v4.1.7: Dumpster Dive

FastMCP 4.1.7 backports 42 fixes from the 4.2 line, covering OpenAPI schema and parameter handling, OAuth redirect and consent edge cases, proxy and response caching, and lost-connection errors in the client. It also requires patched joserfc and Authlib releases and closes a redirect URI validation gap for callers that pass raw strings.

Thanks to our 41 contributors, including 28 first-time contributors.

What's Changed

Security 🔒

• Redact passwords from the worker's backend URL by @jaeminbird and @mbishflavien in #6113
• fix(auth): collapse a repeated iss in the client redirect by @shi-felix and @alpaylan in #6352
• Require patched joserfc by @zzstoatzz in #6371
• [4.1] Require patched Authlib in client and server extras by @zzstoatzz and @zhuweid in #6338
• [4.1] Normalize raw-string redirect URIs through AnyUrl before validation by @zzstoatzz, @uhhgxg, and @alpaylan in #6385

Fixes 🐞

• fix(openapi): serialize header and path parameters per the simple style by @Harsh23Kashyap in #5091
• fix(proxy): keep stale list results out of cache by @mikamikasuki in #5521
• fix(auth): Preserve browser consent bindings across concurrent OAuth approvals by @mikamikasuki in #5541
• fix(openapi): preserve explicit null in nullable JSON body properties by @mumu-bird in #5633
• fix: name root self-references after the generated root class by @BlueX888 in #5671
• Convert OpenAPI 3.0 boolean exclusive bounds to numeric bounds by @asasemahmed in #5697
• Rewrite component refs under not, if/then/else and similar keywords by @asasemahmed in #5698
• Fall back to method and path when an OpenAPI name slugs to nothing by @asasemahmed in #5699
• fix(openapi): keep media-type $defs beside component schemas by @BlueX888 in #5709
• Fix namespaced file resource reads while preserving URI normalization by @BlueLi66 in #5716
• fix(middleware): treat an empty methods allowlist as "log nothing" by @gdut4140 in #5727
• fix(server): pass typed list request messages to list middleware hooks by @BlueX888 in #5732
• fix(tasks): send task IDs in routing headers by @eli-yip in #5810
• fix(mcp-config): reuse one OAuth client per configured server by @kbkb628 and @whoskn in #6097
• Fix kept-alive stdio transports ignoring client timeouts by @HootRock in #6156
• fix(cli): preserve explicit null in generated tool commands by @likecake in #6191
• Honor empty tag inclusion filters in multi-server configs by @PennEwan in #6200
• Match Claude Code project keys by path on Windows by @zzstoatzz and @yongpange in #6240
• Stop preloading the server before launching the Inspector by @zzstoatzz and @mikamikasuki in #6241
• Cull expired OAuth state from the default OAuthProxy file store by @zzstoatzz, @nosmile99, and @mheidari98 in #6242
• Match Gemini function responses to tool-use IDs by @zzstoatzz and @mikamikasuki in #6244
• Replace parent type keywords when an ArgTransform changes the type by @zzstoatzz, @syf2211, @HootRock, and @chrikrah in #6246
• Expire idle per-client rate limiters by @zzstoatzz and @mikamikasuki in #6247
• Match resource templates that spell out a literal query by @zzstoatzz and @arieleven in #6248
• fix(telemetry): record mounted and nested server spans as INTERNAL by @zzstoatzz and @sonmaximum in #6252
• fix(openapi): keep both values when a query object property matches another parameter by @zzstoatzz and @alpaylan in #6256
• fix(middleware): map exception subclasses in ErrorHandlingMiddleware by @zzstoatzz and @zurmag in #6257
• fix(client): report a lost connection instead of 'Client is not connected' by @zzstoatzz and @alex-feel in #6259
• Mask prompt handler exceptions when mask_error_details=True by @pratyu2h and @maxmorrish in #6277
• fix(search): rebuild the BM25 index when the tool name set changes by @shi-felix in #6282
• fix(tools): keep hidden parameter factories out of visible defaults by @shi-felix in #6283
• fix(client): keep the response cache inert on legacy connections (#6298) by @xunWhale and @alpaylan in #6321
• fix(auth): accept private-use scheme redirect URIs in CIMD documents by @ColePBryan in #6335
• Send {} for required OpenAPI object bodies with no fields by @rome-xi and @wang1299 in #6340
• Report the stop reason from sampling handlers when no tools are offered by @AarnavNoble in #6342
• fix(auth): preserve empty authority on custom-scheme redirect URIs by @codesphere-u and @alpaylan in #6347
• Declare items.type on multi-select list shorthand elicitations by @zzstoatzz, @shi-felix, @Vivek1898, and @alpaylan in #6361

Docs 📚

• Correct how tools docs describe bytes return values by @DivyaNarahari97 in #6275

Other Changes 🦾

• Keep colon-terminated prose lines in docstring tool descriptions by @zzstoatzz, @jlx1999s, and @ptrailblazer89 in #6372

New Contributors

• @jaeminbird made their first contribution in #6113
• @mbishflavien made their first contribution in #6113
• @shi-felix made their first contribution in #6352
• @zhuweid made their first contribution in #6338
• @mumu-bird made their first contribution in #5633
• @BlueLi66 made their first contribution in #5716
• @gdut4140 made their first contribution in #5727
• @eli-yip made their first contribution in #5810
• @whoskn made their first contribution in #6097
• @likecake made their first contribution in #6191
• @PennEwan made their first contribution in #6200
• @yongpange made their first contribution in #6240
• @nosmile99 made their first contribution in #6242
• @mheidari98 made their first contribution in #6242
• @arieleven made their first contribution in #6248
• @sonmaximum made their first contribution in #6252
• @zurmag made their first contribution in #6257
• @pratyu2h made their first contribution in #6277
• @maxmorrish made their first contribution in #6277
• @xunWhale made their first contribution in #6321
• @ColePBryan made their first contribution in #6335
• @rome-xi made their first contribution in #6340
• @wang1299 made their first contribution in #6340
• @codesphere-u made their first contribution in #6347
• @Vivek1898 made their first contribution in #6361
• @DivyaNarahari97 made their first contribution in #6275
• @jlx1999s made their first contribution in #6372
• @ptrailblazer89 made their first contribution in #6372

Full Changelog: v4.1.6...v4.1.7