# What changed in fastmcp-slim

> 34 changes in fastmcp-slim 3 to 4 from its official release notes, upgrade guides and advisories: 3 breaking, 5 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/fastmcp-slim/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## fastmcp-slim 4

### Breaking changes

- Certifi-backed server dependencies and optional SDK integrations now require certifi 2026.10.19 or later following the eMudhra CA compromise. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- A tool with an output schema now raises ToolError when it returns an unserializable value. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

### Security

- FastMCP 4 uses system trust by default; update operating-system, container, custom, and installer trust stores because upgrading FastMCP alone is insufficient. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- Set issuer to bind OAuth client credentials to a configured issuer across fresh and cached-token flows; upgrading alone does not enable this protection. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Authorization now applies after component transforms, so transformed components are checked before being served. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Set issuer to bind OAuth client credentials to a configured issuer across fresh and cached-token flows; upgrading alone does not enable this protection. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Denied resources no longer fall through to matching templates, preventing disabled resources from being served. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

### New APIs and options

- Adds a foundation for the SEP-2640 Skills extension. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Adds experimental Skills discovery to SkillsDirectoryProvider. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

### Fixes and other changes

- Per-server MCP config timeouts are honored for ordinary requests. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- Empty session visibility selections are preserved instead of being lost. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- A TimeoutError raised by a tool body's own code is no longer classified as the tool timeout. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- Generator results from transform_fn are materialized when run, fixing generator transforms. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- The upstream token auth method now defaults to none when there is no client secret, fixing public-client OAuth authentication. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- CIMD private_key_jwt assertions now accept ES256 and other RSA/EC algorithms. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Falls back to the client timeout when resolving claimed results. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Fixes ctx.log() failures when extra contains names of LogRecord attributes. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- The MCP format of fastmcp inspect now follows pagination. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Keeps fastmcp.json resolvable when deployment.cwd changes the working directory. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Data-backed File resources are named consistently with their MIME subtype. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- An explicit is_binary=False is now respected. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- FileUpload and session visibility are scoped to a stable client on MCP 2026-07-28. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Adds discovery of Goose Streamable HTTP extensions. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- An unbindable OAuth callback port is reported instead of causing SystemExit. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- The OAuth callback server no longer requires websockets. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Accepts private_key_jwt without a form client_id. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Python stdio child processes now run in UTF-8 mode. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Built-in read contents preserve public metadata. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Component metadata is preserved for list[ResourceContent] returns. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Valid schema defaults are hydrated while invalid defaults are preserved. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Non-string skill frontmatter descriptions are treated as absent. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Icons are preserved on transformed tools. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- The CLI now honors an explicitly selected URL transport. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

## fastmcp-slim 3

### Breaking changes

- FastMCP's HTTP stack now requires certifi 2026.10.19 or later. Update custom, system, and installer trust stores too; upgrading FastMCP alone is insufficient. (3.4.11) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.11)