Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 20, 2025

Bumps fastmcp from 2.12.2 to 2.12.5.

Release notes

Sourced from fastmcp's releases.

v2.12.5: Safety Pin

This is a point release to pin the MCP SDK below 1.17, which introduced a change that is affecting some FastMCP users who 1) are using FastMCP auth providers and 2) are mounting their MCP servers as part of a larger application, resulting in the .well-known payload appearing in an unexpected location.

The only change in this release is pinning the SDK version: jlowin/fastmcp@dab2b31

Full Changelog: jlowin/fastmcp@v2.12.4...v2.12.5

v2.12.4: OIDC What You Did There

FastMCP 2.12.4 adds comprehensive OIDC support and expands authentication options with AWS Cognito and Descope providers. The release also includes improvements to logging middleware, URL handling for nested resources, persistent OAuth client registration storage, and various fixes to the experimental OpenAPI parser.

What's Changed

New Features 🎉

Enhancements 🔧

Fixes 🐞

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true

v2.12.5: Safety Pin

FastMCP 2.12.5 is a point release that pins the MCP SDK version below 1.17, which introduced a change affecting FastMCP users with auth providers mounted as part of a larger application. This ensures the .well-known payload appears in the expected location when using FastMCP authentication providers with composite applications.

What's Changed

Fixes 🐞

Full Changelog: v2.12.4...v2.12.5

v2.12.4: OIDC What You Did There

FastMCP 2.12.4 adds comprehensive OIDC support and expands authentication options with AWS Cognito and Descope providers. The release also includes improvements to logging middleware, URL handling for nested resources, persistent OAuth client registration storage, and various fixes to the experimental OpenAPI parser.

What's Changed

New Features 🎉

Enhancements 🔧

Fixes 🐞

... (truncated)

Commits
  • dab2b31 Pin MCP to <1.17 for 2.12.5 patch release
  • b96e6eb Use lowercase namespace for fastmcp logger (#1791)
  • d6aa980 Fix typos discovered by codespell (#1922)
  • df9e5ac Fix route count logging in OpenAPI server (#1928)
  • 5486b5a Add AWS Cognito OAuth Provider for Enterprise Authentication (#1873)
  • fccd081 Clean up code for creating the resource url (#1916)
  • 0a8f8bb descope icon (#1912)
  • eb0db4f Fix: get_resource_url nested URL handling (#1914)
  • 104b965 client: add optional context_arguments to completions (#1906)
  • a41600d Fix: Remove JSON schema title metadata while preserving parameters named 'tit...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [fastmcp](https://github.com/jlowin/fastmcp) from 2.12.2 to 2.12.5.
- [Release notes](https://github.com/jlowin/fastmcp/releases)
- [Changelog](https://github.com/jlowin/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](jlowin/fastmcp@v2.12.2...v2.12.5)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 2.12.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants