chore(deps): update fastmcp requirement from >=3.4.2 to >=3.4.4

[dependabot]

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in PrefectHQ/fastmcp#4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in PrefectHQ/fastmcp#4439
• Restore HTTP host guard compatibility by @​jlowin in PrefectHQ/fastmcp#4472

Docs 📚

• Docs: add v3.4.4 changelog entries by @​jlowin in PrefectHQ/fastmcp#4473

New Contributors

• @​evalstate made their first contribution in PrefectHQ/fastmcp#4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in #4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in #4439
• Restore HTTP host guard compatibility by @​jlowin in #4472

New Contributors

• @​evalstate made their first contribution in #4385

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

Enhancements ✨

• Dedupe discriminator-required helper across schema converters by @​jlowin in #4362
• Add real Monty sandbox e2e coverage for CodeMode call_tool by @​AlexlaGuardia in #4274
• Switch prettier hook to rbubley/mirrors-prettier by @​jlowin in #4366
• feat(remote): add --verify flag for TLS certificate verification by @​jlowin in #4369

Security 🔒

• fix(deps): clear Dependabot security alerts via lockfile bumps by @​jlowin in #4393
• Clarify resource path parameter safety by @​jlowin in #4398
• Fix dev apps launch escaping by @​jlowin in #4399
• Block NAT64 SSRF bypass by @​jlowin in #4400
• [codex] Fix event store replay isolation by @​jlowin in #4402
• Fix DCR redirect URI validation by @​jlowin in #4408
• Protect streamable HTTP from DNS rebinding by @​jlowin in #4405
• Block unsafe OAuth redirect schemes by @​jlowin in #4419
• Block IPv6 transition SSRF bypasses by @​jlowin in #4426

Fixes 🐞

• fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @​gmenziesint in #4301
• Fix: async rate limiting middleware get_client_id callbacks by @​Chotom in #4319

... (truncated)

Commits

• 9138d40 Docs: add v3.4.4 changelog entries (#4473)
• d929882 Hugging Face Auth Integration (#4385)
• 5fe4fae Restore HTTP host guard compatibility (#4472)
• 400db61 Relax host origin guard defaults (#4439)
• 1eedd1f Docs: add v3.4.2 and v3.4.3 changelog entries (#4430)
• 3b1afe6 chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...
• 874425a chore: Update SDK documentation (#4427)
• 691766b [codex] Fix OpenAPI resource template requests (#4407)
• 47907e0 Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)
• c1b0396 Block IPv6 transition SSRF bypasses (#4426)
• Additional commits viewable in compare view

[dependabot]

Superseded by #33.