v4.1 — Word forms, FastMCP 4, patched image

Word forms, FastMCP 4 with the sessionless 2026-07-28 protocol, <br> that behaves, and a patched image. Everything from the 4.1 betas, now on latest.

🔒 Security (#208)

The image is clean of the findings from the latest scan:

• fastmcp / fastmcp-slim 4.1.0 → 4.1.3: GHSA-7xgj-8392-5q4r (post-transform authorization skipped on direct calls), GHSA-vqqp-x5qm-5qp4.
• certifi ≥ 2026.10.19: drops the emSign roots whose intermediate keys leaked (GHSA-6q48-6c7w-9gw2).
• pip 25.0.1 → 26.2: in both the app's venv and the base Python (CVE-2025-8869, CVE-2026-3219, -6357, -8643, -13346).
• brotli 1.2.1: CVE-2026-111497. Every release now rebuilds the shipped image stage instead of reusing a cached apk upgrade.

✨ Word content controls (#200, #201)

A Word template can be a real form. Check boxes, drop-down lists, text fields, combo boxes and date pickers are filled by their Tag (Developer ▸ Properties ▸ Tag = argument name), with no {{placeholder}} needed, and the file stays an editable form.

• A group of check boxes is one argument (type: list with enum).
• New date argument type: the AI sends ISO, and the picker shows it in its own format.
• A control the AI leaves out keeps its prompt, so you can fill it by hand.
• Dynamic Word templates return warnings when something did not fit, the way the static tools do.
• Admin UI: finds the controls, pre-fills the arguments from their tags, and previews them filled.

⬆️ FastMCP 4.1 (#206)

• FastMCP 3.4 → 4.1 (MCP SDK 2.3). Clients on the 2026-07-28 protocol connect without a handshake or session, and existing clients work as before.
• Smaller tool schemas: optional arguments no longer publish "default": null (#202).

🩹 Bug fixes

• <br> + Enter is one soft break, not a new paragraph, in prose, lists, quotes, placeholders and header/footer text. Signature blocks and addresses come out as one paragraph (#204).
• A {{placeholder}} no longer moves a content control or hyperlink in the same paragraph to its start (#200).
• The admin UI no longer drops enum options when saving a template (#200).
• A rejected API key returns Unauthorized – invalid or missing API key instead of a traceback (#206).

Check on upgrade (from v4.0)

• Idle sessions expire after 30 minutes. To keep the old behaviour, set FASTMCP_HTTP_SESSION_IDLE_TIMEOUT=none.
• A rejected API key is JSON-RPC error -32600. A client that matched on the old error should match on the message.
• A content control whose Tag equals an argument name is now filled. A Word type: list + enum argument is now multi-choice.
• Dynamic Word template tools can return {"file": …, "warnings": […]} instead of a bare URL.
• A line after a list item ending in <br> or two spaces joins that item. Put a blank line after the item to get a separate paragraph.

docker pull georgx22/mcp-office-docs:v4.1

Full changelog: v4.0...v4.1