[dependabot]

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨

• ci: deploy docs through Mintlify's admin API and wait for a verdict by @​zzstoatzz in PrefectHQ/fastmcp#4996
• perf: avoid duplicate startup for mixed-era backends by @​ningmao-hlyz in PrefectHQ/fastmcp#4971
• docs: clarify release title history lookup by @​zzstoatzz in PrefectHQ/fastmcp#5006

Fixes 🐞

• fix: don't infer an output schema for unconstrained sequences by @​fsecada01 in PrefectHQ/fastmcp#4999
• Clean up unfinished Monty callbacks by @​zzstoatzz in PrefectHQ/fastmcp#5005
• Fix task timing field serialization by @​LarryHu0217 in PrefectHQ/fastmcp#5003

Docs 📚

• docs: point What's New at the changelog for later releases by @​zzstoatzz in PrefectHQ/fastmcp#4992
• docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @​zzstoatzz in PrefectHQ/fastmcp#4988
• docs: add v4.0.3 changelog entries by @​zzstoatzz in PrefectHQ/fastmcp#5007

New Contributors

• @​fsecada01 made their first contribution in PrefectHQ/fastmcp#4999
• @​ningmao-hlyz made their first contribution in PrefectHQ/fastmcp#4971

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.5: No Country for Loose Ints

Tool parameters declared strict with Field(strict=True), StrictInt, or a strict model config are honored again, on both direct calls and task submission. Since the SDK v2 migration the server's lax default overrode them and silently coerced values.

Security 🔒

• Add regression test for the unconfigured ID-JAG guard by @​zzstoatzz in #5146

Fixes 🐞

• Preserve field-level strict validation in lax mode by @​zzstoatzz in #5141

Full Changelog: v4.0.4...v4.0.5

v4.0.4: Here Be No Dragons

OpenAPI request bodies get most of the attention in this patch: multipart string arrays are sent as repeated fields, whole-body arguments no longer clobber same-named HTTP parameters, dictionary bodies and raw content types survive intact, and JSON scalar bodies are encoded. On the auth side, OAuthProxy rejects ID-JAG tokens unless identity assertion is configured and refuses non-positive upstream token expiries. Clients now follow empty pagination cursors and servers reject malformed ones.

Enhancements ✨

• Refresh the smart-home example with Hue V2 and native effects by @​zzstoatzz in #5009
• Update CodeMode for pydantic-monty 0.0.21 by @​strawgate in #5033
• Keep linked contributor PRs open while awaiting assignment by @​zzstoatzz in #5048
• Reduce redundant CI execution while preserving required checks by @​zzstoatzz in #5049
• Share and streamline repository skills by @​zzstoatzz in #5013
• Support anthropic 1.x alongside 0.x by @​tdsmith in #5066
• renovate: cap routine PRs at 5 concurrent and 5 per hour by @​zzstoatzz in #5110
• Give docs quality checks a corpus-wide timeout by @​zzstoatzz in #5109
• Resolve ty 0.0.79 warnings from upgrade checks by @​zzstoatzz in #5123

Security 🔒

• Fix #5115: OAuthProxy accepts self-contained ID-JAG tokens even when identity_ass by @​nandanadileep in #5119

Fixes 🐞

• Fix upgrade checks for the M2M storage warning test by @​zzstoatzz in #5040
• Fix OpenAPI query explode defaults by @​zzstoatzz in #5065
• fix(openapi): encode JSON scalar request bodies by @​Gonghan-Princess in #5052
• fix(versions): deterministic meta.fastmcp.versions ordering by @​feiiiiii5 in #4880
• Parse skills frontmatter with yaml.safe_load, falling back to the line parser by @​vishnujayvel in #4701
• Keep client data out of tool validation warnings by @​zzstoatzz in #5106
• fix: follow empty pagination cursors in client lists by @​sicauzxl in #5026
• fix: reject non-positive upstream token expiry by @​sui-ni2 in #4849

... (truncated)

Commits

• 7129236 Add v4.0.3 changelog entries (#5007)
• f79bc82 chore: Update SDK documentation (#4945)
• 6e0859f fix task timing field serialization (#5003)
• 855cb7a Clarify release title history lookup (#5006)
• 6236ac1 Clean up unfinished Monty callbacks (#5005)
• 6c2fbe7 docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 (#4988)
• e68bacc perf: avoid duplicate startup for mixed-era backends (#4971)
• 032b9f6 fix: don't infer an output schema for unconstrained sequences (#4999)
• 75d50ff ci: deploy docs through Mintlify's admin API and wait for a verdict (#4996)
• a338cfb docs: point What's New at the changelog for later releases (#4992)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #130.