobbyjames839) in [#&#8203;4293](https://github.com/PrefectHQ/fastmcp/pull/4293) - fix(resources): round-trip path values with reserved characters in URI templates by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4368](https://github.com/PrefectHQ/fastmcp/pull/4368) - fix: bracket IPv6 hosts in server startup log URL by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4372](https://github.com/PrefectHQ/fastmcp/pull/4372) - fix: bound default OIDC discovery timeout and expose it on provider wrappers by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4374](https://github.com/PrefectHQ/fastmcp/pull/4374) - fix: validate task tool arguments against declared types by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4373](https://github.com/PrefectHQ/fastmcp/pull/4373) - fix(tools): honor serialize\_by\_alias in tool result serialization by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4391](https://github.com/PrefectHQ/fastmcp/pull/4391) - Fix/cimd flow issue by [@&#8203;twjackysu](https://github.com/twjackysu) in [#&#8203;4206](https://github.com/PrefectHQ/fastmcp/pull/4206) - Reject empty env var keys by [@&#8203;CodingFeng101](https://github.com/CodingFeng101) in [#&#8203;4410](https://github.com/PrefectHQ/fastmcp/pull/4410) - fix: correct replace\_type docstring parameter descriptions by [@&#8203;hiSandog](https://github.com/hiSandog) in [#&#8203;4375](https://github.com/PrefectHQ/fastmcp/pull/4375) - Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4428](https://github.com/PrefectHQ/fastmcp/pull/4428) - \[codex] Fix OpenAPI resource template requests by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4407](https://github.com/PrefectHQ/fastmcp/pull/4407) ##### Docs 📚 - fix: RST docstrings in fastmcp.types render raw on gofastmcp.com by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4367](https://github.com/PrefectHQ/fastmcp/pull/4367) - docs: fix 5 broken internal links (auth & providers pages) by [@&#8203;Michael-WhiteCapData](https://github.com/Michael-WhiteCapData) in [#&#8203;4344](https://github.com/PrefectHQ/fastmcp/pull/4344) - docs: add audit/event-record recipe for tool-call middleware by [@&#8203;AlexlaGuardia](https://github.com/AlexlaGuardia) in [#&#8203;4345](https://github.com/PrefectHQ/fastmcp/pull/4345) ##### Dependencies 📦 - chore(deps): bump actions/checkout from 6 to 7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;4343](https://github.com/PrefectHQ/fastmcp/pull/4343) - chore(deps): bump joserfc from 1.6.5 to 1.6.7 in the uv group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;4394](https://github.com/PrefectHQ/fastmcp/pull/4394) - chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;4429](https://github.com/PrefectHQ/fastmcp/pull/4429) ##### Other Changes 🦾 - Raise fastmcp.ValidationError for invalid tool arguments by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4392](https://github.com/PrefectHQ/fastmcp/pull/4392) - Fix versioned auth middleware checks by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4401](https://github.com/PrefectHQ/fastmcp/pull/4401) - Docs: add v3.4.2 and v3.4.3 changelog entries by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4430](https://github.com/PrefectHQ/fastmcp/pull/4430) #### New Contributors - [@&#8203;gmenziesint](https://github.com/gmenziesint) made their first contribution in [#&#8203;4301](https://github.com/PrefectHQ/fastmcp/pull/4301) - [@&#8203;Chotom](https://github.com/Chotom) made their first contribution in [#&#8203;4319](https://github.com/PrefectHQ/fastmcp/pull/4319) - [@&#8203;he-yufeng](https://github.com/he-yufeng) made their first contribution in [#&#8203;4297](https://github.com/PrefectHQ/fastmcp/pull/4297) - [@&#8203;AlexlaGuardia](https://github.com/AlexlaGuardia) made their first contribution in [#&#8203;4274](https://github.com/PrefectHQ/fastmcp/pull/4274) - [@&#8203;tcconnally](https://github.com/tcconnally) made their first contribution in [#&#8203;4328](https://github.com/PrefectHQ/fastmcp/pull/4328) - [@&#8203;Epochex](https://github.com/Epochex) made their first contribution in [#&#8203;4312](https://github.com/PrefectHQ/fastmcp/pull/4312) - [@&#8203;Michael-WhiteCapData](https://github.com/Michael-WhiteCapData) made their first contribution in [#&#8203;4344](https://github.com/PrefectHQ/fastmcp/pull/4344) - [@&#8203;bobbyjames839](https://github.com/bobbyjames839) made their first contribution in [#&#8203;4293](https://github.com/PrefectHQ/fastmcp/pull/4293) - [@&#8203;twjackysu](https://github.com/twjackysu) made their first contribution in [#&#8203;4206](https://github.com/PrefectHQ/fastmcp/pull/4206) - [@&#8203;CodingFeng101](https://github.com/CodingFeng101) made their first contribution in [#&#8203;4410](https://github.com/PrefectHQ/fastmcp/pull/4410) - [@&#8203;hiSandog](https://github.com/hiSandog) made their first contribution in [#&#8203;4375](https://github.com/PrefectHQ/fastmcp/pull/4375) **Full Changelog**: <https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
jcabillot was assigned by renovate 2026-07-07 20:05:56 -04:00
renovate added 1 commit 2026-07-09 09:04:22 -04:00
chore(deps): update dependency fastmcp to v3.4.3
renovate/stability-days Updates have met minimum release age requirement
Details
Docker Build and Push / test (pull_request) Successful in 19s
Details
Docker Build and Push / integration-test (pull_request) Successful in 25s
Details
Docker Build and Push / build (pull_request) Successful in 1m26s
Details
ef33d685ab
renovate force-pushed renovate/fastmcp-3.x from d0a41c20ec to ef33d685ab 2026-07-09 09:04:22 -04:00 Compare
jcabillot merged commit 0a2c24f533 into main 2026-07-09 12:22:47 -04:00
jcabillot deleted branch renovate/fastmcp-3.x 2026-07-09 12:22:50 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
cloudix_mcp_server jcabillot opencodecabilloteu renovate
No Assignees jcabillot
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: perso/mcp-maildir#28
Delete Branch "renovate/fastmcp-3.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?