[dependabot]

Bumps fastmcp from 4.0.3 to 4.1.2.

Release notes

Sourced from fastmcp's releases.

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

• Authorize transformed components and prevent denied-resource template fallback by @​zzstoatzz and @​rishid in PrefectHQ/fastmcp#5933
• Bind OAuth client credentials to a configured issuer, including cached-token renewal, by @​zzstoatzz and @​LHMisme420 in PrefectHQ/fastmcp#5933

Enhancements ✨

• Add SEP-2640 Skills extension foundation by @​strawgate in PrefectHQ/fastmcp#5057
• Write down triage and merge norms in docs/development by @​zzstoatzz in PrefectHQ/fastmcp#5872
• Add experimental Skills discovery to SkillsDirectoryProvider by @​zzstoatzz in PrefectHQ/fastmcp#5704

Fixes 🐞

• Do not require websockets for the OAuth callback server by @​asasemahmed in PrefectHQ/fastmcp#5693
• Keep fastmcp.json resolvable when deployment.cwd changes the working directory by @​asasemahmed in PrefectHQ/fastmcp#5700
• Fix ctx.log() failing when extra contains LogRecord attribute names by @​asasemahmed in PrefectHQ/fastmcp#5688
• Use a monotonic clock in the rate limiters by @​asasemahmed in PrefectHQ/fastmcp#5689
• Escape server metadata in the fastmcp inspect text summary by @​asasemahmed in PrefectHQ/fastmcp#5701
• Respect an explicit is_binary=False on FileResource by @​asasemahmed in PrefectHQ/fastmcp#5696
• Follow pagination in the MCP format of fastmcp inspect by @​asasemahmed in PrefectHQ/fastmcp#5691
• Visit each reference once when finding access-restricted properties by @​AarnavNoble in PrefectHQ/fastmcp#5751
• Run sync resource templates in the threadpool by @​hardness1020 in PrefectHQ/fastmcp#5742
• Require openapi-pydantic 0.6.0 so OpenAPI 3.1.2 specs load by @​jsphbtst in PrefectHQ/fastmcp#5647
• Scope FileUpload and session visibility to a stable client on MCP 2026-07-28 by @​zzstoatzz in PrefectHQ/fastmcp#5651
• fix(auth): accept private_key_jwt without form client_id by @​HootRock and @​imranq2 in PrefectHQ/fastmcp#5832
• fix(cli): honor explicit URL transport by @​mikamikasuki in PrefectHQ/fastmcp#5529
• Remove legacy logging state when HTTP sessions close by @​mikamikasuki in PrefectHQ/fastmcp#5539
• Name data-backed File resources consistently with their MIME subtype by @​nandanadileep in PrefectHQ/fastmcp#5568
• fix(client): run Python stdio children in UTF-8 mode by @​ningmao-hlyz in PrefectHQ/fastmcp#5642
• Report an unbindable OAuth callback port instead of SystemExit by @​asasemahmed in PrefectHQ/fastmcp#5692
• Accept ES256 and other RSA/EC algorithms for CIMD private_key_jwt assertions by @​asasemahmed in PrefectHQ/fastmcp#5695
• Preserve icons on transformed tools by @​asasemahmed in PrefectHQ/fastmcp#5702
• Hydrate valid schema defaults while preserving invalid defaults by @​nandanadileep in PrefectHQ/fastmcp#5738
• fix(resources): preserve public metadata in built-in read contents by @​HootRock in PrefectHQ/fastmcp#5778
• Preserve shared dependency scopes without optional task dependencies by @​HootRock and @​BlueX888 in PrefectHQ/fastmcp#5817
• fix: treat non-string skill frontmatter descriptions as absent by @​BlueX888 in PrefectHQ/fastmcp#5823
• fix(resources): preserve component meta for list[ResourceContent] returns by @​BlueX888 in PrefectHQ/fastmcp#5843
• Fall back to the client timeout when resolving claimed results by @​marcinbelczewski in PrefectHQ/fastmcp#5190
• Discover Goose Streamable HTTP extensions by @​jiuyueQ and @​ch-z-hc in PrefectHQ/fastmcp#5582
• Raise ToolError when a tool with an output schema returns an unserializable value by @​massimiliano1991 in PrefectHQ/fastmcp#5063
• Stop deploy tests from spawning PowerShell on every state access by @​zzstoatzz in PrefectHQ/fastmcp#5874
• Give the timeout-override test headroom for the follow-up tools/list by @​zzstoatzz in PrefectHQ/fastmcp#5875
• Keep disabled resources from being served by matching templates by @​zzstoatzz in PrefectHQ/fastmcp#5876

