diff --git a/docs/changelog.mdx b/docs/changelog.mdx index 373f76ab9..9ee438d53 100644 --- a/docs/changelog.mdx +++ b/docs/changelog.mdx @@ -5,6 +5,25 @@ rss: true tag: NEW --- + + +**[v3.4.4: Host in Translation](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.4)** + +FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD. + +### Enhancements ✨ +* Hugging Face Auth Integration by [@evalstate](https://github.com/evalstate) in [#4385](https://github.com/PrefectHQ/fastmcp/pull/4385) +### Fixes 🐞 +* Relax host origin guard defaults by [@jlowin](https://github.com/jlowin) in [#4439](https://github.com/PrefectHQ/fastmcp/pull/4439) +* Restore HTTP host guard compatibility by [@jlowin](https://github.com/jlowin) in [#4472](https://github.com/PrefectHQ/fastmcp/pull/4472) + +## New Contributors +* @evalstate made their first contribution in [#4385](https://github.com/PrefectHQ/fastmcp/pull/4385) + +**Full Changelog**: [v3.4.3...v3.4.4](https://github.com/PrefectHQ/fastmcp/compare/v3.4.3...v3.4.4) + + + **[v3.4.3: The Fast and the Secure-ious](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.3)** @@ -3737,4 +3756,4 @@ This release is highlighted by the ability to handle complex JSON objects as MCP The very first release of FastMCP! πŸŽ‰ **Full Changelog**: [Initial commits](https://github.com/PrefectHQ/fastmcp/commits/v0.1.0) - \ No newline at end of file + diff --git a/docs/updates.mdx b/docs/updates.mdx index 18e8efe2f..0faf12da9 100644 --- a/docs/updates.mdx +++ b/docs/updates.mdx @@ -5,6 +5,22 @@ icon: "sparkles" tag: NEW --- + + +A compatibility patch for HTTP deployments affected by the 3.4.3 Host/Origin guard defaults. FastMCP 3.x now keeps strict Host and Origin validation available for explicit opt-in deployments without rejecting existing ASGI, serverless, and reverse-proxy traffic by default. + +🌐 **HTTP compatibility restored** β€” existing hosted deployments keep accepting their public Host headers unless strict host/origin protection is configured. + +πŸ” **Guard remains available** β€” deployments that know their public host and browser origins can still enable strict validation with `host_origin_protection=True`, `allowed_hosts`, and `allowed_origins`. + +πŸ€— **Hugging Face auth** β€” new OAuth provider support covers public and private Hugging Face apps, with docs and examples for PKCE, Dynamic Client Registration, and CIMD. + + + -