chore(deps): update pip: update fastmcp requirement from <2.14.1,>=2.13.1 to >=2.13.1,<2.14.2 in the python-version-updates group across 1 directory

[dependabot]

Updates the requirements on fastmcp to permit the latest version.
Updates fastmcp to 2.14.1

Release notes

Sourced from fastmcp's releases.

'Tis a Gift to Be Sample

FastMCP 2.14.1 adds support for sampling with tools (SEP-1577). This exciting new feature lets servers pass tools to ctx.sample(), enabling agentic workflows where the server borrows the client's LLM and controls tool execution automatically. Pass any callable as a tool and FastMCP handles the loop: calling the LLM, executing tools, and feeding results back until a final response is produced. For fine-grained control, ctx.sample_step() makes a single LLM call and returns a SampleStep, letting you inspect tool calls, add custom logic, or build your own execution loop. Structured output via result_type returns validated Pydantic models instead of raw text. This release also adds AnthropicSamplingHandler alongside the existing OpenAI handler (newly promoted out of the experimental module), so clients and servers can provide sampling capability across major providers with ease.

What's Changed

New Features 🎉

• SEP-1577: Sampling with tools by @​jlowin in jlowin/fastmcp#2551
• Add AnthropicSamplingHandler by @​jlowin in jlowin/fastmcp#2617

Enhancements 🔧

• Add Python 3.13 to Ubuntu CI tests by @​jlowin in jlowin/fastmcp#2606
• Remove legacy _task_capable_initialize() workaround by @​jlowin in jlowin/fastmcp#2612
• Consolidate session state reset logic and improve cancellation cleanup by @​jlowin in jlowin/fastmcp#2615
• Unify SamplingHandler and promote OpenAI handler by @​jlowin in jlowin/fastmcp#2616
• Add tool_names parameter to mount() for name overrides by @​jlowin in jlowin/fastmcp#2619
• Adopt streamable_http_client API from MCP SDK by @​jlowin in jlowin/fastmcp#2620
• Deprecate exclude_args in favor of Depends() by @​jlowin in jlowin/fastmcp#2621

Fixes 🐞

• fix: prompt tasks returning mcp.types.PromptMessage now work by @​chrisguidry in jlowin/fastmcp#2603
• Use WindowsSelectorEventLoopPolicy to fix Windows test warnings by @​jlowin in jlowin/fastmcp#2607
• Clean up cancelled connection startup by @​shawnthapa in jlowin/fastmcp#2614
• Consolidate sampling examples and fix tool_choice bug by @​jlowin in jlowin/fastmcp#2618

Docs 📚

• docs: simplify Docket tip wording by @​jlowin in jlowin/fastmcp#2599

Dependencies 📦

• chore: bump pydocket to >=0.15.5 by @​chrisguidry in jlowin/fastmcp#2605

New Contributors

• @​shawnthapa made their first contribution in jlowin/fastmcp#2614

Full Changelog: PrefectHQ/fastmcp@v2.14.0...v2.14.1

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true

v2.13.0: Cache Me If You Can

FastMCP 2.13 "Cache Me If You Can" represents a fundamental maturation of the framework. After months of community feedback on authentication and state management, this release delivers the infrastructure FastMCP needs to handle production workloads: persistent storage, response caching, and pragmatic OAuth improvements that reflect real-world deployment challenges.

💾 Pluggable storage backends bring persistent state to FastMCP servers. Built on py-key-value-aio, a new library from FastMCP maintainer Bill Easton (@​strawgate), the storage layer provides encrypted disk storage by default, platform-aware token management, and a simple key-value interface for application state. We're excited to bring this elegantly designed library into the FastMCP ecosystem - it's both powerful and remarkably easy to use, including wrappers to add encryption, TTLs, caching, and more to backends ranging from Elasticsearch, Redis, DynamoDB, filesystem, in-memory, and more! OAuth providers now automatically persist tokens across restarts, and developers can store arbitrary state without reaching for external databases. This foundation enables long-running sessions, cached credentials, and stateful applications built on MCP.

🔐 OAuth maturity brings months of production learnings into the framework. The new consent screen prevents confused deputy and authorization bypass attacks discovered in earlier versions while providing a clean UX with customizable branding. The OAuth proxy now issues its own tokens with automatic key derivation from client secrets, and RFC 7662 token introspection support enables enterprise auth flows. Path prefix mounting enables OAuth-protected servers to integrate into existing web applications under custom paths like /api, and MCP 1.17+ compliance with RFC 9728 ensures protocol compatibility. Combined with improved error handling and platform-aware token storage, OAuth is now production-ready and security-hardened for serious applications.

FastMCP now supports out-of-the-box authentication with:

• WorkOS and AuthKit
• GitHub
• Google
• Azure (Entra ID)
• AWS Cognito
• Auth0
• Descope
• Scalekit
• JWTs
• RFC 7662 token introspection

⚡ Response Caching Middleware dramatically improves performance for expensive operations. Cache tool and resource responses with configurable TTLs, reducing redundant API calls and speeding up repeated queries.

🔄 Server lifespans provide proper initialization and cleanup hooks that run once per server instance instead of per client session. This fixes a long-standing source of confusion in the MCP SDK and enables proper resource management for database connections, background tasks, and other server-level state. Note: this is a breaking behavioral change if you were using the lifespan parameter.

✨ Developer experience improvements include Pydantic input validation for better type safety, icon support for richer UX, RFC 6570 query parameters for resource templates, improved Context API methods (list_resources, list_prompts, get_prompt), and async file/directory resources.

This release includes contributions from 20 new contributors and represents the largest feature set in a while. Thank you to everyone who tested preview builds and filed issues - your feedback shaped these improvements!

Full Changelog: v2.12.5...v2.13.0

v2.12.5: Safety Pin

FastMCP 2.12.5 is a point release that pins the MCP SDK version below 1.17, which introduced a change affecting FastMCP users with auth providers mounted as part of a larger application. This ensures the .well-known payload appears in the expected location when using FastMCP authentication providers with composite applications.

What's Changed

Fixes 🐞

• Pin MCP SDK version below 1.17 by @​jlowin in a1b2c3d

... (truncated)

Commits

• 2f561ec Deprecate exclude_args in favor of Depends() (#2621)
• 076ec0c Adopt streamable_http_client API from MCP SDK (#2620)
• b8ae95a Add tool_names parameter to mount() for name overrides (#2619)
• 577f4d1 Consolidate sampling examples and fix tool_choice bug (#2618)
• c91c43e Add AnthropicSamplingHandler (#2617)
• da77cfa Unify SamplingHandler and promote OpenAI handler (#2616)
• 41ec7ee SEP-1577: Sampling with tools (#2551)
• 0cd3690 Consolidate session state reset logic and improve cancellation cleanup (#2615)
• d26b04f Clean up cancelled connection startup (#2614)
• 08d092b Use WindowsSelectorEventLoopPolicy to fix Windows test warnings (#2607)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.