Skip to content

chore(deps): unpin and refresh FastMCP#1052

Merged
phernandez merged 1 commit into
mainfrom
codex/unpin-fastmcp
Jul 14, 2026
Merged

chore(deps): unpin and refresh FastMCP#1052
phernandez merged 1 commit into
mainfrom
codex/unpin-fastmcp

Conversation

@phernandez

Copy link
Copy Markdown
Member

Why

FastMCP was pinned to 3.3.1 while each minor upgrade was validated against the MCP transport matrix. The current 3.4.4 release passes the repository's MCP smoke and transport-routing coverage, so the exact pin can be relaxed while retaining a v3 compatibility boundary.

What Changed

  • replace the exact fastmcp==3.3.1 requirement with fastmcp>=3.3.1,<4
  • regenerate the root lockfile with uv lock --upgrade
  • update FastMCP and FastMCP Slim from 3.3.1 to 3.4.4
  • update the newly available transitive jaraco-functools release from 4.5.0 to 4.6.0

Implementation Details

The <4 upper bound remains intentional: this allows future compatible FastMCP v3 releases without silently adopting a breaking major version. The root dependency set had already received a broad refresh on main, so the regenerated lockfile only changed FastMCP, FastMCP Slim, and jaraco-functools, plus FastMCP's newly declared extras.

Testing

Passed:

  • uv lock --check
  • just test-smoke — 1 passed
  • uv run pytest test-int/cli/test_routing_integration.py -q --no-cov — 32 passed, including stdio, streamable HTTP, and SSE routing
  • just package-check — Claude, Codex, shared skills, Hermes, and OpenClaw package checks passed
  • git diff --check

Broad suite result:

  • just fast-check ran the full suite after dependency changes invalidated testmon: 3,399 passed and 43 skipped
  • its only failure was the live postgres-openai semantic benchmark receiving 429 insufficient_quota from the configured OpenAI account; all FastMCP and local deterministic tests passed

Additional doctor result:

  • just doctor completed initialization, API write, file sync, vector indexing, search, and clean-status checks
  • cleanup then hit the existing sole-default-project guard: Cannot delete default project ... This is the only project in your configuration.

Risks / Follow-ups

The primary risk is behavioral drift in future FastMCP v3 minors. The existing MCP smoke, tool contract, integration, and transport-routing coverage remain the guardrail. FastMCP v4 stays excluded pending an intentional compatibility review.

Signed-off-by: phernandez <paul@basicmachines.co>
@phernandez phernandez merged commit 26846e3 into main Jul 14, 2026
23 checks passed
@phernandez phernandez deleted the codex/unpin-fastmcp branch July 14, 2026 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant