This patch release fixes a fresh install bug where the packaging library was previously installed as a transitive dependency but is no longer—causing an import error on fresh installs without dev dependencies. Also includes a pydocket version pin to avoid Redis connection noise in tests, plus backports from 3.x for $ref dereferencing in tool schemas and the task capabilities location fix.

What's Changed

Enhancements 🔧

• Add release notes for v2.14.2 and v2.14.3 by @jlowin in #2851

Fixes 🐞

• Backport: Dereference $ref in tool schemas for MCP client compatibility by @jlowin in #2861
• Fix task capabilities location (issue #2870) by @jlowin in #2874
• Add missing packaging dependency by @jlowin in #2989

Full Changelog: v2.14.3...v2.14.4

FastMCP 3.0 rebuilds the framework around three primitives: components, providers, and transforms. Providers source components dynamically—from decorators, filesystems, OpenAPI specs, remote servers, or anywhere else. Transforms modify components as they flow to clients—renaming, namespacing, filtering, securing. The features that required specialized subsystems in v2 now compose naturally from these building blocks.

🔌 Provider Architecture unifies how components are sourced. FileSystemProvider discovers decorated functions from directories with optional hot-reload. SkillsProvider exposes agent skill files as MCP resources. OpenAPIProvider and ProxyProvider get cleaner integrations. Providers are composable—share one across servers, or attach many to one server.

🔄 Transforms add middleware for components. Namespace mounted servers, rename verbose tools, filter by version, control visibility—all without touching source code. ResourcesAsTools and PromptsAsTools expose non-tool components to tool-only clients.

📋 Component Versioning lets you register @tool(version="2.0") alongside older versions. Clients see the highest version by default but can request specific versions. VersionFilter serves different API versions from one codebase.

💾 Session-Scoped State persists across requests. await ctx.set_state() and await ctx.get_state() now survive the full session. Per-session visibility via ctx.enable_components() lets servers adapt dynamically to each client.

⚡ DX Improvements include --reload for auto-restart during development, automatic threadpool dispatch for sync functions, tool timeouts, pagination for large component lists, and OpenTelemetry tracing.

🔐 Component Authorization via @tool(auth=require_scopes("admin")) and AuthMiddleware for server-wide policies.

...and more.

Breaking changes are minimal: for most servers, updating the import statement is all you need. See the migration guide for details.

What's Changed

New Features 🎉

• Refactor resource behavior and add meta support by @jlowin in #2611
• Refactor prompt behavior and add meta support by @jlowin in #2610
• feat: Provider abstraction for dynamic MCP components by @jlowin in #2622
• Unify component storage in LocalProvider by @jlowin in #2680
• Introduce ResourceResult as canonical resource return type by @jlowin in #2734
• Introduce Message and PromptResult as canonical prompt types by @jlowin in #2738
• Add --reload flag for auto-restart on file changes by @jlowin in #2816
• Add FileSystemProvider for filesystem-based component discovery by @jlowin in #2823
• Add standalone decorators and eliminate fastmcp.fs module by @jlowin in #2832
• Add authorization checks to components and servers by @jlowin in #2855
• Decorators return functions instead of component objects by @jlowin in #2856
• Add transform system for modifying components in provider chains by @jlowin in #2836
• Add OpenTelemetry tracing support by @chrisguidry in #2869
• Add component versioning and VersionFilter transform by @jlowin in #2894
• Add version discovery and calling a certain version for components by @jlowin in #2897
• Refactor visibility to mark-based enabled system by @jlowin in #2912
• Add session-specific visibility control via Context by @jlowin in #2917
• Add Skills Provider for exposing agent skills as MCP resources by @jlowin in #2944

