Skip to content

fix(deps): update dependency fastmcp to v2.14.0 [security] #13681

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate-bot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency fastmcp to v2.14.0 [security] #13681

renovate-bot wants to merge 1 commit into from
+355 −218

Conversation

@renovate-bot
Copy link
Contributor

@renovate-bot renovate-bot commented Dec 26, 2025

This PR contains the following updates:

Package Change Age Confidence
fastmcp ==2.13.0 -> ==2.14.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-rcfx-77hg-w2wv

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

Release Notes

jlowin/fastmcp (fastmcp)

v2.14.0: : Task and You Shall Receive

Compare Source

FastMCP 2.14 begins adopting the MCP 2025-11-25 specification, headlined by protocol-native background tasks that let long-running operations report progress without blocking clients. This release also graduates the OpenAPI parser to standard, adds first-class support for several new spec features, and removes deprecated APIs accumulated across the 2.x series.

Background Tasks (SEP-1686)

Long-running operations (like tool calls) normally block MCP clients until they complete. The new MCP background task protocol (SEP-1686) lets clients start operations, track progress, and retrieve results without blocking. For FastMCP users, taking advantage of this new functionality is as easy as adding task=True to any async decorator. Under the hood, it's powered by Docket, the enterprise task scheduler at the heart of Prefect Cloud that handles millions of concurrent tasks every day.

from fastmcp import FastMCP
from fastmcp.dependencies import Progress

mcp = FastMCP("MyServer")

@&#8203;mcp.tool(task=True)
async def train_model(dataset: str, progress: Progress = Progress()) -> str:
    await progress.set_total(100)
    for epoch in range(100):
        # ... training work ...
        await progress.increment()
    return "Model trained successfully"

Clients that call this tool in task-augmented mode (for FastMCP clients, that merely means another task=True!) receive a task ID immediately, poll for progress updates, and fetch results when ready. Background tasks work out-of-the-box with an in-memory backend, and users can optionally provide a Redis URL for persistence, horizontal scaling, and single-digit millisecond task pickup latency. When using Redis, users can also add additional Docket workers to scale out their task processing.

Read the docs here!

OpenAPI Parser Promotion

The experimental OpenAPI parser graduates to standard. The new architecture delivers improved performance through single-pass schema processing and cleaner internal abstractions. Existing code works unchanged; users of the experimental module should update their imports.

MCP 2025-11-25 Spec Support

This release begins adopting the MCP 2025-11-25 specification. Beyond the core SDK updates, FastMCP adds first-class developer experiences for:

  • SEP-1686: Background tasks with progress tracking
  • SEP-1699: SSE polling and event resumability, with full AsyncKeyValue support
  • SEP-1330: Multi-select enum elicitation schemas
  • SEP-1034: Default values for elicitation schemas
  • SEP-986: Tool name validation at registration time

As the MCP SDK continues to adopt more of the specification, FastMCP will add corresponding high-level APIs.

Breaking Changes & Cleanup

This release removes deprecated APIs accumulated across the 2.x series: BearerAuthProvider, Context.get_http_request(), the dependencies parameter, legacy resource prefix formats, and several deprecated methods. The upgrade guide provides migration paths for each.

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Breaking Changes 🛫
Docs 📚

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.2...v2.14.0

v2.13.3: : Pin-ish Line

Compare Source

MCP SDK 1.23 introduced some changes related to the 11/25/25 MCP protocol update that break some patches/workarounds that FastMCP had implemented previously. In particular, OAuth changes in the new protocol changed some implementation details that FastMCP patched; as such 1.23 is not necessarily a breaking SDK change but it is "breaking" for certain FastMCP behaviors.

As a precaution, this release pins mcp<1.23. FastMCP 2.14 will introduce 11/25/25 support (and require mcp>=1.23).

v2.13.2: : Refreshing Changes

Compare Source

FastMCP 2.13.2 polishes the authentication stack with fixes for token refresh, scope handling, and multi-instance deployments. Discord joins the growing roster of built-in OAuth providers, Azure and Google token handling gets more reliable, and proxy classes now properly forward icons and titles. This release also adds CSP customization for consent screens and fixes an edge case where $defs could mutate during tool transforms.

Welcome to 7 new contributors who made their first FastMCP contributions in this release!

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾
  • Add extra_authorize_params and extra_token_params to OIDCProxy by @​jlowin in #​2439

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.1...v2.13.2

v2.13.1: : Heavy Meta

Compare Source

FastMCP 2.13.1 introduces meta parameter support for ToolResult (#​2283), letting tools return metadata alongside results to enable new use cases such as OpenAI's Apps SDK. It also supports client-sent meta (#​2206) as well as improved OAuth capabilities and custom token verifiers (including the new DebugTokenVerifier) and an OCI authentication provider. A large list of enhancements and bugfixes round out the release.

Note that #​2422 excludes MCP SDK 1.21.1 as a permitted dependency version due to a bug that fails FastMCP integration tests.

What's Changed

Enhancements 🔧
Fixes 🐞
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.0.1...v2.13.1

v2.13.0.2: : Cache Me If You Can

Compare Source

Bugfixes

This release includes two critical dependency fixes:

  • Fix py-key-value-aio minimum version (#​2288): Corrected minimum version requirement to 0.2.8 to ensure compatibility
  • Replace openapi-core with jsonschema-path (#​2291): Migrated from openapi-core to jsonschema-path for improved OpenAPI validation performance and stability

v2.13.0.1: : Cache Me If You Can

Compare Source

This release includes an important bugfix for 2.13.0 that affects how the Azure OAuth provider handles scopes.

What's Changed

Enhancements 🔧
Fixes 🐞
Other Changes 🦾

New Contributors

Full Changelog: jlowin/fastmcp@v2.13.0...v2.13.0.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate-bot renovate-bot requested review from a team as code owners December 26, 2025 23:26
@trusted-contributions-gcf trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Dec 26, 2025
@product-auto-label product-auto-label bot added samples Issues that are directly related to samples. api: run Issues related to the Cloud Run API. labels Dec 26, 2025
@gemini-code-assist
Copy link
Contributor

gemini-code-assist bot commented Dec 26, 2025

Summary of Changes

Hello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the fastmcp dependency to v2.14.0, primarily to incorporate crucial security fixes related to the MCP SDK and to introduce significant new features. The update enhances the framework with native support for background tasks, improves OpenAPI parsing, and aligns with the latest MCP specification, while also cleaning up deprecated APIs.

Highlights

  • Dependency Update: Upgrades the fastmcp library from version 2.13.0 to 2.14.0.
  • Security Fix: Addresses a security vulnerability (CVE-2025-66416) by ensuring compatibility with MCP SDK versions that are not vulnerable, as older fastmcp versions allowed vulnerable SDK versions.
  • Background Tasks: Introduces a new protocol for background tasks (SEP-1686), enabling non-blocking execution and progress tracking for long-running operations.
  • OpenAPI Parser Promotion: Promotes the experimental OpenAPI parser to standard, offering improved performance and cleaner abstractions.
  • MCP Specification Support: Adds first-class support for several new features from the MCP 2025-11-25 specification, including SSE polling, multi-select enum elicitation, and tool name validation.
  • API Cleanup: Removes numerous deprecated APIs and features accumulated across the 2.x series, streamlining the library.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@kokoro-team kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Dec 26, 2025
gemini-code-assist[bot]
gemini-code-assist bot reviewed Dec 26, 2025
View reviewed changes
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the fastmcp dependency from 2.13.0 to 2.14.0. This is an important security update to address the vulnerability GHSA-rcfx-77hg-w2wv. I have reviewed the release notes for fastmcp v2.14.0 and its breaking changes. The project's usage of fastmcp in server.py and test_server.py is basic and does not seem to be affected by the breaking changes. The update is safe to merge and necessary for security.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

api: run Issues related to the Cloud Run API. owlbot:run Add this label to trigger the Owlbot post processor. samples Issues that are directly related to samples.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@renovate-bot @kokoro-team