chore(deps): bump fastmcp from 3.4.4 to 3.4.5

[dependabot]

Bumps fastmcp from 3.4.4 to 3.4.5.

Release notes

Sourced from fastmcp's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in #4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in #4761

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

• Migrate to MCP Python SDK v2 by @​jlowin in #4437
• Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
• Forward-port Hugging Face auth provider by @​jlowin in #4475
• Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483
• Add guard-mode multi-round-trip tools (SEP-2322) by @​jlowin in #4544
• Add FastMCP-native server extension API (SEP-2133) by @​jlowin in #4602
• Add stateless session state (UserSession / SessionId) by @​jlowin in #4604
• Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by @​jlowin in #4603

Breaking Changes ⚠️

• Emit one SERVER span per request and adopt spec-correct error codes by @​jlowin in #4445
• Remove 3.x deprecated module shims and dead parameters by @​jlowin in #4447
• Remove 3.0-deprecated FastMCP server methods by @​jlowin in #4451
• Remove 3.x deprecated parameters and object-mode decorators by @​jlowin in #4453
• Migrate to MCP SDK v2.0.0b2 (httpx2) by @​jlowin in #4503
• Fix typos by @​szepeviktor in #4498
• Stop proxies from validating backend results or mutating shared transports by @​jlowin in #4552
• Surface resource, prompt, and proxy errors on the modern protocol by @​jlowin in #4579
• Negotiate the best mutual protocol era by default by @​jlowin in #4572
• Remove server-initiated sampling and roots from the server API by @​jlowin in #4648
• Remove 3.x-era compatibility shims by @​jlowin in #4661

... (truncated)

Commits

• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• See full diff in compare view