Sourced from fastmcp-slim's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Sourced from fastmcp-slim's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line, led by JWTVerifier no longer rejecting every token when an authorization server publishes an unrecognized key type such as Ed25519.

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in #4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in #4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in #4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in #4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in #4663

New Contributors

• @​kakiii made their first contribution in #4631

Full Changelog: v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in #4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in #4439
• Restore HTTP host guard compatibility by @​jlowin in #4472

New Contributors

• @​evalstate made their first contribution in #4385

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

... (truncated)

• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)