# What changed in fastmcp

> 35 changes in fastmcp 3 to 4 from its official release notes, upgrade guides and advisories: 2 breaking, 3 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/fastmcp/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## fastmcp 4

### Breaking changes

- Certifi-backed server dependencies and optional SDK integrations now require certifi 2026.10.19 or later following the eMudhra CA compromise. (3.4.11, 4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3), [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.11)
- FastMCP 4 uses system trust by default; developers may need to update operating-system, container, custom, and installer trust stores because upgrading FastMCP alone is insufficient. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)

### Security

- Authorization now applies after component transforms, so transformed components are authorized before use. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- OAuth client credentials can be bound to a configured issuer across fresh and cached-token flows. Users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Denied or disabled resources can no longer be served through matching templates. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

### New APIs and options

- Adds a foundation for the SEP-2640 Skills extension. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Adds experimental Skills discovery to SkillsDirectoryProvider. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

### Behavior and default changes

- The upstream token auth method now defaults to none when there is no client secret, fixing public-client OAuth authentication. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)

### Fixes and other changes

- Ordinary requests now honor timeout settings in per-server MCP configuration. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- Empty session visibility selections are now preserved. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- A TimeoutError raised by a tool body's own code is no longer classified as the tool timeout. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- Generator results from transform_fn are now materialized when run, fixing handling of generator transforms. (4.1.3) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3)
- Preserves public metadata in built-in read contents. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Accepts ES256 and other RSA/EC algorithms for CIMD private_key_jwt assertions. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Uses the client timeout when resolving claimed results if no other timeout applies. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Fixes ctx.log() when extra contains names that are attributes of LogRecord. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- The MCP-format inspect output follows pagination and escapes server metadata in its text summary. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Keeps fastmcp.json resolvable when deployment.cwd changes the working directory. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Data-backed File resources are named consistently with their MIME subtype. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Respects an explicit is_binary=False value. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- FileUpload and session visibility are scoped to a stable client on MCP 2026-07-28. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Adds discovery of Goose Streamable HTTP extensions. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Reports an unbindable OAuth callback port instead of raising SystemExit. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- The OAuth callback server no longer requires websockets. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Accepts private_key_jwt without a form client_id. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Python stdio child processes now run in UTF-8 mode. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Synchronous resource templates now run in the threadpool. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Preserves component metadata for list[ResourceContent] returns. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Valid schema defaults are hydrated while invalid defaults are preserved. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Preserves shared dependency scopes without optional task dependencies. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Treats non-string skill frontmatter descriptions as absent. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Raises ToolError when a tool with an output schema returns an unserializable value. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- Preserves icons on transformed tools. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)
- The CLI now honors an explicitly specified URL transport. (4.1.2) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2)

## fastmcp 3

### Fixes and other changes

- Update custom, system, and installer trust stores too; upgrading FastMCP alone is insufficient. (3.4.11) — [release notes](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.11)