deps: Update fastmcp requirement from <4,>=3.2.4 to >=3.2.4,<5

[dependabot]

Updates the requirements on fastmcp to permit the latest version.

Release notes

Sourced from fastmcp's releases.

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

What's Changed

Enhancements ✨

• ci: deploy docs through Mintlify's admin API and wait for a verdict by @​zzstoatzz in PrefectHQ/fastmcp#4996
• perf: avoid duplicate startup for mixed-era backends by @​ningmao-hlyz in PrefectHQ/fastmcp#4971
• docs: clarify release title history lookup by @​zzstoatzz in PrefectHQ/fastmcp#5006

Fixes 🐞

• fix: don't infer an output schema for unconstrained sequences by @​fsecada01 in PrefectHQ/fastmcp#4999
• Clean up unfinished Monty callbacks by @​zzstoatzz in PrefectHQ/fastmcp#5005
• Fix task timing field serialization by @​LarryHu0217 in PrefectHQ/fastmcp#5003

Docs 📚

• docs: point What's New at the changelog for later releases by @​zzstoatzz in PrefectHQ/fastmcp#4992
• docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @​zzstoatzz in PrefectHQ/fastmcp#4988
• docs: add v4.0.3 changelog entries by @​zzstoatzz in PrefectHQ/fastmcp#5007

New Contributors

• @​fsecada01 made their first contribution in PrefectHQ/fastmcp#4999
• @​ningmao-hlyz made their first contribution in PrefectHQ/fastmcp#4971

Full Changelog: PrefectHQ/fastmcp@v4.0.2...v4.0.3

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.5: No Country for Loose Ints

Tool parameters declared strict with Field(strict=True), StrictInt, or a strict model config are honored again, on both direct calls and task submission. Since the SDK v2 migration the server's lax default overrode them and silently coerced values.

Security 🔒

• Add regression test for the unconfigured ID-JAG guard by @​zzstoatzz in #5146

Fixes 🐞

• Preserve field-level strict validation in lax mode by @​zzstoatzz in #5141

Full Changelog: v4.0.4...v4.0.5

v4.0.4: Here Be No Dragons

OpenAPI request bodies get most of the attention in this patch: multipart string arrays are sent as repeated fields, whole-body arguments no longer clobber same-named HTTP parameters, dictionary bodies and raw content types survive intact, and JSON scalar bodies are encoded. On the auth side, OAuthProxy rejects ID-JAG tokens unless identity assertion is configured and refuses non-positive upstream token expiries. Clients now follow empty pagination cursors and servers reject malformed ones.

Enhancements ✨

• Refresh the smart-home example with Hue V2 and native effects by @​zzstoatzz in #5009
• Update CodeMode for pydantic-monty 0.0.21 by @​strawgate in #5033
• Keep linked contributor PRs open while awaiting assignment by @​zzstoatzz in #5048
• Reduce redundant CI execution while preserving required checks by @​zzstoatzz in #5049
• Share and streamline repository skills by @​zzstoatzz in #5013
• Support anthropic 1.x alongside 0.x by @​tdsmith in #5066
• renovate: cap routine PRs at 5 concurrent and 5 per hour by @​zzstoatzz in #5110
• Give docs quality checks a corpus-wide timeout by @​zzstoatzz in #5109
• Resolve ty 0.0.79 warnings from upgrade checks by @​zzstoatzz in #5123

Security 🔒

• Fix #5115: OAuthProxy accepts self-contained ID-JAG tokens even when identity_ass by @​nandanadileep in #5119

Fixes 🐞

• Fix upgrade checks for the M2M storage warning test by @​zzstoatzz in #5040
• Fix OpenAPI query explode defaults by @​zzstoatzz in #5065
• fix(openapi): encode JSON scalar request bodies by @​Gonghan-Princess in #5052
• fix(versions): deterministic meta.fastmcp.versions ordering by @​feiiiiii5 in #4880
• Parse skills frontmatter with yaml.safe_load, falling back to the line parser by @​vishnujayvel in #4701
• Keep client data out of tool validation warnings by @​zzstoatzz in #5106
• fix: follow empty pagination cursors in client lists by @​sicauzxl in #5026
• fix: reject non-positive upstream token expiry by @​sui-ni2 in #4849

... (truncated)

Commits

• 7129236 Add v4.0.3 changelog entries (#5007)
• f79bc82 chore: Update SDK documentation (#4945)
• 6e0859f fix task timing field serialization (#5003)
• 855cb7a Clarify release title history lookup (#5006)
• 6236ac1 Clean up unfinished Monty callbacks (#5005)
• 6c2fbe7 docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 (#4988)
• e68bacc perf: avoid duplicate startup for mixed-era backends (#4971)
• 032b9f6 fix: don't infer an output schema for unconstrained sequences (#4999)
• 75d50ff ci: deploy docs through Mintlify's admin API and wait for a verdict (#4996)
• a338cfb docs: point What's New at the changelog for later releases (#4992)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

code-review-graph review

Overall risk: 0.00 (LOW) — 0 changed function(s)/class(es), 0 affected flow(s), 0 test gap(s)

Token savings: this graph-backed report used ~1,666 fewer tokens (~96%) than reading every changed file in full (estimated, chars/4 approximation).

---

Powered by code-review-graph — local-first analysis; no code leaves the CI runner.

[tirth8205]

Outside this sweep's mission of verified coding-session token savings: widening FastMCP to <5 permits major version 4 without repairing a selected failure. The current Python 3.11 and Windows checks also fail, so protocol compatibility needs separate evidence before changing that dependency contract.

[tirth8205]

This fails the checks once merged into staging.

Merge: clean fast-forward (pyproject.toml only). Gates as instructed, run in the merged worktree where uv.lock still pins fastmcp 3.4.5: pytest -> "3223 passed, 9 skipped, 2 xpassed, 1 warning in 170.33s"; ruff -> "All checks passed!"; mypy -> "Success: no issues found in 72 source files". That run does NOT exercise the PR, because the only thing the PR does is admit fastmcp 4.x and the lock kept 3.4.5.

To fix:

• Migrate code_review_graph/prompts.py:15 to an import that exists on both 3.x and 4.x (e.g. from fastmcp.prompts import Message, with a 3.x fallback if needed) and verify the rest of the FastMCP surface used in code_review_graph/main.py (FastMCP(), @mcp.tool/@mcp.prompt, mcp.list_tools, mcp.local_p...
• Run the full suite with fastmcp 4.x actually installed (uv lock --upgrade-package fastmcp) and commit the regenerated uv.lock so the lock matches the new constraint.
• Update the stale rationale comment in pyproject.toml (lines 29-31) and the fastmcp<4 cap references in docs/FEATURES.md:18 and docs/ROADMAP.md:16 (CHANGELOG.md:483 is historical and can stay).

Merge origin/staging into your branch first to reproduce it.

PRs now target staging, not main. Yours was retargeted already, so nothing to do there.