Enhancements 🔧

• Convert mounted servers to MountedProvider by @jlowin in #2635
• Simplify .key as computed property by @jlowin in #2648
• Refactor MountedProvider into FastMCPProvider + TransformingProvider by @jlowin in #2653
• Enable background task support for custom component subclasses by @jlowin in #2657
• Use CreateTaskResult for background task creation by @jlowin in #2660
• Refactor provider execution: components own their execution by @jlowin in #2663
• Add supports_tasks() method to replace string mode checks by @jlowin in #2664
• Replace type: ignore[attr-defined] with isinstance assertions in tests by @jlowin in #2665
• Add poll_interval to TaskConfig by @jlowin in #2666
• Refactor task module: rename protocol.py to requests.py and reduce redundancy by @jlowin in #2667
• Refactor FastMCPProxy into ProxyProvider by @jlowin in #2669
• Move OpenAPI to providers/openapi submodule by @jlowin in #2672
• Use ergonomic provider initialization pattern by @jlowin in #2675
• Fix ty 0.0.5 type errors by @jlowin in #2676
• Remove execution methods from Provider base class by @jlowin in #2681
• Add type-prefixed keys for globally unique component identification by @jlowin in #2704
• Skip parallel MCP config test on Windows by @jlowin in #2711
• Consolidate notification system with unified API by @jlowin in #2710
• Skip test_multi_client on Windows by @jlowin in #2714
• Parallelize provider operations by @jlowin in #2716
• Consolidate get_* and list* methods into single API by @jlowin in #2719
• Consolidate execution method chains into single public API by @jlowin in #2728
• Add documentation check to required PR workflow by @jlowin in #2730
• Parallelize list_* calls in Provider.get_tasks() by @jlowin in #2731
• Consistent decorator-based MCP handler registration by @jlowin in #2732
• Make ToolResult a BaseModel for serialization support by @jlowin in #2736
• Align prompt handler with resource pattern by @jlowin in #2740
• Update classes to inherit from FastMCPBaseModel instead of BaseModel by @jlowin in #2739
• Convert provider tests to use direct server calls by @jlowin in #2748
• Add explicit task_meta parameter to FastMCP.call_tool() by @jlowin in #2749
• Add task_meta parameter to read_resource() for explicit task control by @jlowin in #2750
• Add task_meta to prompts and centralize fn_key enrichment by @jlowin in #2751
• Remove unused include_tags/exclude_tags settings by @jlowin in #2756
• Parallelize provider access when executing components by @jlowin in #2744
• Add tests for OAuth generator cleanup and use aclosing by @jlowin in #2759
• Deprecate tool_serializer parameter by @jlowin in #2753
• Feature/supabase custom auth route by @EloiZalczer in #2632
• Add regression tests for caching with mounted server prefixes by @jlowin in #2762
• Update CLI banner with FastMCP 3.0 notice by @jlowin in #2766
• Make FASTMCP_SHOW_SERVER_BANNER apply to all server startup methods by @jlowin in #2771
• Add MCP tool annotations to smart_home example by @triepod-ai in #2777
• Cherry-pick debug logging for OAuth token expiry to main by @jlowin in #2797
• Turn off negative CLI flags by default by @jlowin in #2801
• Configure ty to fail on warnings by @jlowin in #2804
• Dereference $ref in tool schemas for MCP client compatibility by @jlowin in #2814
• Add v3.0 feature tracking document by @jlowin in #2822
• Remove deprecated WSTransport by @jlowin in #2826
• Add composable lifespans by @jlowin in #2828
• Replace FastMCP.as_proxy() with create_proxy() function by @jlowin in #2829
• Add docs-broken-links command and fix docstring markdown parsing by @jlowin in #2830
• Add PingMiddleware for keepalive connections by @jlowin in #2838
• Add CLI up...

This patch release fixes an HTTP transport timeout bug where connections were defaulting to 5 seconds instead of respecting MCP's 30-second default, causing premature timeouts for slower operations. Also includes OAuth token storage fixes, Redis key isolation for ACL compliance, and improved ContextVar propagation for ASGI-mounted servers. Plus, the CLI will now nudge you when updates are available (you're welcome, future you).

What's Changed

Enhancements 🔧

• Add debug logging for OAuth token expiry diagnostics by @jlowin in #2789
• Add CLI update notifications by @jlowin in #2839
• Use pip instead of uv pip in upgrade instructions by @jlowin in #2841

Fixes 🐞

• Backport OAuth token storage TTL fix to release/2.x by @jlowin in #2798
• Prefix Redis keys with docket name for ACL isolation (2.x backport) by @chrisguidry in #2812
• Fix ContextVar propagation for ASGI-mounted servers with tasks by @chrisguidry in #2843
• Fix HTTP transport timeout defaulting to 5 seconds by @jlowin in #2848

Full Changelog: v2.14.2...v2.14.3

FastMCP 2.14.2 brings a wave of community contributions safely into the 2.x line. A variety of important fixes backported from 3.0 work improve OpenAPI 3.1 compatibility, MCP spec compliance for output schemas and elicitation, and correct a subtle base_url fallback issue. The CLI now gently reminds you that FastMCP 3.0 is on the horizon.

