Skip to content

fix(deps): update dependencies #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependencies #42

wants to merge 1 commit into from
+629 −920

Conversation

@terraform-ibm-modules-ops
Copy link
Contributor

@terraform-ibm-modules-ops terraform-ibm-modules-ops commented Oct 25, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update
fastmcp ==2.12.5 -> ==2.13.0 age confidence project.dependencies minor
hypothesis (changelog) ==6.140.2 -> ==6.142.4 age confidence project.optional-dependencies minor
pydantic (changelog) ==2.11.9 -> ==2.12.3 age confidence project.dependencies minor
python (source) >=3.11.0 -> ==3.14.0 age confidence requires-python pin
pyyaml (source) >=6.0.2 -> ==6.0.2 age confidence project.dependencies pin
ruff (source, changelog) ==0.14.1 -> ==0.14.2 age confidence project.optional-dependencies patch
ruff (source, changelog) ==0.14.1 -> ==0.14.2 age confidence dependency-groups patch

Release Notes

jlowin/fastmcp (fastmcp)

v2.13.0: : Cache Me If You Can

Compare Source

FastMCP 2.13.0 "Cache Me If You Can" represents a fundamental maturation of the framework. After months of community feedback on authentication and state management, this release delivers the infrastructure FastMCP needs to handle production workloads: persistent storage, response caching, and pragmatic OAuth improvements that reflect real-world deployment challenges.

💾 Pluggable storage backends bring persistent state to FastMCP servers. Built on py-key-value-aio, a new library from FastMCP maintainer Bill Easton (@​strawgate), the storage layer provides encrypted disk storage by default, platform-aware token management, and a simple key-value interface for application state. We're excited to bring this elegantly designed library into the FastMCP ecosystem - it's both powerful and remarkably easy to use, including wrappers to add encryption, TTLs, caching, and more to backends ranging from Elasticsearch, Redis, DynamoDB, filesystem, in-memory, and more! OAuth providers now automatically persist tokens across restarts, and developers can store arbitrary state without reaching for external databases. This foundation enables long-running sessions, cached credentials, and stateful applications built on MCP.

🔐 OAuth maturity brings months of production learnings into the framework. The new consent screen prevents confused deputy and authorization bypass attacks discovered in earlier versions while providing a clean UX with customizable branding. The OAuth proxy now issues its own tokens with automatic key derivation from client secrets, and RFC 7662 token introspection support enables enterprise auth flows. Path prefix mounting enables OAuth-protected servers to integrate into existing web applications under custom paths like /api, and MCP 1.17+ compliance with RFC 9728 ensures protocol compatibility. Combined with improved error handling and platform-aware token storage, OAuth is now production-ready and security-hardened for serious applications.

FastMCP now supports out-of-the-box authentication with:

⚡ Response Caching Middleware dramatically improves performance for expensive operations. Cache tool and resource responses with configurable TTLs, reducing redundant API calls and speeding up repeated queries.

🔄 Server lifespans provide proper initialization and cleanup hooks that run once per server instance instead of per client session. This fixes a long-standing source of confusion in the MCP SDK and enables proper resource management for database connections, background tasks, and other server-level state. Note: this is a breaking behavioral change if you were using the lifespan parameter.

✨ Developer experience improvements include Pydantic input validation for better type safety, icon support for richer UX, RFC 6570 query parameters for resource templates, improved Context API methods (list_resources, list_prompts, get_prompt), and async file/directory resources.

This release includes contributions from 20 new contributors and represents the largest feature set in a while. Thank you to everyone who tested preview builds and filed issues - your feedback shaped these improvements!

What's Changed

New Features 🎉
Enhancements 🔧
Fixes 🐞
Breaking Changes 🛫
Docs 📚
Dependencies 📦
Other Changes 🦾

New Contributors

Full Changelog: jlowin/fastmcp@v2.12.4...v2.13.0

pydantic/pydantic (pydantic)

v2.12.3

Compare Source

GitHub release

What's Changed

This is the third 2.12 patch release, fixing issues related to the FieldInfo class, and reverting a change to the supported
after model validator function signatures.

  • Raise a warning when an invalid after model validator function signature is raised by @​Viicos in #​12414.
    Starting in 2.12.0, using class methods for after model validators raised an error, but the error wasn't raised concistently. We decided
    to emit a deprecation warning instead.
  • Add FieldInfo.asdict() method, improve documentation around FieldInfo by @​Viicos in #​12411.
    This also add back support for mutations on FieldInfo classes, that are reused as Annotated metadata. However, note that this is still
    not a supported pattern. Instead, please refer to the added example in the documentation.

The blog post section on changes was also updated to document the changes related to serialize_as_any.

v2.12.2

Compare Source

GitHub release

What's Changed
Fixes
  • Release a new pydantic-core version, as a corrupted CPython 3.10 manylinux2014_aarch64 wheel got uploaded (pydantic-core#1843).
  • Fix issue with recursive generic models with a parent model class by @​Viicos in #​12398

v2.12.1

Compare Source

GitHub release

What's Changed

This is the first 2.12 patch release, addressing most (but not all yet) regressions from the initial 2.12.0 release.

Fixes
New Contributors

v2.12.0

Compare Source

GitHub release

What's Changed

This is the final 2.12 release. It features the work of 20 external contributors and provides useful new features, along with initial Python 3.14 support.
Several minor changes (considered non-breaking changes according to our versioning policy)
are also included in this release. Make sure to look into them before upgrading.

Note that Pydantic V1 is not compatible with Python 3.14 and greater.

Changes (see the alpha and beta releases for additional changes since 2.11):

Packaging
New Features
Fixes
New Contributors

v2.11.10

Compare Source

GitHub release

What's Changed
Fixes
astral-sh/ruff (ruff)

v0.14.2

Compare Source

Released on 2025-10-23.

Preview features
  • [flake8-gettext] Resolve qualified names and built-in bindings (INT001, INT002, INT003) (#​19045)
Bug fixes
  • Avoid reusing nested, interpolated quotes before Python 3.12 (#​20930)
  • Catch syntax errors in nested interpolations before Python 3.12 (#​20949)
  • [fastapi] Handle ellipsis defaults in FAST002 autofix (#​20810)
  • [flake8-simplify] Skip SIM911 when unknown arguments are present (#​20697)
  • [pyupgrade] Always parenthesize assignment expressions in fix for f-string (UP032) (#​21003)
  • [pyupgrade] Fix UP032 conversion for decimal ints with underscores (#​21022)
  • [fastapi] Skip autofix for keyword and __debug__ path params (FAST003) (#​20960)
Rule changes
  • [flake8-bugbear] Skip B905 and B912 for fewer than two iterables and no starred arguments (#​20998)
  • [ruff] Use DiagnosticTag for more pyflakes and pandas rules (#​20801)
CLI
  • Improve JSON output from ruff rule (#​20168)
Documentation
Other changes
  • [syntax-errors] Name is parameter and global (#​20426)
  • [syntax-errors] Alternative match patterns bind different names (#​20682)
Contributors

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@terraform-ibm-modules-dev
Copy link

/run pipeline

@terraform-ibm-modules-dev
Copy link

/run pipeline

@terraform-ibm-modules-dev
Copy link

/run pipeline

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vburckhardt vburckhardt Awaiting requested review from vburckhardt vburckhardt is a code owner

@daniel-butler-irl daniel-butler-irl Awaiting requested review from daniel-butler-irl daniel-butler-irl is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@terraform-ibm-modules-ops @terraform-ibm-modules-dev