chore(deps): bump fastmcp from 3.2.4 to 3.4.4 - #672
Conversation
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.2.4 to 3.4.4. - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.2.4...v3.4.4) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 3.4.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependency ReviewThe following issues were found:
License Issuesuv.lock
OpenSSF Scorecard
Scanned Files
|
Completed Working on "Code Review"✅ Review published successfully. Posted all chunk comments and submitted final review: COMMENT with 1 total comment across 1 file. ✅ Workflow completed successfully. |
![overcut-ai[bot]](https://avatars.githubusercontent.com/in/1367736?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
- BLOCKER: 0
- CRITICAL: 0
- MAJOR: 1
- MINOR: 0
- SUGGESTION: 0
- PRAISE: 0
Key theme: Dependency composition/runtime surface increased due to package split and extras resolution (fastmcp -> fastmcp-slim[client,server]).
Actionable next step: Restrict fastmcp extras to only the mode this project actually needs (e.g., server-only) and regenerate uv.lock to reduce unnecessary transitive dependencies and risk exposure.
| version = "3.4.4" | ||
| source = { registry = "https://pypi.org/simple" } | ||
| dependencies = [ | ||
| { name = "fastmcp-slim", extra = ["client", "server"] }, |
There was a problem hiding this comment.
[major]: The dependency update now brings in fastmcp-slim[client,server] through fastmcp, which changes transitive composition and broadens installed runtime surface versus a single-mode install. If this project only uses one mode, this adds unnecessary dependencies and potential risk without functional gain.
|
Combined into #678. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Combines the following Dependabot updates into a single PR: - Bump mcp from 1.27.2 to 1.28.1 (#663) - Bump actions/setup-python from 6.3.0 to 7.0.0 (#665) - Bump actions/checkout from 7.0.0 to 7.0.1 (#666) - Bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#667) - Bump openai from 2.45.0 to 2.48.0 (#668) - Bump fastapi from 0.139.0 to 0.140.0 (#669) - Bump sqlglot from 30.12.0 to 30.13.0 (#670) - Bump snowflake-connector-python from 4.6.0 to 4.7.1 (#671) - Bump fastmcp from 3.2.4 to 3.4.4 (#672) - Bump brace-expansion from 5.0.7 to 5.0.9 (latest available) in /app (#674) - Bump rojopolis/spellcheck-github-actions from 0.63.0 to 0.63.1 (#675) - Bump docker/login-action from 4.4.0 to 4.6.0 (#676) - Bump the npm-minor-patch group across 1 directory with 29 updates in /app (#677) Verified locally: uv run pytest (210 passed), uv run pylint (10.00/10), npm run lint and npm run build (in app/), all against a running FalkorDB container. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 participant
Bumps fastmcp from 3.2.4 to 3.4.4.
Release notes
Sourced from fastmcp's releases.
... (truncated)
Changelog
Sourced from fastmcp's changelog.
... (truncated)
Commits
9138d40Docs: add v3.4.4 changelog entries (#4473)d929882Hugging Face Auth Integration (#4385)5fe4faeRestore HTTP host guard compatibility (#4472)400db61Relax host origin guard defaults (#4439)1eedd1fDocs: add v3.4.2 and v3.4.3 changelog entries (#4430)3b1afe6chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...874425achore: Update SDK documentation (#4427)691766b[codex] Fix OpenAPI resource template requests (#4407)47907e0Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)c1b0396Block IPv6 transition SSRF bypasses (#4426)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)