chore(deps): bump fastmcp from 3.4.2 to 3.4.4 in /mcp_server by dependabot[bot] · Pull Request #111 · saagpatel/notification-hub

dependabot · 2026-07-10T06:06:52Z

Bumps fastmcp from 3.4.2 to 3.4.4.

Release notes

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

Hugging Face Auth Integration by @evalstate in PrefectHQ/fastmcp#4385

Fixes 🐞

Relax host origin guard defaults by @jlowin in PrefectHQ/fastmcp#4439

Restore HTTP host guard compatibility by @jlowin in PrefectHQ/fastmcp#4472

Docs 📚

Docs: add v3.4.4 changelog entries by @jlowin in PrefectHQ/fastmcp#4473

New Contributors

@evalstate made their first contribution in PrefectHQ/fastmcp#4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨

Dedupe discriminator-required helper across schema converters by @jlowin in PrefectHQ/fastmcp#4362

Add real Monty sandbox e2e coverage for CodeMode call_tool by @AlexlaGuardia in PrefectHQ/fastmcp#4274

Switch prettier hook to rbubley/mirrors-prettier by @jlowin in PrefectHQ/fastmcp#4366

feat(remote): add --verify flag for TLS certificate verification by @jlowin in PrefectHQ/fastmcp#4369

Security 🔒

fix(deps): clear Dependabot security alerts via lockfile bumps by @jlowin in PrefectHQ/fastmcp#4393

Clarify resource path parameter safety by @jlowin in PrefectHQ/fastmcp#4398

Fix dev apps launch escaping by @jlowin in PrefectHQ/fastmcp#4399

Block NAT64 SSRF bypass by @jlowin in PrefectHQ/fastmcp#4400

[codex] Fix event store replay isolation by @jlowin in PrefectHQ/fastmcp#4402

Fix DCR redirect URI validation by @jlowin in PrefectHQ/fastmcp#4408

Protect streamable HTTP from DNS rebinding by @jlowin in PrefectHQ/fastmcp#4405

Block unsafe OAuth redirect schemes by @jlowin in PrefectHQ/fastmcp#4419

Block IPv6 transition SSRF bypasses by @jlowin in PrefectHQ/fastmcp#4426

Fixes 🐞

fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @gmenziesint in PrefectHQ/fastmcp#4301

Fix: async rate limiting middleware get_client_id callbacks by @Chotom in PrefectHQ/fastmcp#4319

Recognize all GitHub issue-link forms in require-issue-link workflow by @jlowin in PrefectHQ/fastmcp#4359

fix: preserve required discriminator tags by @he-yufeng in PrefectHQ/fastmcp#4297

fix(proxy): shield stateful proxy disconnect during session teardown by @jlowin in PrefectHQ/fastmcp#4363

fix(fs): isolate same-named package imports across providers by @jlowin in PrefectHQ/fastmcp#4361

fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by @tcconnally in PrefectHQ/fastmcp#4328

fix: guard recursive refs in json_schema_to_type by @Epochex in PrefectHQ/fastmcp#4312

Forward IdP auth errors to MCP client instead of showing HTML error page by @bobbyjames839 in PrefectHQ/fastmcp#4293

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

Hugging Face Auth Integration by @evalstate in #4385

Fixes 🐞

Relax host origin guard defaults by @jlowin in #4439

Restore HTTP host guard compatibility by @jlowin in #4472

New Contributors

@evalstate made their first contribution in #4385

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

Enhancements ✨

Dedupe discriminator-required helper across schema converters by @jlowin in #4362

Add real Monty sandbox e2e coverage for CodeMode call_tool by @AlexlaGuardia in #4274

Switch prettier hook to rbubley/mirrors-prettier by @jlowin in #4366

feat(remote): add --verify flag for TLS certificate verification by @jlowin in #4369

Security 🔒

fix(deps): clear Dependabot security alerts via lockfile bumps by @jlowin in #4393

Clarify resource path parameter safety by @jlowin in #4398

Fix dev apps launch escaping by @jlowin in #4399

Block NAT64 SSRF bypass by @jlowin in #4400

[codex] Fix event store replay isolation by @jlowin in #4402

Fix DCR redirect URI validation by @jlowin in #4408

Protect streamable HTTP from DNS rebinding by @jlowin in #4405

Block unsafe OAuth redirect schemes by @jlowin in #4419

Block IPv6 transition SSRF bypasses by @jlowin in #4426

Fixes 🐞

fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @gmenziesint in #4301

Fix: async rate limiting middleware get_client_id callbacks by @Chotom in #4319

... (truncated)

Commits

9138d40 Docs: add v3.4.4 changelog entries (#4473)
d929882 Hugging Face Auth Integration (#4385)
5fe4fae Restore HTTP host guard compatibility (#4472)
400db61 Relax host origin guard defaults (#4439)
1eedd1f Docs: add v3.4.2 and v3.4.3 changelog entries (#4430)
3b1afe6 chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...
874425a chore: Update SDK documentation (#4427)
691766b [codex] Fix OpenAPI resource template requests (#4407)
47907e0 Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)
c1b0396 Block IPv6 transition SSRF bypasses (#4426)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.2 to 3.4.4. - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.4.2...v3.4.4) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 3.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump fastmcp from 3.4.2 to 3.4.4 in /mcp_server#111

chore(deps): bump fastmcp from 3.4.2 to 3.4.4 in /mcp_server#111
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/mcp_server/fastmcp-3.4.4

dependabot Bot commented on behalf of github Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026

v3.4.4: Host in Translation

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

v3.4.3: The Fast and the Secure-ious

What's Changed

Enhancements ✨

Security 🔒

Fixes 🐞

title: "Changelog" icon: "list-check" rss: true tag: NEW

Enhancements ✨

Fixes 🐞

New Contributors

Enhancements ✨

Security 🔒

Fixes 🐞

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants