Bump the mcp-local-dependencies group in /mcp-local with 5 updates

[dependabot]

Bumps the mcp-local-dependencies group in /mcp-local with 5 updates:

Package	From	To
fastmcp	3.4.5	3.4.7
gitpython	3.1.58	3.1.59
numkong	7.7.0	7.8.0
sentence-transformers	5.6.1	5.7.0
pip	26.1.2	26.2.1

Updates fastmcp from 3.4.5 to 3.4.7

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

• Backport CIMD assertion audience fix to v3 by @​jlowin in PrefectHQ/fastmcp#4799

Docs 📚

• Docs: add v3.4.7 changelog entries by @​jlowin in PrefectHQ/fastmcp#4810

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in PrefectHQ/fastmcp#4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in PrefectHQ/fastmcp#4761

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.0b3: Fast Fourward

FastMCP 4 beta 3 moves the v4 line toward general availability with Prefect Horizon authentication, CallArgument and Depends bindings for tools and background tasks, and a round of OAuth, proxy, OpenAPI, and Python 3.14 compatibility hardening.

Enhancements ✨

• Add Prefect Horizon authentication client and local state by @​parkedwards in #4785
• Clarify auto-closed PR message by @​jlowin in #4820
• Support CallArgument and Depends bindings from uncalled-for 0.4.0 by @​chrisguidry in #4802
• Fix static analysis under newer ty releases by @​zzstoatzz in #4831
• Cover CallArgument resolution in background tasks by @​zzstoatzz in #4833
• Scalekit issuer updates backward compatibility by @​AkshayParihar33 in #4798

Security 🔒

• Add audience pinning to GoogleTokenVerifier by @​zzstoatzz in #4827
• Bump cryptography to 50.0.0 by @​zzstoatzz in #4836

Fixes 🐞

• Fix partial parameter hints on Python 3.14 by @​zzstoatzz in #4796
• fix(openapi): extract parameter-level example and examples by @​doneman536 in #4793
• Keep earlier consent CSRF tokens valid within a transaction by @​trevhud in #4818
• Fix StatefulProxyClient reconnection after session failure by @​jlowin in #4829

Docs 📚

• Docs language dropdown by @​znicholasbrown in #4801
• Docs: mirror v3.4.7 release notes by @​jlowin in #4811
• docs: prepare FastMCP 4 beta 3 by @​jlowin in #4840
• docs: add FastMCP 4 beta 3 release entries by @​jlowin in #4841

New Contributors

• @​parkedwards made their first contribution in #4785
• @​trevhud made their first contribution in #4818

Full Changelog: v4.0.0b2...v4.0.0b3

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

... (truncated)

Commits

• 758397e Docs: add v3.4.7 changelog entries (#4810)
• 538611b Backport CIMD assertion audience fix to v3 (#4799)
• c587bdd Docs: add v3.4.6 changelog entries (#4761)
• fcdf422 Backport #4412 to 3.x: support trusted SSRF proxies (#4755)
• See full diff in compare view

Updates gitpython from 3.1.58 to 3.1.59

Release notes

Sourced from gitpython's releases.

3.1.59 - Security

What's Changed

• prepare changelog for upcoming release by @​Byron in gitpython-developers/GitPython#2207
• Block file-reading Git options by @​Byron in gitpython-developers/GitPython#2208
• index: write blobs via git hash-object, not gitdb's odb.store by @​caroescm in gitpython-developers/GitPython#2209
• Block separate git directories during clone by @​Byron in gitpython-developers/GitPython#2210
• fix: harden config parsing boundaries by @​Byron in gitpython-developers/GitPython#2211
• repo.index.add() now respects worktree filters gitpython-developers/GitPython#2209

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

Commits

• 66340d7 prepare changelog prior to release
• a5e047d Merge pull request #2211 from gitpython-developers/config-sanitize-more
• ef7568e fix: ignore includes in submodule configuration
• 4b4e47f fix: preserve multiline config values when writing
• b473abb Merge pull request #2210 from gitpython-developers/fix-clone-unsafe-option
• 5ff52cc Merge pull request #2209 from caroescm/fix-index-add-chmod
• b68afff Block separate git directories during clone
• 93677a0 fix: index.add() now supports filters (#2021)
• 9729ed3 Merge pull request #2208 from gitpython-developers/security-fixes
• ce9d8e8 prepare next release
• Additional commits viewable in compare view

Updates numkong from 7.7.0 to 7.8.0

Release notes

Sourced from numkong's releases.

Release v7.8.0

Release: v7.8.0 [skip ci]

Minor

• Add: Native thread pools for Python and JavaScript bindings (0354de0b)

Patch

• Fix: Self-contained ISA headers (4383f444)
• Make: Unbreak Windows, RISC-V, and SDE jobs (b9570af1)
• Make: Pin cibuildwheel to 3.x instead of 4.x (bfa76018)
• Make: Unblock wheel builds on current cibuildwheel (96319ad1)
• Fix: Scatter cast writeback into a strided out (6500d1e3)
• Make: Wire WASI to CTest (648092d3)
• Improve: Allocation-free nk.astype for Python (d058a275)
• Make: CMake option to enable AddressSanitizer (#370) (b7a0d2f5)

Release v7.7.1

Release: v7.7.1 [skip ci]

Patch

• Improve: Report Umeyama scale as NaN for degenerate source (895742d8)
• Fix: Fast-math-safe float classification (b25666da)
• Fix: Accumulate i4 angular bias correction in i64 on Icelake (f59c9156)

Commits

• 1a26d12 Release: v7.8.0 [skip ci]
• 4383f44 Fix: Self-contained ISA headers
• b9570af Make: Unbreak Windows, RISC-V, and SDE jobs
• 0354de0 Add: Native thread pools for Python and JavaScript bindings
• bfa7601 Make: Pin cibuildwheel to 3.x instead of 4.x
• 96319ad Make: Unblock wheel builds on current cibuildwheel
• 6500d1e Fix: Scatter cast writeback into a strided out
• 648092d Make: Wire WASI to CTest
• d058a27 Improve: Allocation-free nk.astype for Python
• b7a0d2f Make: CMake option to enable AddressSanitizer (#370)
• Additional commits viewable in compare view

Updates sentence-transformers from 5.6.1 to 5.7.0

Release notes

Sourced from sentence-transformers's releases.

v5.7.0 - GradCache Overhaul, torch.compile Inference, and a Large Batch of Correctness Fixes

This minor version is a correctness and performance-focused release. It rebuilds all gradient-cached losses on one shared engine, fixing several silently wrong gradients and adding token-based mini-batching for up to 3.9x faster cached-loss training. It also makes model.compile() actually speed up inference, and brings a long list of fixes across embedding quantization, evaluators, hard-negative mining, community detection, and multimodal inputs.

Two changes are marked breaking (🚨): int8/uint8 embedding quantization now clips out-of-range values and floors bucket values, so int8 outputs are no longer bit-identical with earlier versions, and AdaptiveLayerLoss/Matryoshka2dLoss now weight prior-layer losses uniformly by default. There's also a forward-looking deprecation: loading models whose modules import classes from outside sentence_transformers will require trust_remote_code=True from v6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.7.0
Inference only, use one of:
pip install sentence-transformers==5.7.0
pip install sentence-transformers[onnx-gpu]==5.7.0
pip install sentence-transformers[onnx]==5.7.0
pip install sentence-transformers[openvino]==5.7.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.7.0
pip install sentence-transformers[audio]==5.7.0
pip install sentence-transformers[video]==5.7.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.7.0

GradCache overhaul: correct gradients and token-based mini-batching (#3862)

The gradient-cached losses (CachedMultipleNegativesRankingLoss, CachedGISTEmbedLoss, CachedSpladeLoss, the Cross Encoder CachedMultipleNegativesRankingLoss, and MegaBatchMarginLoss) train with large batch sizes at constant memory by embedding in mini-batches and replaying them with cached gradients. Each loss carried its own diverged copy of that machinery. They are now all rebuilt on one shared engine, which fixed several bugs that silently corrupted gradients:

• Cross Encoder CachedMultipleNegativesRankingLoss on GPU: the backward pass used different dropout masks than the forward pass, silently biasing gradients for every reranker trained with dropout active on CUDA or MPS. CPU training was unaffected.
• Running two forward passes before a backward pass (e.g. in custom training loops) made CachedGISTEmbedLoss and the Cross Encoder loss backpropagate the wrong batch's gradients, because the cache was stored on the loss module. The cache now travels with each forward pass's backward hook (the .cache and .random_states loss attributes are gone as a result).
• Pooling(include_prompt=False) (e.g. Instructor models) mutated the attention mask in place, so the backward re-embedding of every cached loss ran with a different mask than the forward pass.
• MatryoshkaLoss(GISTEmbedLoss(...)): the guide model overwrote the cached embeddings, so only the largest Matryoshka dimension was actually trained.

Along the way, this also fixed an autocast dtype crash in the backward pass and the trainer retaining autograd graphs between logging steps when tracking loss components.

MegaBatchMarginLoss's default mini-batched version is rebuilt on the engine as well. It crashed outright on recent releases, and underneath that, its historical implementation only applied the last mini-batch's gradients. It now trains on the full batch (results will differ, for the better), works with MatryoshkaLoss, evaluates under torch.no_grad, and raises for a third input column instead of silently ignoring it.

The headline feature is mini_batch_num_tokens, available on CachedMultipleNegativesRankingLoss, CachedMultipleNegativesSymmetricRankingLoss, CachedGISTEmbedLoss, CachedSpladeLoss, and MegaBatchMarginLoss. Instead of a fixed number of sequences per mini-batch, mini-batches are greedily packed by total non-padding token count, giving near-constant work per mini-batch on variable-length data:

from sentence_transformers import SentenceTransformer
from sentence_transformers.sentence_transformer.losses import CachedMultipleNegativesRankingLoss
model = SentenceTransformer("microsoft/mpnet-base")
loss = CachedMultipleNegativesRankingLoss(model, mini_batch_num_tokens=16384)

On the PR's Natural Questions benchmark, cached-loss training with flash attention and a tuned token budget dropped from 715 to 182 seconds (3.9x) versus the previous release, with unchanged quality. The engine also trims trailing padding from each mini-batch, which alone is worth about 26% throughput on the default padded path. The updated training efficiency documentation recommends the smallest token budget that saturates your GPU. mini_batch_size keeps working everywhere as before.

... (truncated)

Commits

• b2a9529 [fix] Name the lone suggested parameter in the mine_hard_negatives missing-ne...
• 00e696c Release v5.7.0
• b69081a [fix] Treat a 1-dimensional query embedding as a single query in semantic_sea...
• c9c4250 Keep queries aligned in semantic_search_seismic when a query matches nothing ...
• 6d331a5 [fix] Support mixed sparse/dense inputs in euclidean and manhattan similari...
• 68c8cda [fix] Reject num_negatives larger than the range_min/range_max window in mine...
• cfb6d43 [trainer] Fix eval DataLoader worker leak with dataloader_persistent_worker...
• f6d3a40 Expand the community window on ties with the threshold (#3900)
• 0b3fcbd Correct the corpus_precision values documented for semantic_search_faiss ...
• 62724e7 Drop FAISS padding placeholders from semantic_search_faiss results (#3887)
• Additional commits viewable in compare view

Updates pip from 26.1.2 to 26.2.1

Changelog

Sourced from pip's changelog.

26.2.1 (2026-08-04)

Bug Fixes

• Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ([#14227](https://github.com/pypa/pip/issues/14227) <https://github.com/pypa/pip/issues/14227>_)

26.2 (2026-07-29)

Deprecations and Removals

• Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

• Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

• Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

  The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

• Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

• Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

• Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

• Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

• Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

• Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

• Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

• Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

• Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

  Note that the feature has limited compatibility with --use-feature=inprocess-build-deps.

... (truncated)

Commits

• 634a6ec Bump for release
• ae2eb4f Revert build dependency installer isolation for legacy build environment (#14...
• 6236392 Merge pull request #14213 from pypa/release/26.2
• da4b2cc Bump for development
• 4b6ae5c Bump for release
• 50b6d3c Update AUTHORS.txt
• dbddfbd Tweak news entries for pip 26.2 (#14212)
• 6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
• 0090e00 Address a variety of typos detected in code review
• e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Pull request overview

This Dependabot PR updates the locked and declared Python dependencies for the mcp-local environment (runtime deps for the Arm MCP server image), bumping five packages to newer patch/minor releases.

Changes:

• Bump fastmcp to 3.4.7 and gitpython to 3.1.59.
• Bump numkong to 7.8.0 and sentence-transformers to 5.7.0 (lockfile reflects updated transitive deps).
• Bump pip (dependency-group acquisition) to 26.2.1.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
mcp-local/pyproject.toml	Updates declared dependency pins for the mcp-local environment.
mcp-local/uv.lock	Updates the resolved lock entries (versions, artifacts, and transitive dependency set) to match the bumped pins.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.