Skip to content

build(deps): bump fastmcp from 2.4.0 to 2.12.5 in the patch-and-minor-updates group#2

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/patch-and-minor-updates-0dba9a2c8b
Open

build(deps): bump fastmcp from 2.4.0 to 2.12.5 in the patch-and-minor-updates group#2
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/patch-and-minor-updates-0dba9a2c8b

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 24, 2025

Bumps the patch-and-minor-updates group with 1 update: fastmcp.

Updates fastmcp from 2.4.0 to 2.12.5

Release notes

Sourced from fastmcp's releases.

v2.12.5: Safety Pin

This is a point release to pin the MCP SDK below 1.17, which introduced a change that is affecting some FastMCP users who 1) are using FastMCP auth providers and 2) are mounting their MCP servers as part of a larger application, resulting in the .well-known payload appearing in an unexpected location.

The only change in this release is pinning the SDK version: jlowin/fastmcp@dab2b31

Full Changelog: jlowin/fastmcp@v2.12.4...v2.12.5

v2.12.4: OIDC What You Did There

FastMCP 2.12.4 adds comprehensive OIDC support and expands authentication options with AWS Cognito and Descope providers. The release also includes improvements to logging middleware, URL handling for nested resources, persistent OAuth client registration storage, and various fixes to the experimental OpenAPI parser.

What's Changed

New Features 🎉

Enhancements 🔧

Fixes 🐞

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true

v2.12.5: Safety Pin

FastMCP 2.12.5 is a point release that pins the MCP SDK version below 1.17, which introduced a change affecting FastMCP users with auth providers mounted as part of a larger application. This ensures the .well-known payload appears in the expected location when using FastMCP authentication providers with composite applications.

What's Changed

Fixes 🐞

Full Changelog: v2.12.4...v2.12.5

v2.12.4: OIDC What You Did There

FastMCP 2.12.4 adds comprehensive OIDC support and expands authentication options with AWS Cognito and Descope providers. The release also includes improvements to logging middleware, URL handling for nested resources, persistent OAuth client registration storage, and various fixes to the experimental OpenAPI parser.

What's Changed

New Features 🎉

Enhancements 🔧

Fixes 🐞

... (truncated)

Commits
  • dab2b31 Pin MCP to <1.17 for 2.12.5 patch release
  • b96e6eb Use lowercase namespace for fastmcp logger (#1791)
  • d6aa980 Fix typos discovered by codespell (#1922)
  • df9e5ac Fix route count logging in OpenAPI server (#1928)
  • 5486b5a Add AWS Cognito OAuth Provider for Enterprise Authentication (#1873)
  • fccd081 Clean up code for creating the resource url (#1916)
  • 0a8f8bb descope icon (#1912)
  • eb0db4f Fix: get_resource_url nested URL handling (#1914)
  • 104b965 client: add optional context_arguments to completions (#1906)
  • a41600d Fix: Remove JSON schema title metadata while preserving parameters named 'tit...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Oct 24, 2025

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@coderabbitai
Copy link

coderabbitai bot commented Oct 24, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

@dependabot dependabot bot force-pushed the dependabot/pip/patch-and-minor-updates-0dba9a2c8b branch 2 times, most recently from d04c099 to 1e333c4 Compare October 28, 2025 17:33
@dependabot dependabot bot force-pushed the dependabot/pip/patch-and-minor-updates-0dba9a2c8b branch 2 times, most recently from 5bf5908 to 9b16622 Compare November 17, 2025 10:20
@dependabot dependabot bot force-pushed the dependabot/pip/patch-and-minor-updates-0dba9a2c8b branch from 9b16622 to 4103360 Compare November 24, 2025 10:47
@dependabot dependabot bot force-pushed the dependabot/pip/patch-and-minor-updates-0dba9a2c8b branch from 4103360 to 0e4c878 Compare December 8, 2025 10:40
Bumps the patch-and-minor-updates group with 1 update: [fastmcp](https://github.com/jlowin/fastmcp).


Updates `fastmcp` from 2.4.0 to 2.12.5
- [Release notes](https://github.com/jlowin/fastmcp/releases)
- [Changelog](https://github.com/jlowin/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](jlowin/fastmcp@v2.4.0...v2.12.5)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 2.12.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/pip/patch-and-minor-updates-0dba9a2c8b branch from 0e4c878 to e3846ba Compare December 22, 2025 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants