v4.1.8: Backporch Light

FastMCP 4.1.8 backports 28 fixes from the 4.2 line, led by OAuth proxy token revocation, which now works for the client that owns the token. It also fixes recursive and untyped schema hydration, GitHub sessions across transient verification failures, proxied sampling and prompt arguments, and a set of OpenAPI, client timeout, task and CLI edge cases.

Thanks to our 21 contributors, including 9 first-time contributors.

What's Changed

Fixes 🐞

• fix: keep additionalProperties on object schemas without a type by @bfs2021 and @alpaylan in #6127
• Fix hydration of mutually recursive schema types by @zzstoatzz, @wozhenbang2004, and @alpaylan in #6394
• Isolate filesystem component construction failures by @PennEwan in #6210
• fix(config): apply tool transforms before tag filters on single servers by @AP24110011695 and @arjunprabhulal in #6214
• fix(tools): isolate mutable defaults in transformed tool calls by @priy-anshugupta in #6184
• fix(openapi): make resource templates for non-identifier path parameters readable by @AP24110011695 and @alpaylan in #6187
• Document that a custom httpx_client_factory owns its timeout by @asasemahmed and @himanshuchawla0807-gif in #5923
• Stop PingMiddleware erroring when the client has no back-channel by @asasemahmed in #5901
• Store sessionless client log levels on the connection by @asasemahmed in #5899
• Register templated MCPMixin resources as resource templates by @asasemahmed in #5895
• Send the whole body when a body $ref with siblings cannot be flattened by @asasemahmed in #5893
• Pass the transport to the fastmcp-remote proxy so it forwards server-initiated requests by @asasemahmed in #5885
• fix(cli): forward path, stateless and log-level to SDK MCPServer servers by @BlueX888 in #5870
• fix(client): preserve a caller-provided OAuth httpx client factory when verify is set by @BlueX888 in #5849
• fix(prompts): resolve postponed annotations when rendering by @67-luck and @BlueX888 in #5803
• fix(openapi): hydrate data for wrapped non-object responses with validate_output=False by @nosmile99 and @BlueX888 in #5784
• Carry prompt argument titles through PromptArgument and proxies by @AarnavNoble in #5749
• Relay the client's sampling result unchanged through proxies by @AarnavNoble in #5747
• fix(tasks): let async-generator tools run as background tasks by @gdut4140 in #5730
• Honor Code Mode search limits after BM25 ranking by @Winoren and @BlueX888 in #5715
• Keep the client timeout from capping the HTTP read timeout by @asasemahmed in #5690
• fix(auth): avoid rereading failed authorization forms by @pei711 and @JordanAfolabiLaw in #5570
• Fix unbounded Apps dev log retention by @mikamikasuki in #5549
• Bound error-stat cardinality in ErrorHandlingMiddleware by @mikamikasuki in #5537
• fix(auth): preserve GitHub sessions across transient verification failures by @sui-ni2 and @benjohngf in #4881
• Expect the extended read timeout in the factory timeout test by @zzstoatzz in #6395
• fix(auth): keep revocation ownership separate from user identity by @zzstoatzz, @BlueX888, and @67-luck in #6404
• Authenticate and pin the schema download in the OpenAPI performance test by @zzstoatzz in #6177

New Contributors

• @AP24110011695 made their first contribution in #6214
• @JordanAfolabiLaw made their first contribution in #5570
• @Winoren made their first contribution in #5715
• @arjunprabhulal made their first contribution in #6214
• @benjohngf made their first contribution in #4881
• @bfs2021 made their first contribution in #6127
• @pei711 made their first contribution in #5570
• @priy-anshugupta made their first contribution in #6184
• @wozhenbang2004 made their first contribution in #6394

Full Changelog: v4.1.7...v4.1.8