What's Changed

Enhancements 🔧

• Pin MCP under 2.x by @jlowin in #2709
• Add auth_route parameter to SupabaseProvider by @EloiZalczer in #2760
• Update CLI banner with FastMCP 3.0 notice by @jlowin in #2765

Fixes 🐞

• Let FastMCPError propagate unchanged from managers by @jlowin in #2697
• Fix test cleanup for uvicorn 0.39+ context isolation by @jlowin in #2696
• Bump pydocket to 0.16.3 to fix worker cleanup race condition by @chrisguidry in #2700
• Fix Prefect website URL in docs footer by @mgoldsborough in #2705
• Fix: resolve root-level $ref in outputSchema for MCP spec compliance by @majiayu000 in #2727
• Fix OAuth Proxy resource parameter validation by @jlowin in #2763
• Fix openapi_version check to include 3.1 by @deeleeramone in #2769
• Fix titled enum elicitation schema to comply with MCP spec by @jlowin in #2774
• Fix base_url fallback when url is not set by @bhbs in #2782
• Lazy import DiskStore to avoid sqlite3 dependency on import by @jlowin in #2785

Docs 📚

• Add v3 breaking changes notice to README and docs by @jlowin in #2713
• Add changelog entries for v2.13.1 through v2.14.1 by @jlowin in #2724
• conference to 2.x branch by @aaazzam in #2787

Full Changelog: v2.14.1...v2.14.2

FastMCP 2.14.1 adds support for sampling with tools (SEP-1577). This exciting new feature lets servers pass tools to ctx.sample(), enabling agentic workflows where the server borrows the client's LLM and controls tool execution automatically. Pass any callable as a tool and FastMCP handles the loop: calling the LLM, executing tools, and feeding results back until a final response is produced. For fine-grained control, ctx.sample_step() makes a single LLM call and returns a SampleStep, letting you inspect tool calls, add custom logic, or build your own execution loop. Structured output via result_type returns validated Pydantic models instead of raw text. This release also adds AnthropicSamplingHandler alongside the existing OpenAI handler (newly promoted out of the experimental module), so clients and servers can provide sampling capability across major providers with ease.

What's Changed

New Features 🎉

• SEP-1577: Sampling with tools by @jlowin in #2551
• Add AnthropicSamplingHandler by @jlowin in #2617

Enhancements 🔧

• Add Python 3.13 to Ubuntu CI tests by @jlowin in #2606
• Remove legacy _task_capable_initialize() workaround by @jlowin in #2612
• Consolidate session state reset logic and improve cancellation cleanup by @jlowin in #2615
• Unify SamplingHandler and promote OpenAI handler by @jlowin in #2616
• Add tool_names parameter to mount() for name overrides by @jlowin in #2619
• Adopt streamable_http_client API from MCP SDK by @jlowin in #2620
• Deprecate exclude_args in favor of Depends() by @jlowin in #2621

Fixes 🐞

• fix: prompt tasks returning mcp.types.PromptMessage now work by @chrisguidry in #2603
• Use WindowsSelectorEventLoopPolicy to fix Windows test warnings by @jlowin in #2607
• Clean up cancelled connection startup by @shawnthapa in #2614
• Consolidate sampling examples and fix tool_choice bug by @jlowin in #2618

Docs 📚

• docs: simplify Docket tip wording by @jlowin in #2599

Dependencies 📦

• chore: bump pydocket to >=0.15.5 by @chrisguidry in #2605

New Contributors

• @shawnthapa made their first contribution in #2614

Full Changelog: v2.14.0...v2.14.1

FastMCP 2.14 begins adopting the MCP 2025-11-25 specification, headlined by protocol-native background tasks that let long-running operations report progress without blocking clients. This release also graduates the OpenAPI parser to standard, adds first-class support for several new spec features, and removes deprecated APIs accumulated across the 2.x series.

