Skip to content

chore(deps): bump the all-dependencies group across 1 directory with 3 updates - #405

Merged
Jeomon merged 1 commit into
mainfrom
dependabot/uv/all-dependencies-5295fa0123
Sep 6, 2026
Merged

chore(deps): bump the all-dependencies group across 1 directory with 3 updates#405
Jeomon merged 1 commit into
mainfrom
dependabot/uv/all-dependencies-5295fa0123

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 3 updates in the / directory: fastmcp, platformdirs and posthog.

Updates fastmcp from 3.4.7 to 4.0.0

Release notes

Sourced from fastmcp's releases.

v4.0.0: Four Real

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

  • Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
  • Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
  • Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.
  • Argument completion for prompt and resource-template inputs, with already-supplied arguments visible to the handler.
  • Auth for agents and services: identity assertion (SEP-990, beta), provider-neutral role checks, insufficient-scope challenges that name the missing scopes, and client-credentials auth.
  • Infrastructure hooks: server-level cache hints, and Mcp-Method/Mcp-Name routing headers so gateways can route without parsing JSON-RPC.

The framework grew alongside the protocol: dependency injection can bind a dependency to arguments of the call it serves (Depends(get_account, user_id=CallArgument("owner"))) while keeping it out of the tool schema, and ClientGroup manages one client per server with collision-checked namespacing — each member negotiating its own protocol version.

The beta period motivated a bunch of correctness work. Most of it was auth: hardened OAuth consent flows, issuer validation, and JWT verification, plus proxies that strip cookies and connection-owned headers at trust boundaries. The rest was durability and compatibility — encrypted task snapshots, serialized event-store writes, response caching handling empty results, errors, and versioned components, and dozens of smaller fixes from CodeMode to Python 3.14 compat.

Breaking changes: server-initiated sampling and roots are removed (no live connection exists to call back into mid-request), ctx.elicit() is old-protocol-only, FastMCP 3's deprecated APIs are gone, MCP model fields are snake_case (with a warning compatibility bridge for the old names), and background tasks moved to fastmcp-tasks. Passing a bare string like Client("server.py") to run local code is deprecated in favor of Path, for removal in FastMCP 5.

The upgrade guide covers every change and includes a copyable prompt for auditing an application with a coding agent.

Happy (context) engineering!

What's Changed

New Features 🎉

Breaking Changes ⚠️

Enhancements ✨

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

Fixes 🐞

Docs 📚

Full Changelog: v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

Fixes 🐞

Docs 📚

Full Changelog: v4.0.0...v4.0.1

v4.0.0: Four Real

... (truncated)

Commits
  • 7e51c1d docs: add v4.0.0 changelog and updates entries (#4955)
  • aeb98e1 chore: add zzstoatzz alongside jlowin in maintainer references (#4953)
  • 3685866 client: deprecate inferring stdio transports from str, prefer Path (#4941)
  • 977ba66 Fix response cache partitioning for versioned components (#4948)
  • 125717d Accept any issuer scoped to the Descope project (#4909)
  • 1f02114 docs: transport inference trust contract; trim SDK session-group comparison (...
  • 92669e4 chore: Update SDK documentation (#4938)
  • 6182642 docs: cover list_tools and restore client modules in the SDK reference (#4936)
  • 89a7d7a docs: prepare FastMCP 4 beta 5 (#4934)
  • 2a2080c add independent client groups (#4904)
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.5 to 4.11.7

Release notes

Sourced from platformdirs's releases.

4.11.7

Full Changelog: tox-dev/platformdirs@4.11.6...4.11.7

4.11.6

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.5...4.11.6

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.7 (2026-09-01)

4.11.6 (2026-09-01)

  • Give :func:~platformdirs.user_bin_dir and :func:~platformdirs.user_bin_path the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:~platformdirs.site_bin_dir. :pr:537

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534
  • Correct the ordering note on the iterator methods. use_site_for_root drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:533

4.11.4 (2026-08-24)

  • Stop the iter_*_dirs methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:520 covered only Unix with use_site_for_root. It also hit :meth:~platformdirs.PlatformDirs.iter_runtime_dirs on Unix with $XDG_RUNTIME_DIR set, on Windows and macOS, and all six iterators on Android. :pr:524
  • Fix the config merging example in the how-to guide. iter_config_paths yields the user directory first, so the config.update loop let the site defaults override the user's config instead of the other way round. :pr:529

... (truncated)

Commits

Updates posthog from 7.44.2 to 7.45.3

Release notes

Sourced from posthog's releases.

posthog-v7.45.3

Patch changes

  • caf9030 MCP tool failures now report the exception the tool actually raised on $mcp_error_message and $mcp_error_type, stepping past the SDK's dispatch ToolError wrapper. mcp 2.1 masks the original message out of that wrapper, which left the failures view with only Error executing tool <name>. The $exception sibling still carries the full chain. — Thanks @​bernatixer!

posthog-v7.45.2

Patch changes

  • 9444ec5 Omit $ai_input_tokens and $ai_output_tokens when the provider never reported usage, instead of sending 0, so an interrupted stream no longer looks like a free call. A zero reported by the provider is still sent, and zero keeps meaning a real report of nothing. Covers the OpenAI, Anthropic, Gemini, LangChain, OpenAI Agents and Claude Agent SDK integrations. — Thanks @​bernatixer!

posthog-v7.45.1

Patch changes

  • 131cc1a Match local feature flag string operators using the flags service's boolean coercion, JSON stringification, and casing rules. — Thanks @​marandaneto!

posthog-v7.45.0

Minor changes

  • f50f333 Add non-blocking feature flag evaluation and remote config APIs to AsyncPosthog — Thanks @​marandaneto!
  • f50f333 Add an asyncio-native client for buffered and immediate event capture — Thanks @​marandaneto!
Commits
  • 9cfe645 chore: Release v7.45.3 [skip ci]
  • caf9030 fix(mcp): report the exception a tool raised when the SDK masks it (#907)
  • bec61e7 Update generated references
  • b619a13 chore: Release v7.45.2 [skip ci]
  • 9444ec5 fix(ai): omit token counts the provider never reported (#906)
  • 2e7c73b chore(deps): bump the ai-providers group with 7 updates (#903)
  • 596cf46 chore(deps): bump the github-actions group with 3 updates (#904)
  • 775b654 Update generated references
  • 57c0d16 chore: Release v7.45.1 [skip ci]
  • 131cc1a fix(flags): align local case folding with the flags service (#902)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-dependencies group across 1 directory with …
585bcea 
…3 updates

Bumps the all-dependencies group with 3 updates in the / directory: [fastmcp](https://github.com/PrefectHQ/fastmcp), [platformdirs](https://github.com/tox-dev/platformdirs) and [posthog](https://github.com/posthog/posthog-python).


Updates `fastmcp` from 3.4.7 to 4.0.0
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.7...v4.0.0)

Updates `platformdirs` from 4.11.5 to 4.11.7
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.5...4.11.7)

Updates `posthog` from 7.44.2 to 7.45.3
- [Release notes](https://github.com/posthog/posthog-python/releases)
- [Changelog](https://github.com/PostHog/posthog-python/blob/main/CHANGELOG.md)
- [Commits](PostHog/posthog-python@posthog-v7.44.2...posthog-v7.45.3)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: platformdirs
  dependency-version: 4.11.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: posthog
  dependency-version: 7.45.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 4, 2026
@Jeomon
Jeomon merged commit f6d83cf into main Sep 6, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/uv/all-dependencies-5295fa0123 branch September 6, 2026 09:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Jeomon