Bump fastmcp minimum to 3.4.2 for the Starlette CVE floor#77
Merged
Conversation
why: 3.4.1 floors starlette>=1.0.1 (CVE-2026-48710), previously only constrained transitively through mcp; 3.4.2 carries that floor. The 3-day uv dependency cooldown that held our floor at 3.4.0 has cleared. what: - pyproject: fastmcp floor >=3.4.0 -> >=3.4.2 - uv.lock: fastmcp resolves to 3.4.2 (starlette to 1.2.1)
why: the fastmcp floor bump needs a Dependencies entry so the starlette CVE-2026-48710 fix it pulls in is recorded for downstream installs. what: - Add a Dependencies entry for the fastmcp >=3.4.2 minimum
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #77 +/- ##
=======================================
Coverage 85.07% 85.07%
=======================================
Files 42 42
Lines 2881 2881
Branches 385 385
=======================================
Hits 2451 2451
Misses 322 322
Partials 108 108 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
why: the Dependencies entry is this branch's only changelog line, so it should carry the PR reference like the other unreleased entries. what: - Add the PR reference to the fastmcp 3.4.2 Dependencies entry
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fastmcpfloor from>=3.4.0to>=3.4.2, picking up fastmcp 3.4.1's explicitstarlette>=1.0.1floor so installs can no longer resolve to a Starlette affected by CVE-2026-48710 — previously this was constrained only transitively throughmcp.fastmcpto3.4.2andstarletteto1.2.1.### Dependenciesin the unreleased changelog.Background: the floor was deliberately held at
>=3.4.0while3.4.1/3.4.2were inside the local uv dependency cooldown; that window has now cleared.Verification
The runtime floor is raised:
rg 'fastmcp>=3.4.2' pyproject.tomlThe lock satisfies the Starlette CVE floor:
rg -A2 '^name = "starlette"' uv.lockTest plan
uv run ruff check .— lint cleanuv run ruff format .— formatting unchangeduv run mypy .— type-check cleanuv run py.test --reruns 0— full suite greenjust build-docs— docs build, CHANGES renders and tool roles resolve