Repository navigation
chore(deps): update fastmcp to 4.1.0 - #1760
Merged
Merged
Conversation
FastMCP 4.0.11 applies host_origin_protection to the SSE transport, so the mcp command passes it to both HTTP transports and drops its own SSE guard. Bump the Claude Code and Codex hook pins to match core. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EQPZkbnuxxtTEJoNJCkt45 Signed-off-by: phernandez <paul@basicmachines.co>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates FastMCP from 4.0.3 to 4.1.0 and mcp from 2.0.0 to 2.3.0, the latest releases of both. FastMCP's notes for 4.0.11 describe it as a security release that all users should take.
Code change
FastMCP 4.0.11 (PrefectHQ/fastmcp#5427) applies
host_origin_protectionto the SSE transport. Under 4.0.3 only streamable HTTP honored it, sobasic-memory mcp --transport sseinstalled its ownHostOriginGuardMiddleware(#1697).The command now passes
host_origin_protection="auto"for both HTTP transports and drops the custom SSE guard. Without this change, SSE would be guarded twice.Pins
The Claude Code and Codex hook scripts pin FastMCP to match core. They move to 4.1.0 as well. The hooks run the released Basic Memory v0.23.2, and I checked that it installs and imports under the 4.1.0 override:
ok 4.1.0 2.3.0 0.23.2.4.1.0 breaking changes reviewed
We don't use MultiAuth, regex tool search, skill providers, OpenAPI components or CodeMode. The one change that reaches us: streamable HTTP sessions now expire after 30 idle minutes, the MCP SDK default, and clients open a new one. The CHANGELOG notes this under v0.24.0 Internal.
Test plan
just fast-checkjust test-unit-sqlite: 8,309 passed. The two hook-pin consistency tests that failed before the pin bump now pass.just test-int-sqlite: 712 passedjust test-smokejust package-check-claude-codetests/cli/test_mcp_command.py: the Host/Origin guard rejects a foreign Host (421) and Origin (403), honors the FastMCP allowlists, and is installed exactly once, on both transports🤖 Generated with Claude Code
https://claude.ai/code/session_01EQPZkbnuxxtTEJoNJCkt45