Skip to content

fix: bump fastmcp from 3.2.0 to 4.1.4 in /docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0 - #2539

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0/fastmcp-4.1.4
Closed

fix: bump fastmcp from 3.2.0 to 4.1.4 in /docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0#2539
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0/fastmcp-4.1.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps fastmcp from 3.2.0 to 4.1.4.

Release notes

Sourced from fastmcp's releases.

v4.1.4: Token Gesture

Generated CLIs now preserve remote transports, empty arrays, and parameters whose names collide with their own helpers; mounted servers honor session visibility and mounted_components_raise_on_load_error, a stale client context no longer closes a newer session, and OAuth provider wrappers accept identity assertions. Tasks accept a redis-py credential provider that returns current credentials for each new connection (streaming providers such as redis-entraid's are rejected until Docket can refresh them safely), Redis 8.1.0 is excluded, and custom KeyringStore users must now install py-key-value-aio[keyring] explicitly. Thanks to our 16 contributors, including 9 first-time contributors.

What's Changed

Enhancements ✨

Security 🔒

Fixes 🐞

Docs 📚

New Contributors

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.2.0a2: Skill Waters Run Deep

The second 4.2 alpha carries every fix from 4.1.5 plus the ones that only land on 4.2: Skills discovery through proxies pages its backends with a bound, pre-4.2 Prefab backend addresses rebind through 4.2 proxies, large tool catalogs expand their schemas faster, and kept-alive stdio transports respect each client's timeout. Before tagging, this build ran against pydantic-ai, langchain, agno, Microsoft Agent Framework, and the OpenAI Agents SDK. Skills support remains experimental; this prerelease is intended for integration testing. Behavior changes since a1: JSON Schema const and enum compare by JSON equality, so true no longer passes for 1; prompts/get with a missing argument returns invalid params (-32602); OpenAPI upstream errors are cut to 1 KB with HTML bodies dropped, and strict input validation rejects undeclared OpenAPI arguments; a later client with a different timeout restarts an idle kept-alive stdio subprocess, while one nested inside a live client shares its session's timeout and logs a warning. Thanks to our 22 contributors, including 13 first-time contributors.

Breaking Changes ⚠️

  • Make Skill a storage-neutral object with folders as one loader by @​zzstoatzz in #6065

Enhancements ✨

Security 🔒

  • Verify advertised skill frontmatter when reading content by @​zzstoatzz in #6090
  • Check skill limits before reading directory and remote files by @​zzstoatzz in #6092
  • fix: preserve _list_query_params in FastMCPProviderResourceTemplate.wrap by @​RS-ITACHI in #6130
  • Read composite action inputs from env and pin actions by digest by @​gaker in #6168
  • Scope the /marvin App token to the permissions it uses by @​zzstoatzz in #6206

Fixes 🐞

... (truncated)

Commits
  • 26bf908 docs: add v4.1.4 changelog entries (#6046)
  • d720db2 Measure blocking duration with perf_counter in transform_fn generator test (#...
  • d4af9a8 Add a downstream smoke for Redis credential providers (#6044)
  • eeb6e93 fix(client): forward max_sse_event_size through StreamableHttpTransport (#6016)
  • 4f40ac0 fix(auth): expose identity assertions on OAuth provider wrappers (#6006)
  • de37675 fix(client): keep stale contexts from closing newer sessions (#6018)
  • cb11052 Reject streaming credential providers in TasksExtension (#6043)
  • 4c7cf2b Honor mounted_components_raise_on_load_error in AggregateProvider (#6026)
  • 2ae660a Fix generate-cli commands for tools with a json parameter (#6032)
  • a9a41eb Strip a URL scheme from a Clerk domain (#5921)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
fix: bump fastmcp
ecb78e1 
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.2.0 to 4.1.4.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.2.0...v4.1.4)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
v0-uvai Ready Ready Preview, v0 Nov 2, 2026 2:22pm UTC

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot
dependabot Bot requested a review from groupthinking as a code owner November 2, 2026 14:20
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Nov 2, 2026
@coderabbitai

coderabbitai Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions github-actions Bot added the documentation Improvements or additions to documentation label Nov 2, 2026
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/beartype 0.23.1 UnknownUnknown
pip/certifi 2026.10.23 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 6Found 4/6 approved changesets -- score normalized to 6
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 88 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 8
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/fastmcp 4.1.4 UnknownUnknown
pip/fastmcp-slim 4.1.4 UnknownUnknown
pip/griffelib 2.4.1 UnknownUnknown
pip/httpcore2 2.16.0 UnknownUnknown
pip/httpx2 2.16.0 UnknownUnknown
pip/httpx2-jsfetch 1.0 UnknownUnknown
pip/idna 3.20 UnknownUnknown
pip/mcp 2.3.0 UnknownUnknown
pip/mcp-types 2.3.0 UnknownUnknown
pip/openapi-pydantic 0.6.0 UnknownUnknown
pip/sse-starlette 3.6.0 UnknownUnknown
pip/truststore 0.10.5 UnknownUnknown
pip/uncalled-for 0.4.1 UnknownUnknown

Scanned Files

  • docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0/uv.lock

@groupthinking Hark

groupthinking commented Nov 4, 2026

Copy link
Copy Markdown
Owner

Closing this one. fastmcp 4.1.4 moves the lock from mcp 1.27.2 to 2.3.0. mcp_youtube.py does from mcp.server.fastmcp import Context, FastMCP, and in mcp 2.3.0 mcp/server/fastmcp.py only raises ModuleNotFoundError (FastMCP was renamed to mcp.server.mcpserver.MCPServer). So this bump breaks the server's import. CI here doesn't run that prototype's tests, which is why the checks stay green.

Also, #2557 deletes docs/knowledge_prototypes/ entirely, including this Dependabot directory.

@dependabot @github

dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/uv/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0/fastmcp-4.1.4 branch November 4, 2026 06:42

This branch was successfully deployed

1 active deployment
Preview — ecb78e16 Deployed Nov 2, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@groupthinking groupthinking Awaiting requested review from groupthinking groupthinking is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@groupthinking