Skip to content

fix(deps): update dependency fastmcp to v2.14.0 [security]#864

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-fastmcp-vulnerability
Open

fix(deps): update dependency fastmcp to v2.14.0 [security]#864
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-fastmcp-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Dec 27, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
fastmcp ==2.13.0.2 → ==2.14.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

GHSA-rcfx-77hg-w2wv

More information

Details

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

Severity

High

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

PrefectHQ/fastmcp (fastmcp)

v2.14.0: : Task and You Shall Receive

Compare Source

FastMCP 2.14 begins adopting the MCP 2025-11-25 specification, headlined by protocol-native background tasks that let long-running operations report progress without blocking clients. This release also graduates the OpenAPI parser to standard, adds first-class support for several new spec features, and removes deprecated APIs accumulated across the 2.x series.

Background Tasks (SEP-1686)

Long-running operations (like tool calls) normally block MCP clients until they complete. The new MCP background task protocol (SEP-1686) lets clients start operations, track progress, and retrieve results without blocking. For FastMCP users, taking advantage of this new functionality is as easy as adding task=True to any async decorator. Under the hood, it's powered by Docket, the enterprise task scheduler at the heart of Prefect Cloud that handles millions of concurrent tasks every day.

from fastmcp import FastMCP
from fastmcp.dependencies import Progress

mcp = FastMCP("MyServer")

@&#8203;mcp.tool(task=True)
async def train_model(dataset: str, progress: Progress = Progress()) -> str:
    await progress.set_total(100)
    for epoch in range(100):
        # ... training work ...
        await progress.increment()
    return "Model trained successfully"

Clients that call this tool in task-augmented mode (for FastMCP clients, that merely means another task=True!) receive a task ID immediately, poll for progress updates, and fetch results when ready. Background tasks work out-of-the-box with an in-memory backend, and users can optionally provide a Redis URL for persistence, horizontal scaling, and single-digit millisecond task pickup latency. When using Redis, users can also add additional Docket workers to scale out their task processing.

Read the docs here!

OpenAPI Parser Promotion

The experimental OpenAPI parser graduates to standard. The new architecture delivers improved performance through single-pass schema processing and cleaner internal abstractions. Existing code works unchanged; users of the experimental module should update their imports.

MCP 2025-11-25 Spec Support

This release begins adopting the MCP 2025-11-25 specification. Beyond the core SDK updates, FastMCP adds first-class developer experiences for:

  • SEP-1686: Background tasks with progress tracking
  • SEP-1699: SSE polling and event resumability, with full AsyncKeyValue support
  • SEP-1330: Multi-select enum elicitation schemas
  • SEP-1034: Default values for elicitation schemas
  • SEP-986: Tool name validation at registration time

As the MCP SDK continues to adopt more of the specification, FastMCP will add corresponding high-level APIs.

Breaking Changes & Cleanup

This release removes deprecated APIs accumulated across the 2.x series: BearerAuthProvider, Context.get_http_request(), the dependencies parameter, legacy resource prefix formats, and several deprecated methods. The upgrade guide provides migration paths for each.

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Breaking Changes 🛫
Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v2.13.2...v2.14.0

v2.13.3: : Pin-ish Line

Compare Source

MCP SDK 1.23 introduced some changes related to the 11/25/25 MCP protocol update that break some patches/workarounds that FastMCP had implemented previously. In particular, OAuth changes in the new protocol changed some implementation details that FastMCP patched; as such 1.23 is not necessarily a breaking SDK change but it is "breaking" for certain FastMCP behaviors.

As a precaution, this release pins mcp<1.23. FastMCP 2.14 will introduce 11/25/25 support (and require mcp>=1.23).

v2.13.2: : Refreshing Changes

Compare Source

FastMCP 2.13.2 polishes the authentication stack with fixes for token refresh, scope handling, and multi-instance deployments. Discord joins the growing roster of built-in OAuth providers, Azure and Google token handling gets more reliable, and proxy classes now properly forward icons and titles. This release also adds CSP customization for consent screens and fixes an edge case where $defs could mutate during tool transforms.

Welcome to 7 new contributors who made their first FastMCP contributions in this release!

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v2.13.1...v2.13.2

v2.13.1: : Heavy Meta

Compare Source

FastMCP 2.13.1 introduces meta parameter support for ToolResult (#​2283), letting tools return metadata alongside results to enable new use cases such as OpenAI's Apps SDK. It also supports client-sent meta (#​2206) as well as improved OAuth capabilities and custom token verifiers (including the new DebugTokenVerifier) and an OCI authentication provider. A large list of enhancements and bugfixes round out the release.

Note that #​2422 excludes MCP SDK 1.21.1 as a permitted dependency version due to a bug that fails FastMCP integration tests.

What's Changed

Enhancements 🔧
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: PrefectHQ/fastmcp@v2.13.0.1...v2.13.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • "after 9am every weekday,before 5pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Dec 27, 2025
@renovate renovate Bot enabled auto-merge (squash) December 27, 2025 00:35
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Dec 27, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: libs/fleet-mcp/uv.lock
Command failed: uv lock --upgrade-package fastmcp
Downloading cpython-3.10.20-linux-x86_64-gnu (download) (28.4MiB)
 Downloaded cpython-3.10.20-linux-x86_64-gnu (download)
Using CPython 3.10.20
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version >= '3.10' and platform_python_implementation !=
  │ 'PyPy'):
  ╰─▶ Because fastmcp==2.14.0 depends on uvicorn>=0.35 and your project
      depends on fastmcp==2.14.0, we can conclude that your project depends
      on uvicorn>=0.35.
      And because your project depends on uvicorn==0.34.0, we can conclude
      that your project's requirements are unsatisfiable.

