Bump fastmcp to ≥3.2.0 once rf-mcp supports it (3 open security advisories)

[raffelino]

Background

fastmcp reaches our dependency tree transitively via rf-mcp, which RoboScope auto-starts on 127.0.0.1:9090 to power keyword discovery, library recommendations, and the AI .roboscope ↔ .robot generation flow.

backend/pyproject.toml currently pins fastmcp<3. rf-mcp 0.31.2 declares only fastmcp>=2.8.0 (no upper bound), but fastmcp 3.x ships API breaks that rf-mcp does not yet support. Removing our pin without an rf-mcp update would risk runtime breakage in the keyword palette + AI generation paths.

Open Dependabot alerts on fastmcp < 3.2.0

Advisory	Severity	Vulnerable API
GHSA-vv7q-7jx5-f767	critical	OpenAPIProvider (SSRF + Path Traversal)
GHSA-rww4-4w9c-7733	high	OAuthProxy callback (Confused Deputy)
GHSA-m8x7-r2rg-vh5g	medium	gemini-cli MCP-tool injection

Why we ship 0.9.0 with this open

None of the three vulnerable APIs are reached through RoboScope's usage of rf-mcp:

• OpenAPIProvider — rf-mcp exposes keyword-discovery tools, it never spins up an OpenAPI-derived MCP server.
• OAuthProxy — rf-mcp has no OAuth proxy flow.
• gemini-cli — RoboScope calls LLM providers directly via httpx; no gemini-cli integration.

The rf-mcp server also binds to 127.0.0.1 only by default. Documented in SECURITY.md under "Known Third-Party Advisories".

Plan

1. Watch rf-mcp releases for a build that declares fastmcp >= 3.2.0.
2. When that release lands:
   • Bump rf-mcp in backend/pyproject.toml to that version.
   • Drop the fastmcp<3 pin (or relax to >=3.2.0,<4).
   • Run the tests/recording/, tests/ai/, and tests/recording/test_v2_* suites to confirm rf-mcp keyword discovery + AI generation still work end-to-end.
   • Smoke-test the Flow Editor's Keyword Palette in a live browser — that's the most user-visible rf-mcp consumer.
3. Ship the bump in 0.9.1.

Workaround for operators

If you bind rf-mcp to a non-loopback interface, manually pin fastmcp >= 3.2.0 in your overrides and accept the (small) rf-mcp compatibility risk until 0.9.1 ships.

References

• Bundled rf-mcp version: 0.31.2
• Bundled fastmcp version (current): 2.14.7
• Pin location: backend/pyproject.toml
• Manager module: backend/src/ai/rf_mcp_manager.py