Skip to content

fix(deps): update dependency fastmcp to v2.14.0 [security] #864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency fastmcp to v2.14.0 [security] #864

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 27, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
fastmcp ==2.13.0.2 → ==2.14.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-rcfx-77hg-w2wv

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

Release Notes

jlowin/fastmcp (fastmcp)

v2.14.0: : Task and You Shall Receive

Compare Source

FastMCP 2.14 begins adopting the MCP 2025-11-25 specification, headlined by protocol-native background tasks that let long-running operations report progress without blocking clients. This release also graduates the OpenAPI parser to standard, adds first-class support for several new spec features, and removes deprecated APIs accumulated across the 2.x series.

Background Tasks (SEP-1686)

Long-running operations (like tool calls) normally block MCP clients until they complete. The new MCP background task protocol (SEP-1686) lets clients start operations, track progress, and retrieve results without blocking. For FastMCP users, taking advantage of this new functionality is as easy as adding task=True to any async decorator. Under the hood, it's powered by Docket, the enterprise task scheduler at the heart of Prefect Cloud that handles millions of concurrent tasks every day.

from fastmcp import FastMCP
from fastmcp.dependencies import Progress

mcp = FastMCP("MyServer")

@&#8203;mcp.tool(task=True)
async def train_model(dataset: str, progress: Progress = Progress()) -> str:
    await progress.set_total(100)
    for epoch in range(100):
        # ... training work ...
        await progress.increment()
    return "Model trained successfully"

Clients that call this tool in task-augmented mode (for FastMCP clients, that merely means another task=True!) receive a task ID immediately, poll for progress updates, and fetch results when ready. Background tasks work out-of-the-box with an in-memory backend, and users can optionally provide a Redis URL for persistence, horizontal scaling, and single-digit millisecond task pickup latency. When using Redis, users can also add additional Docket workers to scale out their task processing.

Read the docs here!

OpenAPI Parser Promotion

The experimental OpenAPI parser graduates to standard. The new architecture delivers improved performance through single-pass schema processing and cleaner internal abstractions. Existing code works unchanged; users of the experimental module should update their imports.

MCP 2025-11-25 Spec Support

This release begins adopting the MCP 2025-11-25 specification. Beyond the core SDK updates, FastMCP adds first-class developer experiences for:

  • SEP-1686: Background tasks with progress tracking
  • SEP-1699: SSE polling and event resumability, with full AsyncKeyValue support
  • SEP-1330: Multi-select enum elicitation schemas
  • SEP-1034: Default values for elicitation schemas
  • SEP-986: Tool name validation at registration time

As the MCP SDK continues to adopt more of the specification, FastMCP will add corresponding high-level APIs.

Breaking Changes & Cleanup

This release removes deprecated APIs accumulated across the 2.x series: BearerAuthProvider, Context.get_http_request(), the dependencies parameter, legacy resource prefix formats, and several deprecated methods. The upgrade guide provides migration paths for each.

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Breaking Changes 🛫
Docs 📚

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.2...v2.14.0

v2.13.3: : Pin-ish Line

Compare Source

MCP SDK 1.23 introduced some changes related to the 11/25/25 MCP protocol update that break some patches/workarounds that FastMCP had implemented previously. In particular, OAuth changes in the new protocol changed some implementation details that FastMCP patched; as such 1.23 is not necessarily a breaking SDK change but it is "breaking" for certain FastMCP behaviors.

As a precaution, this release pins mcp<1.23. FastMCP 2.14 will introduce 11/25/25 support (and require mcp>=1.23).

v2.13.2: : Refreshing Changes

Compare Source

FastMCP 2.13.2 polishes the authentication stack with fixes for token refresh, scope handling, and multi-instance deployments. Discord joins the growing roster of built-in OAuth providers, Azure and Google token handling gets more reliable, and proxy classes now properly forward icons and titles. This release also adds CSP customization for consent screens and fixes an edge case where $defs could mutate during tool transforms.

Welcome to 7 new contributors who made their first FastMCP contributions in this release!

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾
  • Add extra_authorize_params and extra_token_params to OIDCProxy by @​jlowin in #​2439

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.1...v2.13.2

v2.13.1: : Heavy Meta

Compare Source

FastMCP 2.13.1 introduces meta parameter support for ToolResult (#​2283), letting tools return metadata alongside results to enable new use cases such as OpenAI's Apps SDK. It also supports client-sent meta (#​2206) as well as improved OAuth capabilities and custom token verifiers (including the new DebugTokenVerifier) and an OCI authentication provider. A large list of enhancements and bugfixes round out the release.