@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch from 4dc2520 to 0b38f52 Compare January 4, 2026 13:09
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jan 4, 2026 •
edited
Loading

Run report for 056b9439 (macos-latest, macOS, 0, 1, 1)

Total time: 5m 27s | Comparison time: 11m 4s | Estimated savings: 5m 36s (50.7% faster)

Action Time Status Info
🟩 SyncWorkspace 10.8ms Passed
🟩 SyncProject(vendir) 0.5ms Passed
🟩 SyncProject(devenv) 0.3ms Passed
🟦 RunTask(vendir:build) 49.7s Cached
🟩 RunTask(devenv:apply) 4m 37s Passed SLOW
🟦 RunTask(devenv:test) 727.1ms Cached
Environment

OS: macOS
Matrix:

os = macos-latest
name = macOS
index = 0
total = 1
job_number = 1

Variables:

MOON_TOOLCHAIN_FORCE_GLOBALS = true
Touched files
libs/fleet-mcp/pyproject.toml

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jan 4, 2026 •
edited
Loading

Run report for 056b9439 (ubuntu-latest, Linux, 0, 2, 1)

Total time: 14m 49s | Comparison time: 23m 34s | Estimated savings: 8m 44s (37.1% faster)

Action Time Status Info
🟩 SyncWorkspace 9ms Passed
🟩 SyncProject(fleet-mcp) 0.5ms Passed
🟩 SyncProject(devcontainer) 0.4ms Passed
🟦 RunTask(talos-image:generate-sha) 1.1s Cached
🟦 RunTask(fleet-mcp:build) 1.9s Cached
🟩 RunTask(docker:buildx_run) 2s Passed
🟦 RunTask(devcontainers-cli:build) 5.1s Cached
🟥 RunTask(fleet-mcp:lint) 7.7s Failed
🟦 RunTask(vendir:build) 1m 10s Cached
🟦 RunTask(vendir:test) 370.1ms Cached
🟦 RunTask(talos-image:generate-profile) 1.1s Cached
🟩 RunTask(devenv:apply) 30.6s Passed
🟩 RunTask(devcontainer:build) 12m 57s Passed SLOW
🟩 RunTask(devcontainer:test) 41s Passed
Environment

OS: Linux
Matrix:

os = ubuntu-latest
name = Linux
index = 0
total = 2
job_number = 1

Variables:

MOON_TOOLCHAIN_FORCE_GLOBALS = true
Touched files
libs/fleet-mcp/pyproject.toml

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jan 4, 2026 •
edited
Loading

Run report for 056b9439 (ubuntu-latest, Linux, 1, 2, 2)

Total time: 12m 54s | Comparison time: 19m 42s | Estimated savings: 6m 47s (34.5% faster)

Action Time Status Info
🟩 SyncWorkspace 6.7ms Passed
🟩 SyncProject(fleet-mcp) 0.4ms Passed
🟩 SyncProject(devcontainer) 0.3ms Passed
🟩 SyncProject(escaperoom) 0.2ms Passed
🟦 RunTask(talos-image:generate-sha) 639.1ms Cached
🟦 RunTask(devcontainers-cli:build) 1.2s Cached
🟦 RunTask(escaperoom:test) 319ms Cached
🟥 RunTask(fleet-mcp:test) 8.4s Failed
🟩 RunTask(docker:buildx_run) 11.3s Passed
🟦 RunTask(vendir:build) 59s Cached
🟦 RunTask(vendir:test) 380.9ms Cached
🟦 RunTask(talos-image:generate-profile) 1.1s Cached
🟩 RunTask(devenv:apply) 29.2s Passed
🟩 RunTask(devcontainer:build) 11m 55s Passed SLOW
Environment

OS: Linux
Matrix:

os = ubuntu-latest
name = Linux
index = 1
total = 2
job_number = 2

Variables:

MOON_TOOLCHAIN_FORCE_GLOBALS = true
Touched files
libs/fleet-mcp/pyproject.toml

@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 6 times, most recently from 882f0e1 to 69a99e7 Compare January 9, 2026 16:33
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 11 times, most recently from 5c423f9 to d0d4f71 Compare January 18, 2026 08:51
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 6 times, most recently from 99d08d4 to 372641e Compare January 23, 2026 10:30
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 4 times, most recently from d0d6362 to d05e7c4 Compare February 6, 2026 19:32
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 5 times, most recently from cfbd7c8 to 8654150 Compare February 19, 2026 16:46
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 8 times, most recently from fb071fa to 44a91ac Compare March 3, 2026 09:57
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 4 times, most recently from ae54852 to 786b7a3 Compare March 11, 2026 20:29
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 2 times, most recently from 5e36cdd to f37d51a Compare March 16, 2026 15:54
@renovate renovate Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 5 times, most recently from c418e94 to b9d26c3 Compare March 23, 2026 20:40
@renovate renovate Bot changed the title fix(deps): update dependency fastmcp to v2.14.0 [security] fix(deps): update dependency fastmcp to v2.14.0 [security] - autoclosed Mar 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants