perso/mcp-maildir
4
0
Fork 0
Code Issues 1 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

chore(deps): update dependency fastmcp to v3.4.3 #28

Open
renovate wants to merge 1 commits from renovate/fastmcp-3.x into main
pull from: renovate/fastmcp-3.x
merge into: perso:main
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-07-07 20:05:54 -04:00
Member
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
fastmcp ==3.4.2 → ==3.4.3 age confidence

Release Notes

PrefectHQ/fastmcp (fastmcp)

v3.4.3: : The Fast and the Secure-ious

Compare Source

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨
Security 🔒
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fastmcp](https://github.com/PrefectHQ/fastmcp) | `==3.4.2` → `==3.4.3` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/fastmcp/3.4.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/fastmcp/3.4.2/3.4.3?slim=true) | --- ### Release Notes <details> <summary>PrefectHQ/fastmcp (fastmcp)</summary> ### [`v3.4.3`](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.3): : The Fast and the Secure-ious [Compare Source](https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3) FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues. <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### Enhancements ✨ - Dedupe discriminator-required helper across schema converters by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4362](https://github.com/PrefectHQ/fastmcp/pull/4362) - Add real Monty sandbox e2e coverage for CodeMode call\_tool by [@&#8203;AlexlaGuardia](https://github.com/AlexlaGuardia) in [#&#8203;4274](https://github.com/PrefectHQ/fastmcp/pull/4274) - Switch prettier hook to rbubley/mirrors-prettier by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4366](https://github.com/PrefectHQ/fastmcp/pull/4366) - feat(remote): add --verify flag for TLS certificate verification by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4369](https://github.com/PrefectHQ/fastmcp/pull/4369) ##### Security 🔒 - fix(deps): clear Dependabot security alerts via lockfile bumps by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4393](https://github.com/PrefectHQ/fastmcp/pull/4393) - Clarify resource path parameter safety by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4398](https://github.com/PrefectHQ/fastmcp/pull/4398) - Fix dev apps launch escaping by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4399](https://github.com/PrefectHQ/fastmcp/pull/4399) - Block NAT64 SSRF bypass by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4400](https://github.com/PrefectHQ/fastmcp/pull/4400) - \[codex] Fix event store replay isolation by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4402](https://github.com/PrefectHQ/fastmcp/pull/4402) - Fix DCR redirect URI validation by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4408](https://github.com/PrefectHQ/fastmcp/pull/4408) - Protect streamable HTTP from DNS rebinding by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4405](https://github.com/PrefectHQ/fastmcp/pull/4405) - Block unsafe OAuth redirect schemes by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4419](https://github.com/PrefectHQ/fastmcp/pull/4419) - Block IPv6 transition SSRF bypasses by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4426](https://github.com/PrefectHQ/fastmcp/pull/4426) ##### Fixes 🐞 - fix: caching middleware TypeError on cache miss due to mismatched call\_next parameter by [@&#8203;gmenziesint](https://github.com/gmenziesint) in [#&#8203;4301](https://github.com/PrefectHQ/fastmcp/pull/4301) - Fix: async rate limiting middleware get\_client\_id callbacks by [@&#8203;Chotom](https://github.com/Chotom) in [#&#8203;4319](https://github.com/PrefectHQ/fastmcp/pull/4319) - Recognize all GitHub issue-link forms in require-issue-link workflow by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4359](https://github.com/PrefectHQ/fastmcp/pull/4359) - fix: preserve required discriminator tags by [@&#8203;he-yufeng](https://github.com/he-yufeng) in [#&#8203;4297](https://github.com/PrefectHQ/fastmcp/pull/4297) - fix(proxy): shield stateful proxy disconnect during session teardown by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4363](https://github.com/PrefectHQ/fastmcp/pull/4363) - fix(fs): isolate same-named package imports across providers by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4361](https://github.com/PrefectHQ/fastmcp/pull/4361) - fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by [@&#8203;tcconnally](https://github.com/tcconnally) in [#&#8203;4328](https://github.com/PrefectHQ/fastmcp/pull/4328) - fix: guard recursive refs in json\_schema\_to\_type by [@&#8203;Epochex](https://github.com/Epochex) in [#&#8203;4312](https://github.com/PrefectHQ/fastmcp/pull/4312) - Forward IdP auth errors to MCP client instead of showing HTML error page by [@&#8203;bobbyjames839](https://github.com/bobbyjames839) in [#&#8203;4293](https://github.com/PrefectHQ/fastmcp/pull/4293) - fix(resources): round-trip path values with reserved characters in URI templates by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4368](https://github.com/PrefectHQ/fastmcp/pull/4368) - fix: bracket IPv6 hosts in server startup log URL by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4372](https://github.com/PrefectHQ/fastmcp/pull/4372) - fix: bound default OIDC discovery timeout and expose it on provider wrappers by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4374](https://github.com/PrefectHQ/fastmcp/pull/4374) - fix: validate task tool arguments