fix: allow fastmcp 4.0.3+ / mcp 2.2.0+ and fix the OAuth test for mcp 2 (#37) #39

Merged
ric merged 1 commit from v6.7.x into main 2026-09-15 09:25:56 +00:00
Owner

Corrects #38. That PR bounded fastmcp<4 / mcp<2, but production already runs OmniMem 6.7.1 on fastmcp 4.0.3 / mcp 2.2.0 without trouble, so the bound pointed CI and the next image build at older versions than the ones in use.

What actually broke on mcp 2

Only a test. In mcp 2, OAuthClientInformationFull.client_id is a required str, and a mode="before" validator strips null and "" at parse time, so the model can't be built without an id. mcp 2's registration handler assigns str(uuid4()) before calling the provider, so a real registration always arrives with one. test_register_and_get built a client with client_id=None, which is the only thing that failed.

Change

  • fastmcp>=4.0.3,<5 and mcp>=2.2.0,<3: floor at the production versions, ceiling at the next major so the next breaking release is adopted deliberately. mcp stays listed because fastmcp's metadata doesn't declare it
  • test_register_and_get registers a client with its id already assigned, as mcp 2 delivers it
  • New test_register_generates_an_id_when_blank reaches the provider's generate-if-missing fallback through model_copy (skips validation)
  • Changelog entry under [6.7.2] - Unreleased rewritten to match

Verified

The Test Coverage job's exact steps on a clean Python 3.12 install with no cache:

  • resolved fastmcp 4.0.3, mcp 2.2.0
  • 1917 passed, 1 skipped, exit 0
  • every memory/ and tools/ module at 100%
  • badge generation succeeds

The v6.7.1 images don't need rebuilding: they run the same versions this PR now declares.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HWqtyPdN5MHxqoVM3Sj9xD

Corrects #38. That PR bounded `fastmcp<4` / `mcp<2`, but production already runs OmniMem 6.7.1 on fastmcp 4.0.3 / mcp 2.2.0 without trouble, so the bound pointed CI and the next image build at older versions than the ones in use. ## What actually broke on mcp 2 Only a test. In mcp 2, `OAuthClientInformationFull.client_id` is a required `str`, and a `mode="before"` validator strips `null` and `""` at parse time, so the model can't be built without an id. mcp 2's registration handler assigns `str(uuid4())` before calling the provider, so a real registration always arrives with one. `test_register_and_get` built a client with `client_id=None`, which is the only thing that failed. ## Change - `fastmcp>=4.0.3,<5` and `mcp>=2.2.0,<3`: floor at the production versions, ceiling at the next major so the next breaking release is adopted deliberately. mcp stays listed because fastmcp's metadata doesn't declare it - `test_register_and_get` registers a client with its id already assigned, as mcp 2 delivers it - New `test_register_generates_an_id_when_blank` reaches the provider's generate-if-missing fallback through `model_copy` (skips validation) - Changelog entry under `[6.7.2] - Unreleased` rewritten to match ## Verified The Test Coverage job's exact steps on a clean Python 3.12 install with no cache: - resolved fastmcp 4.0.3, mcp 2.2.0 - 1917 passed, 1 skipped, exit 0 - every `memory/` and `tools/` module at 100% - badge generation succeeds The v6.7.1 images don't need rebuilding: they run the same versions this PR now declares. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HWqtyPdN5MHxqoVM3Sj9xD
fix: allow fastmcp 4.0.3+ / mcp 2.2.0+ and fix the OAuth test for mcp 2 (#37)
All checks were successful
Security Scans / Bandit SAST (pull_request) Successful in 11s
Security Scans / Dependency Audit (mcp_server) (pull_request) Successful in 40s
Security Scans / Dependency Audit (rss_worker) (pull_request) Successful in 27s
Security Scans / Dependency Audit (web_ui) (pull_request) Successful in 26s
Security Scans / Test Coverage (pull_request) Successful in 1m13s
Security Scans / Secret Scan (pull_request) Successful in 5s
66272a2e47
Production already runs fastmcp 4.0.3 / mcp 2.2.0, so the <4 / <2 bound
from 332fab3 pointed CI and the images at older versions than the ones in
use. The only break on mcp 2 was test-side: OAuthClientInformationFull
requires client_id and strips null/"" at parse, while mcp 2's registration
handler assigns a uuid before calling the provider.

Floor the requirements at the production versions with a ceiling at the
next major, register the test client with its id assigned, and reach the
generate-if-missing fallback through model_copy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HWqtyPdN5MHxqoVM3Sj9xD
ric merged commit 6aaee7e8f5 into main 2026-09-15 09:25:56 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ric/omnimem!39
No description provided.