Skip to content

chore(deps): Update dependency fastmcp to 3.4.2#301

Open
robander wants to merge 1 commit into
oracle:mainfrom
robander:starlette
Open

chore(deps): Update dependency fastmcp to 3.4.2#301
robander wants to merge 1 commit into
oracle:mainfrom
robander:starlette

Conversation

@robander

@robander robander commented May 29, 2026

Copy link
Copy Markdown
Member

Description

Package bump fastmcp to pick up latest version of the starlette dependency. This is a recreation of #292 after a rebase to fix conflicts.

This PR was originally submitted to update starlette, but revised to get the latest fastmcp which now updates starlette.

Fixes GHSA-86qp-5c8j-p5mr

This dependency is used by FastAPI, but there is not a version of FastAPI that pins starlette. It looks like they will not be forcing an update, based on a comment here: https://github.com/fastapi/fastapi/discussions/15593and#discussioncomment-17065958

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

  • Test A
  • Test B

Test Configuration:

  • Firmware version:
  • Hardware:
  • Toolchain:
  • SDK:

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

@oracle-contributor-agreement oracle-contributor-agreement Bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label May 29, 2026
@robander robander changed the title Update dependency startlette to 1.0.1 chore(deps): Update dependency startlette to 1.0.1 Jun 1, 2026

@dustin-sale dustin-sale left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you kindly update the CHANGELOG.md files? This is a notable Security update. I dont think my PR for adding changelog guidence has been merged yet but you may refer to that.

@robander

robander commented Jun 5, 2026

Copy link
Copy Markdown
Member Author

@dustin-sale Updated to add changelog entries

@dustin-sale dustin-sale enabled auto-merge (squash) June 5, 2026 18:32
@dustin-sale dustin-sale disabled auto-merge June 5, 2026 18:32

@gebhardtr gebhardtr left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we just bump the fastmcp version now instead?

PrefectHQ/fastmcp#4286

@robander robander changed the title chore(deps): Update dependency startlette to 1.0.1 chore(deps): Update dependency fastmcp to 3.4.2 Jun 10, 2026
@robander robander force-pushed the starlette branch 2 times, most recently from 4d1a15a to bff0996 Compare June 10, 2026 21:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants