build(deps): bump fastmcp from 3.4.7 to 4.0.3

[dependabot]

Bumps fastmcp from 3.4.7 to 4.0.3.

Release notes

Sourced from fastmcp's releases.

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨

• ci: deploy docs through Mintlify's admin API and wait for a verdict by @​zzstoatzz in PrefectHQ/fastmcp#4996
• perf: avoid duplicate startup for mixed-era backends by @​ningmao-hlyz in PrefectHQ/fastmcp#4971
• docs: clarify release title history lookup by @​zzstoatzz in PrefectHQ/fastmcp#5006

Fixes 🐞

• fix: don't infer an output schema for unconstrained sequences by @​fsecada01 in PrefectHQ/fastmcp#4999
• Clean up unfinished Monty callbacks by @​zzstoatzz in PrefectHQ/fastmcp#5005
• Fix task timing field serialization by @​LarryHu0217 in PrefectHQ/fastmcp#5003

Docs 📚

• docs: point What's New at the changelog for later releases by @​zzstoatzz in PrefectHQ/fastmcp#4992
• docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @​zzstoatzz in PrefectHQ/fastmcp#4988
• docs: add v4.0.3 changelog entries by @​zzstoatzz in PrefectHQ/fastmcp#5007

New Contributors

• @​fsecada01 made their first contribution in PrefectHQ/fastmcp#4999
• @​ningmao-hlyz made their first contribution in PrefectHQ/fastmcp#4971

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨

• Expose ClientGroup from package root by @​jlowin in PrefectHQ/fastmcp#4987
• skills: add release skill with changelog entry helper by @​zzstoatzz in PrefectHQ/fastmcp#4982

Fixes 🐞

• docs: escape <1 in changelog so MDX parses by @​zzstoatzz in PrefectHQ/fastmcp#4978

Docs 📚

• docs: note the 4.0.1 floor for ClientGroup reentrancy by @​zzstoatzz in PrefectHQ/fastmcp#4980
• docs: link the GA announcement and blog from What's New by @​zzstoatzz in PrefectHQ/fastmcp#4984

Other Changes 🦾

• docs: add v4.0.2 changelog entries by @​zzstoatzz in PrefectHQ/fastmcp#4990

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.9: Cache and Release

ResourceTemplate now keeps its compiled URI pattern for its own lifetime while the shared cache is bounded again, preventing dynamic proxies from growing process memory without restoring the 4,096-template performance cliff.

Fixes 🐞

• resources: keep each template's compiled pattern on the template by @​zzstoatzz in #5253

Full Changelog: v4.0.8...v4.0.9

v4.0.8: Take Three

Completion goes back to its 4.0.5 behavior. The visibility check added in 4.0.6 and reworked in 4.0.7 simulated list requests through middleware, and in 4.0.7 that could let a response cache serve hidden prompts to other clients. New tests pin both problems, and withholding suggestions for hidden references will return with a proper design. Resource template patterns are now cached without a size limit, so servers with thousands of templates read fast again, and OAuthProxy revokes the upstream refresh token instead of sending its own token upstream.

Security 🔒

• completions: revert the list-based visibility check (#5240, #5244) by @​zzstoatzz in #5250

Fixes 🐞

• Fix OAuthProxy upstream refresh token revocation by @​Ujemny in #5243
• resources: keep every compiled template pattern cached by @​zzstoatzz in #5248

New Contributors

• @​Ujemny made their first contribution in #5243

Full Changelog: v4.0.7...v4.0.8

v4.0.7: Double Take

Fixes two regressions from 4.0.6. The completion visibility check runs only the list-specific middleware hooks, so rate limits, logging, and metrics see a single request per completion again. Resource template patterns are cached, which makes template reads faster than in 4.0.5.

Fixes 🐞

• completions: check reference visibility through typed list hooks only by @​zzstoatzz in #5244
• resources: cache compiled URI template patterns by @​zzstoatzz in #5245

... (truncated)

Commits

• 7129236 Add v4.0.3 changelog entries (#5007)
• f79bc82 chore: Update SDK documentation (#4945)
• 6e0859f fix task timing field serialization (#5003)
• 855cb7a Clarify release title history lookup (#5006)
• 6236ac1 Clean up unfinished Monty callbacks (#5005)
• 6c2fbe7 docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 (#4988)
• e68bacc perf: avoid duplicate startup for mixed-era backends (#4971)
• 032b9f6 fix: don't infer an output schema for unconstrained sequences (#4999)
• 75d50ff ci: deploy docs through Mintlify's admin API and wait for a verdict (#4996)
• a338cfb docs: point What's New at the changelog for later releases (#4992)
• Additional commits viewable in compare view

[MSKazemi]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.