Docs 📚

• Fix codespell typo in v4.1.1 changelog by @​zzstoatzz in PrefectHQ/fastmcp#5818
• context: stop documenting session_id as a cross-request key by @​zzstoatzz in PrefectHQ/fastmcp#5862

Examples & Contrib 💡

• fix(contrib): preserve BulkToolCaller tool prefixes by @​mikamikasuki in PrefectHQ/fastmcp#5555

Other Changes 🦾

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.2.0a1: Skill Issue

FastMCP 4.2's first alpha brings code-defined skills, discovery through mounted and proxied servers, and verified downloads into one workflow. Build a Skill in Python or load one from a folder or package, publish it through SkillCatalogProvider, and let clients discover its metadata or download and export its files. Proxy discovery is opt-in with skills=True. Skills support remains experimental; this prerelease is intended for integration testing. It also includes lazy, shared Prefab renderer resources and backend-addressing fixes. Migration: Skill now represents file contents; the wire metadata model is named MCPSkill. Whole-skill downloads require a standard SKILL.md with a name matching its URI and a description. Exports with overwrite=True replace the installed folder, including locally added files. Ordinary resource providers still support their existing document formats. Thanks to our 8 contributors, including 3 first-time contributors.

Breaking Changes ⚠️

• Make Skill a storage-neutral object with folders as one loader by @​zzstoatzz in #6065

Enhancements ✨

• Rename the resource-era list_skills helper to list_skill_summaries by @​zzstoatzz in #6051
• Discover skills through mounted servers by @​zzstoatzz in #6067
• Share Prefab renderer resources across equivalent tools by @​jlowin, @​fprieto14, and @​keremoktener in #6077
• Export Skill from fastmcp by @​zzstoatzz in #6071
• Add skills discovery to ClientGroup by @​zzstoatzz in #6072
• Add --skills to fastmcp list by @​zzstoatzz in #6073
• Add Client.read_skill and tighten skills docs by @​zzstoatzz in #6087
• Verify and export skills with resource-manifest fallback by @​zzstoatzz in #6086
• Forward Skills discovery through proxies by @​jakekaplan in #5788
• Share strict skill snapshot projection by @​zzstoatzz in #6089
• Use scoped local tests and leave full suites to CI by @​zzstoatzz in #6094
• Share ClientGroup skill client lookup by @​zzstoatzz in #6101
• Share filesystem skill supporting-file reads by @​zzstoatzz in #6102

Security 🔒

• Verify advertised skill frontmatter when reading content by @​zzstoatzz in #6090
• Check skill limits before reading directory and remote files by @​zzstoatzz in #6092

Fixes 🐞

• Make the version-check InvalidURL regression independent of proxy parsing by @​HootRock in #6048
• Build the Prefab renderer page on read, not on resources/list by @​adam-zovos in #6039
• Install mounted skills under their own name in sync_skills by @​zzstoatzz in #6078
• Stage skill exports before replacing installed files by @​zzstoatzz in #6091
• fix: Prefix backend hash addresses with double underscores by @​jlowin and @​BlueX888 in #6100

Docs 📚

• Consolidate skills docs into one Skills over MCP page by @​zzstoatzz in #6049
• Rewrite skills docs around Skill and SkillCatalogProvider by @​zzstoatzz in #6066
• Tighten skills docs examples by @​zzstoatzz in #6070
• Shorten the skills docs page by @​zzstoatzz in #6079
• Badge the skills page as 4.2.0 by @​zzstoatzz in #6083
• Consolidate skills examples around verified Skill values by @​zzstoatzz in #6093

New Contributors

• @​fprieto14 made their first contribution in #6077
• @​keremoktener made their first contribution in #6077
• @​adam-zovos made their first contribution in #6039

... (truncated)

Commits

• 0f4674e docs: add v4.1.2 changelog entries (#5936)
• 85df42f Enforce component authorization and bind OAuth credentials to an issuer (#5933)
• 535a3e1 Remove stray logo.py and unused CodeRabbit config (#5873)
• 49858c3 Keep disabled resources from being served by matching templates (#5876)
• 9921d5e Add experimental Skills discovery to SkillsDirectoryProvider (#5704)
• cb20ad6 Give the timeout-override test headroom for the follow-up tools/list (#5875)
• 623590a Stop deploy tests from spawning PowerShell on every state access (#5874)
• 70ac0ce context: stop documenting session_id as a cross-request key (#5862)
• e1b3e57 Write down triage and merge norms in docs/development (#5872)
• 78e1256 Raise ToolError when a tool with an output schema returns an unserializable v...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.