build(deps-dev): bump fastmcp from 3.4.3 to 3.4.4 in /pywry

[dependabot]

Bumps fastmcp from 3.4.3 to 3.4.4.

Release notes

Sourced from fastmcp's releases.

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in PrefectHQ/fastmcp#4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in PrefectHQ/fastmcp#4439
• Restore HTTP host guard compatibility by @​jlowin in PrefectHQ/fastmcp#4472

Docs 📚

• Docs: add v3.4.4 changelog entries by @​jlowin in PrefectHQ/fastmcp#4473

New Contributors

• @​evalstate made their first contribution in PrefectHQ/fastmcp#4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in #4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in #4439
• Restore HTTP host guard compatibility by @​jlowin in #4472

New Contributors

• @​evalstate made their first contribution in #4385

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

Enhancements ✨

• Dedupe discriminator-required helper across schema converters by @​jlowin in #4362
• Add real Monty sandbox e2e coverage for CodeMode call_tool by @​AlexlaGuardia in #4274
• Switch prettier hook to rbubley/mirrors-prettier by @​jlowin in #4366
• feat(remote): add --verify flag for TLS certificate verification by @​jlowin in #4369

Security 🔒

• fix(deps): clear Dependabot security alerts via lockfile bumps by @​jlowin in #4393
• Clarify resource path parameter safety by @​jlowin in #4398
• Fix dev apps launch escaping by @​jlowin in #4399
• Block NAT64 SSRF bypass by @​jlowin in #4400
• [codex] Fix event store replay isolation by @​jlowin in #4402
• Fix DCR redirect URI validation by @​jlowin in #4408
• Protect streamable HTTP from DNS rebinding by @​jlowin in #4405
• Block unsafe OAuth redirect schemes by @​jlowin in #4419
• Block IPv6 transition SSRF bypasses by @​jlowin in #4426

Fixes 🐞

• fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @​gmenziesint in #4301
• Fix: async rate limiting middleware get_client_id callbacks by @​Chotom in #4319

... (truncated)

Commits

• 9138d40 Docs: add v3.4.4 changelog entries (#4473)
• d929882 Hugging Face Auth Integration (#4385)
• 5fe4fae Restore HTTP host guard compatibility (#4472)
• 400db61 Relax host origin guard defaults (#4439)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)