Commit graph

3,569 commits

Author SHA1 Message Date
Jeremiah Lowin
9138d40e88
Docs: add v3.4.4 changelog entries (#4473) v3.4.4 2026-07-08 20:30:40 -04:00
shaun smith
d929882f77
Hugging Face Auth Integration (#4385)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-07-08 20:27:44 -04:00
Jeremiah Lowin
5fe4fae535
Restore HTTP host guard compatibility (#4472) 2026-07-08 20:16:44 -04:00
Jeremiah Lowin
400db61b8b
Relax host origin guard defaults (#4439) 2026-07-06 20:59:28 -04:00
Jeremiah Lowin
1eedd1f6f1
Docs: add v3.4.2 and v3.4.3 changelog entries (#4430) v3.4.3 2026-07-05 19:27:01 -04:00
dependabot[bot]
3b1afe6cf1
chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 directory (#4429)
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-05 19:16:30 -04:00
marvin-context-protocol[bot]
874425a113
chore: Update SDK documentation (#4427) 2026-07-05 19:16:03 -04:00
Jeremiah Lowin
691766b5d0
[codex] Fix OpenAPI resource template requests (#4407) 2026-07-05 19:11:03 -04:00
Jeremiah Lowin
47907e0767
Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428) 2026-07-05 19:10:40 -04:00
Jeremiah Lowin
c1b0396c0a
Block IPv6 transition SSRF bypasses (#4426) 2026-07-05 17:52:57 -04:00
陈家名
522ed5bb30
fix: correct replace_type docstring parameter descriptions (#4375) 2026-07-05 17:44:28 -04:00
Jeremiah Lowin
67527c1f69
Block unsafe OAuth redirect schemes (#4419) 2026-07-05 17:16:10 -04:00
Jeremiah Lowin
57a279928d
Protect streamable HTTP from DNS rebinding (#4405) 2026-07-05 17:11:08 -04:00
Jeremiah Lowin
cccb529f50
Fix DCR redirect URI validation (#4408) 2026-07-05 17:05:13 -04:00
fengguodong
0d8844d5a7
Reject empty env var keys (#4410) 2026-06-29 09:42:06 -04:00
Jeremiah Lowin
de521e651d
Fix versioned auth middleware checks (#4401) 2026-06-28 10:43:34 -04:00
Jeremiah Lowin
feaae683a4
[codex] Fix event store replay isolation (#4402) 2026-06-27 12:49:24 -04:00
Jeremiah Lowin
5de15e0c21
Block NAT64 SSRF bypass (#4400) 2026-06-27 12:21:37 -04:00
Jeremiah Lowin
a1dd8b12e1
Fix dev apps launch escaping (#4399) 2026-06-27 12:18:36 -04:00
Jeremiah Lowin
6b2a2d507a
Clarify resource path parameter safety (#4398) 2026-06-27 12:10:37 -04:00
Jeremiah Lowin
a8bb1b08c2
Raise fastmcp.ValidationError for invalid tool arguments (#4392)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2026-06-27 11:14:20 -04:00
Jacky Su
0668eb7b80
Fix/cimd flow issue (#4206) 2026-06-27 10:57:58 -04:00
marvin-context-protocol[bot]
4d5627ba5d
chore: Update SDK documentation (#4360) 2026-06-27 10:36:03 -04:00
dependabot[bot]
7643480bd6
chore(deps): bump joserfc from 1.6.5 to 1.6.7 in the uv group across 1 directory (#4394)
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-27 10:35:50 -04:00
Jeremiah Lowin
dc4b0e202d
fix(tools): honor serialize_by_alias in tool result serialization (#4391) 2026-06-27 10:24:39 -04:00
Jeremiah Lowin
cccff4849e
fix(deps): clear Dependabot security alerts via lockfile bumps (#4393) 2026-06-27 10:22:36 -04:00
Jeremiah Lowin
0cffe41115
fix: validate task tool arguments against declared types (#4373) 2026-06-27 10:03:59 -04:00
Jeremiah Lowin
a612846224
fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374) 2026-06-24 17:16:18 -04:00
Jeremiah Lowin
ade2b3ff46
fix: bracket IPv6 hosts in server startup log URL (#4372) 2026-06-24 17:15:40 -04:00
Jeremiah Lowin
094908042c
fix(resources): round-trip path values with reserved characters in URI templates (#4368) 2026-06-24 13:56:04 -04:00
Jeremiah Lowin
a13e48ea6f
feat(remote): add --verify flag for TLS certificate verification (#4369) 2026-06-24 12:09:22 -04:00
Bobby Davidson
7f2d034f4d
Forward IdP auth errors to MCP client instead of showing HTML error page (#4293)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-06-24 12:09:09 -04:00
Alex LaGuardia
ea63d06241
docs: add audit/event-record recipe for tool-call middleware (#4345)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24 12:03:11 -04:00
Michael@WCD
0d5667bed2
docs: fix 5 broken internal links (auth & providers pages) (#4344)
Co-authored-by: Michael Tierney <MichaelTierney315@outlook.com>
2026-06-24 12:02:20 -04:00
Jianke LIN
ba77e4626b
fix: guard recursive refs in json_schema_to_type (#4312) 2026-06-24 11:53:36 -04:00
Perseus Computing
222742a737
fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown (#4328) 2026-06-24 11:53:22 -04:00
Jeremiah Lowin
6429909f05
Switch prettier hook to rbubley/mirrors-prettier (#4366) 2026-06-24 11:52:40 -04:00
Alex LaGuardia
27a0720928
Add real Monty sandbox e2e coverage for CodeMode call_tool (#4274)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-06-24 11:52:27 -04:00
Jeremiah Lowin
47101eeccd
fix: RST docstrings in fastmcp.types render raw on gofastmcp.com (#4367)
Co-authored-by: Justin van Zyl <justin.vanzyl@xero.com>
2026-06-24 11:52:05 -04:00
Jeremiah Lowin
cf1d821129
fix(fs): isolate same-named package imports across providers (#4361) 2026-06-24 10:57:01 -04:00
Jeremiah Lowin
ddcdf64813
fix(proxy): shield stateful proxy disconnect during session teardown (#4363) 2026-06-24 10:56:40 -04:00
Jeremiah Lowin
5fa4f32cca
Dedupe discriminator-required helper across schema converters (#4362) 2026-06-24 10:54:03 -04:00
dependabot[bot]
0ca2c0d115
chore(deps): bump actions/checkout from 6 to 7 (#4343)
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-24 10:39:32 -04:00
Yufeng He
9b1a1a04e0
fix: preserve required discriminator tags (#4297)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-06-24 10:36:56 -04:00
Jeremiah Lowin
d7730788fa
Recognize all GitHub issue-link forms in require-issue-link workflow (#4359) 2026-06-24 10:28:36 -04:00
Tomasz Czochański
4ce8e2a5d0
Fix: async rate limiting middleware get_client_id callbacks (#4319)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-06-24 10:27:30 -04:00
Greig Menzies
257fe32556
fix: caching middleware TypeError on cache miss due to mismatched call_next parameter (#4301) 2026-06-24 10:27:18 -04:00
Jeremiah Lowin
3b8538e242
Allow private JWT headers (#4290) v3.4.2 2026-06-06 02:23:48 +01:00
marvin-context-protocol[bot]
0445c31fef
chore: Update SDK documentation (#4223) 2026-06-06 02:23:33 +01:00
Jeremiah Lowin
9261793ae0
Docs: add v3.4.1 changelog entries (#4289) 2026-06-06 02:06:45 +01:00