against declared types by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4373](https://github.com/PrefectHQ/fastmcp/pull/4373) - fix(tools): honor serialize\_by\_alias in tool result serialization by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4391](https://github.com/PrefectHQ/fastmcp/pull/4391) - Fix/cimd flow issue by [@&#8203;twjackysu](https://github.com/twjackysu) in [#&#8203;4206](https://github.com/PrefectHQ/fastmcp/pull/4206) - Reject empty env var keys by [@&#8203;CodingFeng101](https://github.com/CodingFeng101) in [#&#8203;4410](https://github.com/PrefectHQ/fastmcp/pull/4410) - fix: correct replace\_type docstring parameter descriptions by [@&#8203;hiSandog](https://github.com/hiSandog) in [#&#8203;4375](https://github.com/PrefectHQ/fastmcp/pull/4375) - Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4428](https://github.com/PrefectHQ/fastmcp/pull/4428) - \[codex] Fix OpenAPI resource template requests by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4407](https://github.com/PrefectHQ/fastmcp/pull/4407) ##### Docs 📚 - fix: RST docstrings in fastmcp.types render raw on gofastmcp.com by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4367](https://github.com/PrefectHQ/fastmcp/pull/4367) - docs: fix 5 broken internal links (auth & providers pages) by [@&#8203;Michael-WhiteCapData](https://github.com/Michael-WhiteCapData) in [#&#8203;4344](https://github.com/PrefectHQ/fastmcp/pull/4344) - docs: add audit/event-record recipe for tool-call middleware by [@&#8203;AlexlaGuardia](https://github.com/AlexlaGuardia) in [#&#8203;4345](https://github.com/PrefectHQ/fastmcp/pull/4345) ##### Dependencies 📦 - chore(deps): bump actions/checkout from 6 to 7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;4343](https://github.com/PrefectHQ/fastmcp/pull/4343) - chore(deps): bump joserfc from 1.6.5 to 1.6.7 in the uv group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;4394](https://github.com/PrefectHQ/fastmcp/pull/4394) - chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;4429](https://github.com/PrefectHQ/fastmcp/pull/4429) ##### Other Changes 🦾 - Raise fastmcp.ValidationError for invalid tool arguments by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4392](https://github.com/PrefectHQ/fastmcp/pull/4392) - Fix versioned auth middleware checks by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4401](https://github.com/PrefectHQ/fastmcp/pull/4401) - Docs: add v3.4.2 and v3.4.3 changelog entries by [@&#8203;jlowin](https://github.com/jlowin) in [#&#8203;4430](https://github.com/PrefectHQ/fastmcp/pull/4430) #### New Contributors - [@&#8203;gmenziesint](https://github.com/gmenziesint) made their first contribution in [#&#8203;4301](https://github.com/PrefectHQ/fastmcp/pull/4301) - [@&#8203;Chotom](https://github.com/Chotom) made their first contribution in [#&#8203;4319](https://github.com/PrefectHQ/fastmcp/pull/4319) - [@&#8203;he-yufeng](https://github.com/he-yufeng) made their first contribution in [#&#8203;4297](https://github.com/PrefectHQ/fastmcp/pull/4297) - [@&#8203;AlexlaGuardia](https://github.com/AlexlaGuardia) made their first contribution in [#&#8203;4274](https://github.com/PrefectHQ/fastmcp/pull/4274) - [@&#8203;tcconnally](https://github.com/tcconnally) made their first contribution in [#&#8203;4328](https://github.com/PrefectHQ/fastmcp/pull/4328) - [@&#8203;Epochex](https://github.com/Epochex) made their first contribution in [#&#8203;4312](https://github.com/PrefectHQ/fastmcp/pull/4312) - [@&#8203;Michael-WhiteCapData](https://github.com/Michael-WhiteCapData) made their first contribution in [#&#8203;4344](https://github.com/PrefectHQ/fastmcp/pull/4344) - [@&#8203;bobbyjames839](https://github.com/bobbyjames839) made their first contribution in [#&#8203;4293](https://github.com/PrefectHQ/fastmcp/pull/4293) - [@&#8203;twjackysu](https://github.com/twjackysu) made their first contribution in [#&#8203;4206](https://github.com/PrefectHQ/fastmcp/pull/4206) - [@&#8203;CodingFeng101](https://github.com/CodingFeng101) made their first contribution in [#&#8203;4410](https://github.com/PrefectHQ/fastmcp/pull/4410) - [@&#8203;hiSandog](https://github.com/hiSandog) made their first contribution in [#&#8203;4375](https://github.com/PrefectHQ/fastmcp/pull/4375) **Full Changelog**: <https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate added 1 commit 2026-07-07 20:05:55 -04:00
chore(deps): update dependency fastmcp to v3.4.3
renovate/stability-days Updates have met minimum release age requirement
Details
Docker Build and Push / test (pull_request) Successful in 24s
Details
Docker Build and Push / integration-test (pull_request) Successful in 2m46s
Details
Docker Build and Push / build (pull_request) Successful in 1m37s
Details
d0a41c20ec
jcabillot was assigned by renovate 2026-07-07 20:05:56 -04:00
Some checks are pending
renovate/stability-days Updates have met minimum release age requirement
Details
Docker Build and Push / test (pull_request) Successful in 24s
Details
Docker Build and Push / integration-test (pull_request) Successful in 2m46s
Details
Docker Build and Push / build (pull_request) Successful in 1m37s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/fastmcp-3.x:renovate/fastmcp-3.x
git checkout renovate/fastmcp-3.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
cloudix_mcp_server jcabillot opencodecabilloteu renovate
No Assignees jcabillot
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: perso/mcp-maildir#28
Delete Branch "renovate/fastmcp-3.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?