Commit graph

3,575 commits

Author SHA1 Message Date
Jeremiah Lowin
8de0c94cbb
Docs: add v3.4.5 changelog entries (#4673) v3.4.5
* Docs: add v3.4.5 changelog entries

* Condense the 3.4.5 entries to patch-release length
2026-07-27 15:12:57 -04:00
Jeremiah Lowin
5daa91bafe
Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema (#4663)
* Don't mutate the caller's schema in compress_schema (#4492)

(cherry picked from commit 6202008cf3)

* Copy schemas iteratively so deep nesting still compresses

(cherry picked from commit 2662e675ca)

* Keep $defs when the reference scan hits its depth limit

(cherry picked from commit 054a6cf3c2)

---------

Co-authored-by: WinkleMad <winklemad@outlook.com>
2026-07-27 15:02:41 -04:00
Jeremiah Lowin
49c5ed5581
Make transformed tool required order deterministic (#4564) (#4665)
(cherry picked from commit 7934124fb5)

Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-27 13:11:04 -04:00
Jeremiah Lowin
87ba18c898
Serialize deep object query parameters (#4523) (#4664)
(cherry picked from commit b623c23183)
2026-07-27 13:10:57 -04:00
Jeremiah Lowin
aa8ab1ee66
Fix Azure scope fallback (#4469) (#4662)
(cherry picked from commit 1d932cc778)

Co-authored-by: nate nowack <thrast36@gmail.com>
2026-07-27 13:10:27 -04:00
Kaki Wang
93696a59f4
Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#4517) (#4631)
(cherry picked from commit 1fca15abe6)

Co-authored-by: Burt Matthews <80060660+earfman@users.noreply.github.com>
2026-07-26 14:02:20 -04:00
Jeremiah Lowin
9138d40e88
Docs: add v3.4.4 changelog entries (#4473) v3.4.4 2026-07-08 20:30:40 -04:00
shaun smith
d929882f77
Hugging Face Auth Integration (#4385)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-07-08 20:27:44 -04:00
Jeremiah Lowin
5fe4fae535
Restore HTTP host guard compatibility (#4472) 2026-07-08 20:16:44 -04:00
Jeremiah Lowin
400db61b8b
Relax host origin guard defaults (#4439) 2026-07-06 20:59:28 -04:00
Jeremiah Lowin
1eedd1f6f1
Docs: add v3.4.2 and v3.4.3 changelog entries (#4430) v3.4.3 2026-07-05 19:27:01 -04:00
dependabot[bot]
3b1afe6cf1
chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 directory (#4429)
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-05 19:16:30 -04:00
marvin-context-protocol[bot]
874425a113
chore: Update SDK documentation (#4427) 2026-07-05 19:16:03 -04:00
Jeremiah Lowin
691766b5d0
[codex] Fix OpenAPI resource template requests (#4407) 2026-07-05 19:11:03 -04:00
Jeremiah Lowin
47907e0767
Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428) 2026-07-05 19:10:40 -04:00
Jeremiah Lowin
c1b0396c0a
Block IPv6 transition SSRF bypasses (#4426) 2026-07-05 17:52:57 -04:00
陈家名
522ed5bb30
fix: correct replace_type docstring parameter descriptions (#4375) 2026-07-05 17:44:28 -04:00
Jeremiah Lowin
67527c1f69
Block unsafe OAuth redirect schemes (#4419) 2026-07-05 17:16:10 -04:00
Jeremiah Lowin
57a279928d
Protect streamable HTTP from DNS rebinding (#4405) 2026-07-05 17:11:08 -04:00
Jeremiah Lowin
cccb529f50
Fix DCR redirect URI validation (#4408) 2026-07-05 17:05:13 -04:00
fengguodong
0d8844d5a7
Reject empty env var keys (#4410) 2026-06-29 09:42:06 -04:00
Jeremiah Lowin
de521e651d
Fix versioned auth middleware checks (#4401) 2026-06-28 10:43:34 -04:00
Jeremiah Lowin
feaae683a4
[codex] Fix event store replay isolation (#4402) 2026-06-27 12:49:24 -04:00
Jeremiah Lowin
5de15e0c21
Block NAT64 SSRF bypass (#4400) 2026-06-27 12:21:37 -04:00
Jeremiah Lowin
a1dd8b12e1
Fix dev apps launch escaping (#4399) 2026-06-27 12:18:36 -04:00
Jeremiah Lowin
6b2a2d507a
Clarify resource path parameter safety (#4398) 2026-06-27 12:10:37 -04:00
Jeremiah Lowin
a8bb1b08c2
Raise fastmcp.ValidationError for invalid tool arguments (#4392)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2026-06-27 11:14:20 -04:00
Jacky Su
0668eb7b80
Fix/cimd flow issue (#4206) 2026-06-27 10:57:58 -04:00
marvin-context-protocol[bot]
4d5627ba5d
chore: Update SDK documentation (#4360) 2026-06-27 10:36:03 -04:00
dependabot[bot]
7643480bd6
chore(deps): bump joserfc from 1.6.5 to 1.6.7 in the uv group across 1 directory (#4394)
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-27 10:35:50 -04:00
Jeremiah Lowin
dc4b0e202d
fix(tools): honor serialize_by_alias in tool result serialization (#4391) 2026-06-27 10:24:39 -04:00
Jeremiah Lowin
cccff4849e
fix(deps): clear Dependabot security alerts via lockfile bumps (#4393) 2026-06-27 10:22:36 -04:00
Jeremiah Lowin
0cffe41115
fix: validate task tool arguments against declared types (#4373) 2026-06-27 10:03:59 -04:00
Jeremiah Lowin
a612846224
fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374) 2026-06-24 17:16:18 -04:00
Jeremiah Lowin
ade2b3ff46
fix: bracket IPv6 hosts in server startup log URL (#4372) 2026-06-24 17:15:40 -04:00
Jeremiah Lowin
094908042c
fix(resources): round-trip path values with reserved characters in URI templates (#4368) 2026-06-24 13:56:04 -04:00
Jeremiah Lowin
a13e48ea6f
feat(remote): add --verify flag for TLS certificate verification (#4369) 2026-06-24 12:09:22 -04:00
Bobby Davidson
7f2d034f4d
Forward IdP auth errors to MCP client instead of showing HTML error page (#4293)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-06-24 12:09:09 -04:00
Alex LaGuardia
ea63d06241
docs: add audit/event-record recipe for tool-call middleware (#4345)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24 12:03:11 -04:00
Michael@WCD
0d5667bed2
docs: fix 5 broken internal links (auth & providers pages) (#4344)
Co-authored-by: Michael Tierney <MichaelTierney315@outlook.com>
2026-06-24 12:02:20 -04:00
Jianke LIN
ba77e4626b
fix: guard recursive refs in json_schema_to_type (#4312) 2026-06-24 11:53:36 -04:00
Perseus Computing
222742a737
fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown (#4328) 2026-06-24 11:53:22 -04:00
Jeremiah Lowin
6429909f05
Switch prettier hook to rbubley/mirrors-prettier (#4366) 2026-06-24 11:52:40 -04:00
Alex LaGuardia
27a0720928
Add real Monty sandbox e2e coverage for CodeMode call_tool (#4274)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-06-24 11:52:27 -04:00
Jeremiah Lowin
47101eeccd
fix: RST docstrings in fastmcp.types render raw on gofastmcp.com (#4367)
Co-authored-by: Justin van Zyl <justin.vanzyl@xero.com>
2026-06-24 11:52:05 -04:00
Jeremiah Lowin
cf1d821129
fix(fs): isolate same-named package imports across providers (#4361) 2026-06-24 10:57:01 -04:00
Jeremiah Lowin
ddcdf64813
fix(proxy): shield stateful proxy disconnect during session teardown (#4363) 2026-06-24 10:56:40 -04:00
Jeremiah Lowin
5fa4f32cca
Dedupe discriminator-required helper across schema converters (#4362) 2026-06-24 10:54:03 -04:00
dependabot[bot]
0ca2c0d115
chore(deps): bump actions/checkout from 6 to 7 (#4343)
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-24 10:39:32 -04:00
Yufeng He
9b1a1a04e0
fix: preserve required discriminator tags (#4297)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-06-24 10:36:56 -04:00