Note that #​2422 excludes MCP SDK 1.21.1 as a permitted dependency version due to a bug that fails FastMCP integration tests.

What's Changed

Enhancements 🔧
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.0.1...v2.13.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - "after 9am every weekday,before 5pm every weekday" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Dec 27, 2025
@renovate renovate bot enabled auto-merge (squash) December 27, 2025 00:35
@renovate
Copy link
Contributor Author

renovate bot commented Dec 27, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: libs/fleet-mcp/uv.lock
Command failed: uv lock --upgrade-package fastmcp
Downloading cpython-3.10.19-linux-x86_64-gnu (download) (27.8MiB)
 Downloaded cpython-3.10.19-linux-x86_64-gnu (download)
Using CPython 3.10.19
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version >= '3.10' and platform_python_implementation !=
  │ 'PyPy'):
  ╰─▶ Because fastmcp==2.14.0 depends on uvicorn>=0.35 and your project
      depends on fastmcp==2.14.0, we can conclude that your project depends
      on uvicorn>=0.35.
      And because your project depends on uvicorn==0.34.0, we can conclude
      that your project's requirements are unsatisfiable.

@renovate renovate bot force-pushed the renovate/pypi-fastmcp-vulnerability branch from 4dc2520 to 0b38f52 Compare January 4, 2026 13:09
@github-actions
Copy link

github-actions bot commented Jan 4, 2026 •
edited
Loading

Run report for 69a99e7d (macos-latest, macOS, 0, 1, 1)

Total time: 1m 8s | Comparison time: 10m 25s | Estimated savings: 9m 16s (89.0% faster)

Action Time Status Info
🟩 SyncWorkspace 8.3ms Passed
🟩 SyncProject(claude-code) 0.8ms Passed
🟩 SyncProject(vendir) 0.8ms Passed
🟩 SyncProject(devenv) 0.4ms Passed
🟦 RunTask(claude-code:build) 4.8s Cached
🟦 RunTask(vendir:build) 1m 8s Cached
🟦 RunTask(devenv:test) 619.9ms Cached
Environment

OS: macOS
Matrix:

os = macos-latest
name = macOS
index = 0
total = 1
job_number = 1

Variables:

MOON_TOOLCHAIN_FORCE_GLOBALS = true
Touched files
libs/fleet-mcp/pyproject.toml

@github-actions
Copy link

github-actions bot commented Jan 4, 2026 •
edited
Loading

Run report for 69a99e7d (ubuntu-latest, Linux, 0, 2, 1)

Total time: 9.1ms | Comparison time: 0s | Estimated loss: 9.1ms (100.0% slower)

Action Time Status Info
🟩 SyncWorkspace 9ms Passed
Environment

OS: Linux
Matrix:

os = ubuntu-latest
name = Linux
index = 0
total = 2
job_number = 1

Variables:

MOON_TOOLCHAIN_FORCE_GLOBALS = true
Touched files
libs/fleet-mcp/pyproject.toml

@github-actions
Copy link

github-actions bot commented Jan 4, 2026 •
edited
Loading

Run report for 69a99e7d (ubuntu-latest, Linux, 1, 2, 2)

Total time: 7s | Comparison time: 34.7s | Estimated savings: 27.7s (79.7% faster)

Action Time Status Info
🟩 SyncWorkspace 8.4ms Passed
🟩 SyncProject(escaperoom) 0.3ms Passed
🟩 SyncProject(fleet-mcp) 0.5ms Passed
🟦 RunTask(escaperoom:test) 767ms Cached
🟦 RunTask(fleet-mcp:build) 1.9s Cached
🟥 RunTask(fleet-mcp:test) 6.9s Failed
🟥 RunTask(fleet-mcp:lint) 7s Failed
Environment

OS: Linux
Matrix:

os = ubuntu-latest
name = Linux
index = 1
total = 2
job_number = 2

Variables:

MOON_TOOLCHAIN_FORCE_GLOBALS = true
Touched files
libs/fleet-mcp/pyproject.toml

@renovate renovate bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 5 times, most recently from fde8664 to 882f0e1 Compare January 8, 2026 13:54
@renovate renovate bot force-pushed the renovate/pypi-fastmcp-vulnerability branch from 882f0e1 to 69a99e7 Compare January 9, 2026 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant