Latest Results
chore(deps-dev): bump setuptools from 83.0.0 to 84.1.0 in /libs/core (#41442)
Bumps [setuptools](https://github.com/pypa/setuptools) from 83.0.0 to
84.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/setuptools/blob/main/NEWS.rst">setuptools's
changelog</a>.</em></p>
<blockquote>
<h1>v84.1.0</h1>
<h2>Features</h2>
<ul>
<li><code>setuptools.archive_util</code> now raises the new
<code>UnsafeMember</code> exception when
an archive member would be extracted outside of the extraction
directory,
where previously such a member was silently skipped. Aborting makes a
malicious or malformed archive visible to the caller instead of yielding
a
quietly incomplete extraction, and matches the behavior of the standard
library's <code>tarfile</code> extraction filters.</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p><code>Wheel.install_as_egg</code> no longer creates namespace package
directories
outside of the destination egg directory. Entries in a wheel's
<code>namespace_packages.txt</code> were split on <code>.</code> and
passed straight to
<code>os.path.join</code>, so an entry that was absolute,
drive-qualified, or UNC
discarded the destination and placed an <code>__init__.py</code> at a
path chosen by
the wheel. Namespace entries are now validated as dotted module names on
every platform -- see GHSA-xmj3-9gf7-h52w.</p>
<p>This code path is reached only by the deprecated
<code>setup_requires</code>
mechanism when <code>setup()</code> is invoked outside a PEP 517
frontend; the
setuptools build backend never reaches it.</p>
</li>
<li>
<p><code>setuptools.archive_util</code> no longer extracts archive
members outside of the
requested extraction directory. Both the tar and zip formats specify
<code>/</code> as
the only path separator, but the guard against <code>..</code>
components split member
names on <code>/</code> alone, so a name such as
<code>..\escaped.txt</code> was treated as a
single component and then resolved as a traversal by the filesystem on
Windows. Member names containing a backslash, a drive letter, or a UNC
prefix
are now rejected on every platform, as are members whose resolved
destination
falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.</p>
</li>
</ul>
<h1>v84.0.0</h1>
<h2>Features</h2>
<ul>
<li>Newline-separated <code>keywords</code> and
<code>platforms</code><code>pypa/setuptools#4887</code><code>old
specification <https://peps.python.org/pep-0345/></code>_
separated items with spaces and the current one uses commas. (<a
href="https://redirect.github.com/pypa/setuptools/issues/4887">#4887</a>)</li>
<li><code>Extension</code><code>pypa/distutils#373</code><a
href="https://redirect.github.com/pypa/setuptools/issues/5022">#5022</a>)</li>
<li>The C compiler modules now emit log messages through their own
<code>compilers.C.*</code> loggers instead of the distutils root logger,
part of decoupling the compilers package from distutils. The logger
names are normalized to a stable <code>compilers.C.*</code> prefix so
they remain constant as the package migrates toward a standalone
<code>compilers.C</code> distribution. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5266">#5266</a>)</li>
<li>The C compilers gained a <code>Compiler.call</code> method -- a thin
wrapper over <code>subprocess.check_call</code> (with macOS
deployment-target env injection) that is the modern replacement for
<code>Compiler.spawn</code>. The compilers no longer depend on
<code>distutils.spawn</code>, <code>distutils.dir_util</code>,
<code>distutils.file_util</code>, <code>distutils._modified</code>, or
<code>distutils.util.execute</code>/<code>split_quoted</code>: the
generic <code>newer</code>/<code>newer_group</code> and
<code>split_quoted</code> helpers are vendored into the
<code>compilers</code> package, and
<code>Compiler.mkpath</code>/<code>move_file</code>/<code>execute</code>
are implemented directly on the standard library
(<code>os.makedirs</code>/<code>shutil.move</code>). The methods are
retained for backward compatibility. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5267">#5267</a>)</li>
<li>The compilers no longer depend on <code>distutils.util</code>,
<code>distutils.version</code>, <code>distutils.compat</code>, or
<code>distutils._macos_compat</code>. The platform-identification
helpers
(<code>get_platform</code>/<code>get_host_platform</code>/<code>is_mingw</code>)
now live in <code>distutils.compilers.platform.detect</code> and the
macOS deployment-target logic and <code>compiler_fixup</code> in
<code>distutils.compilers.platform.macos</code>;
<code>CygwinCCompiler.gcc_version</code> returns a
<code>packaging.version.Version</code>. <code>distutils.util</code>
re-exports the platform/macOS helpers from their new homes for backward
compatibility rather than keeping duplicate copies. (sysconfig lookups
still route through distutils pending its own decoupling.) (<a
href="https://redirect.github.com/pypa/setuptools/issues/5268">#5268</a>)</li>
<li>The compilers now read their build configuration from the standard
library's <code>sysconfig</code> instead of
<code>distutils.sysconfig</code>. Per-compiler customization --
previously <code>distutils.sysconfig.customize_compiler</code> -- has
moved into <code>Compiler.configure_system()</code>: a no-op on the base
class, with <code>UnixCCompiler</code> applying the
compiler/flag/archiver settings CPython recorded in
<code>sysconfig</code> (and the usual
<code>CC</code>/<code>CFLAGS</code>/<code>LDSHARED</code>/… environment
overrides). <code>distutils.sysconfig.customize_compiler</code> is
retained as a thin wrapper that calls
<code>compiler.configure_system()</code>. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5269">#5269</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/setuptools/commit/77b7ace0aaf660beeb9b3f9da4aabf21cbcf3fa9"><code>77b7ace</code></a>
Bump version: 84.0.0 → 84.1.0</li>
<li><a
href="https://github.com/pypa/setuptools/commit/e66004c64eaf6cf2f8c53ccdfac75cf7abce7ccf"><code>e66004c</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5329">#5329</a>
from pypa/fix/wheel-namespace-path-escape</li>
<li><a
href="https://github.com/pypa/setuptools/commit/54b5dcadc1bd938a5a66919e8ab7bcd59805e7fd"><code>54b5dca</code></a>
Cover the containment check with a symlink escape test</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af"><code>6d07b8d</code></a>
Validate namespace package names during legacy wheel installation</li>
<li><a
href="https://github.com/pypa/setuptools/commit/8419f006d4e34c4ecfc7a0bd1bc6993855adc3cc"><code>8419f00</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5356">#5356</a>
from pypa/skeleton-ruff-0.16</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6dadc86a3f7dbe1cf49c6301548ffde61d4e74e1"><code>6dadc86</code></a>
Remove DTZ011 suppressions that Ruff 0.17 reports as unused.</li>
<li><a
href="https://github.com/pypa/setuptools/commit/715ec38b46424533806195a96983e3dd70fdf3b9"><code>715ec38</code></a>
Merge <a
href="https://github.com/jaraco/skeleton">https://github.com/jaraco/skeleton</a></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9695460ebfa879ada16545d62b26b9a489a6d5ed"><code>9695460</code></a><code>jaraco/skeleton#219</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9e0812976b1154a7aece47188814385c887bc6c9"><code>9e08129</code></a><code>jaraco/skeleton#216</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/4e612f9e44ecfad130d0b2a27a2dce0740599b4b"><code>4e612f9</code></a>
Ignore PyPy's deprecated check_home warning in tests</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/setuptools/compare/v83.0.0...v84.1.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langchain/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump fastmcp from 4.0.11 to 4.1.2 in /libs/langchain_v1 (#41437)
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 4.0.11 to
4.1.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/PrefectHQ/fastmcp/releases">fastmcp's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.2: License to Deny</h2>
<p>Component authorization now applies after transforms, denied
resources cannot fall through matching templates, and OAuth client
credentials providers support issuer binding across fresh and
cached-token flows. Existing configurations remain compatible, but users
of <code>ClientCredentialsOAuthProvider</code> or
<code>PrivateKeyJWTOAuthProvider</code> must set <code>issuer</code> to
enable this protection; upgrading alone is insufficient. Thanks to our
18 contributors, including 9 first-time contributors.</p>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Security 🔒</h3>
<ul>
<li>Authorize transformed components and prevent denied-resource
template fallback by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> and <a
href="https://github.com/rishid"><code>@rishid</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5933">PrefectHQ/fastmcp#5933</a></li>
<li>Bind OAuth client credentials to a configured issuer, including
cached-token renewal, by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> and <a
href="https://github.com/LHMisme420"><code>@LHMisme420</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5933">PrefectHQ/fastmcp#5933</a></li>
</ul>
<h3>Enhancements ✨</h3>
<ul>
<li>Add SEP-2640 Skills extension foundation by <a
href="https://github.com/strawgate"><code>@strawgate</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5057">PrefectHQ/fastmcp#5057</a></li>
<li>Write down triage and merge norms in docs/development by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5872">PrefectHQ/fastmcp#5872</a></li>
<li>Add experimental Skills discovery to SkillsDirectoryProvider by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5704">PrefectHQ/fastmcp#5704</a></li>
</ul>
<h3>Fixes 🐞</h3>
<ul>
<li>Do not require websockets for the OAuth callback server by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5693">PrefectHQ/fastmcp#5693</a></li>
<li>Keep fastmcp.json resolvable when deployment.cwd changes the working
directory by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5700">PrefectHQ/fastmcp#5700</a></li>
<li>Fix ctx.log() failing when extra contains LogRecord attribute names
by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5688">PrefectHQ/fastmcp#5688</a></li>
<li>Use a monotonic clock in the rate limiters by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5689">PrefectHQ/fastmcp#5689</a></li>
<li>Escape server metadata in the fastmcp inspect text summary by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5701">PrefectHQ/fastmcp#5701</a></li>
<li>Respect an explicit is_binary=False on FileResource by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5696">PrefectHQ/fastmcp#5696</a></li>
<li>Follow pagination in the MCP format of fastmcp inspect by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5691">PrefectHQ/fastmcp#5691</a></li>
<li>Visit each reference once when finding access-restricted properties
by <a
href="https://github.com/AarnavNoble"><code>@AarnavNoble</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5751">PrefectHQ/fastmcp#5751</a></li>
<li>Run sync resource templates in the threadpool by <a
href="https://github.com/hardness1020"><code>@hardness1020</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5742">PrefectHQ/fastmcp#5742</a></li>
<li>Require openapi-pydantic 0.6.0 so OpenAPI 3.1.2 specs load by <a
href="https://github.com/jsphbtst"><code>@jsphbtst</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5647">PrefectHQ/fastmcp#5647</a></li>
<li>Scope FileUpload and session visibility to a stable client on MCP
2026-07-28 by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5651">PrefectHQ/fastmcp#5651</a></li>
<li>fix(auth): accept private_key_jwt without form client_id by <a
href="https://github.com/HootRock"><code>@HootRock</code></a> and <a
href="https://github.com/imranq2"><code>@imranq2</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5832">PrefectHQ/fastmcp#5832</a></li>
<li>fix(cli): honor explicit URL transport by <a
href="https://github.com/mikamikasuki"><code>@mikamikasuki</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5529">PrefectHQ/fastmcp#5529</a></li>
<li>Remove legacy logging state when HTTP sessions close by <a
href="https://github.com/mikamikasuki"><code>@mikamikasuki</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5539">PrefectHQ/fastmcp#5539</a></li>
<li>Name data-backed File resources consistently with their MIME subtype
by <a
href="https://github.com/nandanadileep"><code>@nandanadileep</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5568">PrefectHQ/fastmcp#5568</a></li>
<li>fix(client): run Python stdio children in UTF-8 mode by <a
href="https://github.com/ningmao-hlyz"><code>@ningmao-hlyz</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5642">PrefectHQ/fastmcp#5642</a></li>
<li>Report an unbindable OAuth callback port instead of SystemExit by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5692">PrefectHQ/fastmcp#5692</a></li>
<li>Accept ES256 and other RSA/EC algorithms for CIMD private_key_jwt
assertions by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5695">PrefectHQ/fastmcp#5695</a></li>
<li>Preserve icons on transformed tools by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5702">PrefectHQ/fastmcp#5702</a></li>
<li>Hydrate valid schema defaults while preserving invalid defaults by
<a
href="https://github.com/nandanadileep"><code>@nandanadileep</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5738">PrefectHQ/fastmcp#5738</a></li>
<li>fix(resources): preserve public metadata in built-in read contents
by <a href="https://github.com/HootRock"><code>@HootRock</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5778">PrefectHQ/fastmcp#5778</a></li>
<li>Preserve shared dependency scopes without optional task dependencies
by <a href="https://github.com/HootRock"><code>@HootRock</code></a> and
<a href="https://github.com/BlueX888"><code>@BlueX888</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5817">PrefectHQ/fastmcp#5817</a></li>
<li>fix: treat non-string skill frontmatter descriptions as absent by <a
href="https://github.com/BlueX888"><code>@BlueX888</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5823">PrefectHQ/fastmcp#5823</a></li>
<li>fix(resources): preserve component meta for list[ResourceContent]
returns by <a
href="https://github.com/BlueX888"><code>@BlueX888</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5843">PrefectHQ/fastmcp#5843</a></li>
<li>Fall back to the client timeout when resolving claimed results by <a
href="https://github.com/marcinbelczewski"><code>@marcinbelczewski</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5190">PrefectHQ/fastmcp#5190</a></li>
<li>Discover Goose Streamable HTTP extensions by <a
href="https://github.com/jiuyueQ"><code>@jiuyueQ</code></a> and <a
href="https://github.com/ch-z-hc"><code>@ch-z-hc</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5582">PrefectHQ/fastmcp#5582</a></li>
<li>Raise ToolError when a tool with an output schema returns an
unserializable value by <a
href="https://github.com/massimiliano1991"><code>@massimiliano1991</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5063">PrefectHQ/fastmcp#5063</a></li>
<li>Stop deploy tests from spawning PowerShell on every state access by
<a href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5874">PrefectHQ/fastmcp#5874</a></li>
<li>Give the timeout-override test headroom for the follow-up tools/list
by <a href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5875">PrefectHQ/fastmcp#5875</a></li>
<li>Keep disabled resources from being served by matching templates by
<a href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5876">PrefectHQ/fastmcp#5876</a></li>
</ul>
<h3>Docs 📚</h3>
<ul>
<li>Fix codespell typo in v4.1.1 changelog by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5818">PrefectHQ/fastmcp#5818</a></li>
<li>context: stop documenting session_id as a cross-request key by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5862">PrefectHQ/fastmcp#5862</a></li>
</ul>
<h3>Examples & Contrib 💡</h3>
<ul>
<li>fix(contrib): preserve BulkToolCaller tool prefixes by <a
href="https://github.com/mikamikasuki"><code>@mikamikasuki</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5555">PrefectHQ/fastmcp#5555</a></li>
</ul>
<h3>Other Changes 🦾</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx">fastmcp's
changelog</a>.</em></p>
<blockquote>
<hr />
<h2>title: "Changelog"
icon: "list-check"
rss: true
tag: NEW</h2>
<!-- raw HTML omitted -->
<p><strong><a
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3">v4.1.3:
Root Awakening</a></strong></p>
<p>This release updates certifi-backed dependencies following the
eMudhra CA compromise and fixes public-client OAuth authentication,
empty visibility selections, generator transforms, and per-server
timeouts for ordinary requests. FastMCP 4 uses system trust by default:
follow the <a
href="https://github.com/PrefectHQ/fastmcp/blob/main/SECURITY.md#certificate-authority-incident-october-2026">security
notice</a> to update operating-system, container, custom, and installer
trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11
contributors, including 6 first-time contributors.</p>
<h3>Security 🔒</h3>
<ul>
<li>Require certifi 2026.10.19 or later for certifi-backed server
dependencies and optional SDK integrations, and document system, custom,
and installer trust-store updates by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5945">#5945</a>.</li>
</ul>
<h3>Enhancements ✨</h3>
<ul>
<li>Chart public backlog counts and closure outcomes by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5942">#5942</a></li>
</ul>
<h3>Fixes 🐞</h3>
<ul>
<li>Default the upstream token auth method to none without a client
secret by <a
href="https://github.com/asasemahmed"><code>@asasemahmed</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5879">#5879</a></li>
<li>fix: preserve empty session visibility selections by <a
href="https://github.com/himanshuchawla0807-gif"><code>@himanshuchawla0807-gif</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5944">#5944</a></li>
<li>test(mount): make unreachable proxy failures deterministic by <a
href="https://github.com/CharlesYXW"><code>@CharlesYXW</code></a> and
<a href="https://github.com/ch-z-hc"><code>@ch-z-hc</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5584">#5584</a></li>
<li>fix(tools): materialize generator transform_fn results in
TransformedTool.run by <a
href="https://github.com/BlueX888"><code>@BlueX888</code></a> and <a
href="https://github.com/nandanadileep"><code>@nandanadileep</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5672">#5672</a></li>
<li>Honor per-server MCP config timeouts by <a
href="https://github.com/atty57"><code>@atty57</code></a>, <a
href="https://github.com/phnmn"><code>@phnmn</code></a>, and <a
href="https://github.com/CRYPTONIKAV"><code>@CRYPTONIKAV</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5758">#5758</a></li>
<li>fix: don't classify a tool body's own TimeoutError as the tool
timeout by <a
href="https://github.com/Wilson0511"><code>@Wilson0511</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5940">#5940</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/phnmn"><code>@phnmn</code></a> made
their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5758">#5758</a></li>
<li><a
href="https://github.com/CRYPTONIKAV"><code>@CRYPTONIKAV</code></a>
made their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5758">#5758</a></li>
<li><a
href="https://github.com/himanshuchawla0807-gif"><code>@himanshuchawla0807-gif</code></a>
made their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5944">#5944</a></li>
<li><a
href="https://github.com/CharlesYXW"><code>@CharlesYXW</code></a> made
their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5584">#5584</a></li>
<li><a href="https://github.com/atty57"><code>@atty57</code></a> made
their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5758">#5758</a></li>
<li><a
href="https://github.com/Wilson0511"><code>@Wilson0511</code></a> made
their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5940">#5940</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/PrefectHQ/fastmcp/compare/v4.1.2...v4.1.3">v4.1.2...v4.1.3</a></p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p><strong><a
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2">v4.1.2:
License to Deny</a></strong></p>
<p>Component authorization now applies after transforms, denied
resources cannot fall through matching templates, and OAuth client
credentials providers support issuer binding across fresh and
cached-token flows. Existing configurations remain compatible, but users
of <code>ClientCredentialsOAuthProvider</code> or
<code>PrivateKeyJWTOAuthProvider</code> must set <code>issuer</code> to
enable this protection; upgrading alone is insufficient. Thanks to our
18 contributors, including 9 first-time contributors.</p>
<h3>Security 🔒</h3>
<ul>
<li>Authorize transformed components and prevent denied-resource
template fallback by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> and <a
href="https://github.com/rishid"><code>@rishid</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5933">#5933</a></li>
<li>Bind OAuth client credentials to a configured issuer, including
cached-token renewal, by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> and <a
href="https://github.com/LHMisme420"><code>@LHMisme420</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5933">#5933</a></li>
</ul>
<h3>Enhancements ✨</h3>
<ul>
<li>Add SEP-2640 Skills extension foundation by <a
href="https://github.com/strawgate"><code>@strawgate</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5057">#5057</a></li>
<li>Write down triage and merge norms in docs/development by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5872">#5872</a></li>
<li>Add experimental Skills discovery to SkillsDirectoryProvider by <a
href="https://github.com/zzstoatzz"><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5704">#5704</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/0f4674e2e15c9cb3a13badf29c873e61e5653d9b"><code>0f4674e</code></a>
docs: add v4.1.2 changelog entries (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5936">#5936</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df"><code>85df42f</code></a>
Enforce component authorization and bind OAuth credentials to an issuer
(<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5933">#5933</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/535a3e124c3a312567168c78ed9b946e133360f6"><code>535a3e1</code></a>
Remove stray logo.py and unused CodeRabbit config (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5873">#5873</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/49858c3239efe2b0655ff7e26ab69fd0224059fb"><code>49858c3</code></a>
Keep disabled resources from being served by matching templates (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5876">#5876</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/9921d5eaa06aab76fed412ae30be4759d751dd00"><code>9921d5e</code></a>
Add experimental Skills discovery to SkillsDirectoryProvider (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5704">#5704</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/cb20ad6f139e9953ac9ef47bd29f5e556c72727c"><code>cb20ad6</code></a>
Give the timeout-override test headroom for the follow-up tools/list (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5875">#5875</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/623590a94d158f836bddb13082249ccb01cfc9ff"><code>623590a</code></a>
Stop deploy tests from spawning PowerShell on every state access (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5874">#5874</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/70ac0ce96bb751f058048008dd4e15b5f69259b6"><code>70ac0ce</code></a>
context: stop documenting session_id as a cross-request key (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5862">#5862</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/e1b3e575699d6dd56dd58695fcddbb22bd6769d8"><code>e1b3e57</code></a>
Write down triage and merge norms in docs/development (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5872">#5872</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/78e12564d42a7de5af551de67639777ba1f03b3f"><code>78e1256</code></a>
Raise ToolError when a tool with an output schema returns an
unserializable v...</li>
<li>Additional commits viewable in <a
href="https://github.com/PrefectHQ/fastmcp/compare/v4.0.11...v4.1.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langchain/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/core (#41425)
Bumps [nbconvert](https://github.com/jupyter/nbconvert) from 7.17.1 to
7.17.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/releases">nbconvert's
releases</a>.</em></p>
<blockquote>
<h2>v7.17.2</h2>
<h2>7.17.2</h2>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Fix CI: fetch the classic CSS from PyPI, update dead links <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2327">#2327</a>
(<a href="https://github.com/Yann-P"><code>@Yann-P</code></a>, <a
href="https://github.com/Carreau"><code>@Carreau</code></a>, <a
href="https://github.com/claude"><code>@claude</code></a>)</li>
</ul>
<h3>Other merged PRs</h3>
<ul>
<li>Use org-level security policy (jupyter/.github/SECURITY.md) <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2318">#2318</a>
(<a href="https://github.com/Yann-P"><code>@Yann-P</code></a>, <a
href="https://github.com/minrk"><code>@minrk</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Carreau"><code>@Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a href="https://github.com/claude"><code>@claude</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a
href="https://github.com/GruffElixir"><code>@GruffElixir</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a href="https://github.com/minrk"><code>@minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a href="https://github.com/Yann-P"><code>@Yann-P</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md">nbconvert's
changelog</a>.</em></p>
<blockquote>
<h2>7.17.2</h2>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Fix CI: fetch the classic CSS from PyPI, update dead links <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2327">#2327</a>
(<a href="https://github.com/Yann-P"><code>@Yann-P</code></a>, <a
href="https://github.com/Carreau"><code>@Carreau</code></a>, <a
href="https://github.com/claude"><code>@claude</code></a>)</li>
</ul>
<h3>Other merged PRs</h3>
<ul>
<li>Use org-level security policy (jupyter/.github/SECURITY.md) <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2318">#2318</a>
(<a href="https://github.com/Yann-P"><code>@Yann-P</code></a>, <a
href="https://github.com/minrk"><code>@minrk</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Carreau"><code>@Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a href="https://github.com/claude"><code>@claude</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a
href="https://github.com/GruffElixir"><code>@GruffElixir</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a href="https://github.com/minrk"><code>@minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)
| <a href="https://github.com/Yann-P"><code>@Yann-P</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues">activity</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/nbconvert/commit/e681152f214b65387f875aad96a4726994533a0b"><code>e681152</code></a>
Publish 7.17.2</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/8685e15e2d924fa39be38aeafb6ac859fc254ccc"><code>8685e15</code></a>
Fix CI: fetch the classic CSS from PyPI, update dead links</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f"><code>ce4bd99</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/1ff189e1b30f0820238e95427c035a9150a5e43f"><code>1ff189e</code></a>
Use org-level security policy (jupyter/.github/SECURITY.md) (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2318">#2318</a>)</li>
<li>See full diff in <a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...v7.17.2">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Latest Branches
+21%
dependabot/uv/libs/core/minor-and-patch-99abfc1897 0%
dependabot/uv/libs/core/setuptools-84.1.0 0%
dependabot/uv/libs/langchain_v1/fastmcp-4.1.2 © 2026 CodSpeed Technology