Background Tasks (SEP-1686)

Long-running operations (like tool calls) normally block MCP clients until they complete. The new MCP background task protocol (SEP-1686) lets clients start operations, track progress, and retrieve results without blocking. For FastMCP users, taking advantage of this new functionality is as easy as adding task=True to any async decorator. Under the hood, it's powered by Docket, the enterprise task scheduler at the heart of Prefect Cloud that handles millions of concurrent tasks every day.

from fastmcp import FastMCP
from fastmcp.dependencies import Progress

mcp = FastMCP("MyServer")

@mcp.tool(task=True)
async def train_model(dataset: str, progress: Progress = Progress()) -> str:
    await progress.set_total(100)
    for epoch in range(100):
        # ... training work ...
        await progress.increment()
    return "Model trained successfully"

Clients that call this tool in task-augmented mode (for FastMCP clients, that merely means another task=True!) receive a task ID immediately, poll for progress updates, and fetch results when ready. Background tasks work out-of-the-box with an in-memory backend, and users can optionally provide a Redis URL for persistence, horizontal scaling, and single-digit millisecond task pickup latency. When using Redis, users can also add additional Docket workers to scale out their task processing.

Read the docs here!

OpenAPI Parser Promotion

The experimental OpenAPI parser graduates to standard. The new architecture delivers improved performance through single-pass schema processing and cleaner internal abstractions. Existing code works unchanged; users of the experimental module should update their imports.

MCP 2025-11-25 Spec Support

This release begins adopting the MCP 2025-11-25 specification. Beyond the core SDK updates, FastMCP adds first-class developer experiences for:

• SEP-1686: Background tasks with progress tracking
• SEP-1699: SSE polling and event resumability, with full AsyncKeyValue support
• SEP-1330: Multi-select enum elicitation schemas
• SEP-1034: Default values for elicitation schemas
• SEP-986: Tool name validation at registration time

As the MCP SDK continues to adopt more of the specification, FastMCP will add corresponding high-level APIs.

Breaking Changes & Cleanup

This release removes deprecated APIs accumulated across the 2.x series: BearerAuthProvider, Context.get_http_request(), the dependencies parameter, legacy resource prefix formats, and several deprecated methods. The upgrade guide provides migration paths for each.

What's Changed

New Features 🎉

• Switch to new OpenAPI parser as default by @jlowin in #2513
• [2.14] SEP-1686 tasks by @chrisguidry in #2378

Enhancements 🔧

• Expose InitializeResult to middleware by @jlowin in #2516
• [2.14] Update for MCP SDK auth changes by @chrisguidry in #2507
• Validate tool names at registration time (SEP-986) by @jlowin in #2540
• Deflake GitHub MCP remote integration tests by @chrisguidry in #2543
• Add SEP-1034 default values support for elicitation by @jlowin in #2545
• Improve rate limit detection for integration tests by @chrisguidry in #2550
• Reduce Marvin Test Failure noise by @strawgate in #2553
• [SEP-1686] Raise ValueError when sync functions have task=True by @jlowin in #2554
• refactor: move task attribute to function-based variants only [SEP-1686] by @jlowin in #2560
• Fix type errors for ty 0.0.1-alpha.31 upgrade by @jlowin in #2561
• Add regression tests for functools.wraps + Context (#2524) by @jlowin in #2566
• Update VersionBadge to use Mintlify native Badge component by @jlowin in #2571
• Add TaskConfig for SEP-1686 execution modes by @jlowin in #2570
• Add execution field to base Tool class by @chrisguidry in #2576
• SEP-1699: Add SSE polling support with EventStore by @jlowin in #2564
• SEP-1330 enum schema support by @jlowin in #2549
• Expose get_session_id callback by @mathewjhan in #2486
• Remove TaskConfig and client from root exports by @jlowin in #2580
• Remove overly restrictive MIME type validation from Resource by @jlowin in #2585
• feat: handle error from the initialize middleware by @tonyxwz in #2531
• Remove tests/test_examples.py by @jlowin in #2593

Fixes 🐞

• Fix RFC 8414 path-aware authorization server metadata discovery by @jlowin in #2533
• Make fastapi.cli a runnable package by @paulo-raca in #2532
• Move TokenHandler to OAuthProvider for consistent OAuth error codes by @jlowin in #2538
• Update FastMCP server documentation link by @sskim91 in #2529
• Fix: Include signature modification in create_function_without_params by @AidanAllchin in #2563
• add client kwargs to proxy clients and meta to proxy tool calls by @cegersdoerfer in #2520
• Prefix Docket function names to avoid collisions in multi-mount setups by @chrisguidry in #2575
• Fix OAuth client to preserve full URL path for metadata discovery by @jlowin in #2577
• Do not run windows tests in parallel by @jlowin in #2579
• Fix proxy tool result meta attribute forwarding by @dherrman in #2526
• Fix nested server mount routing for 3+ levels deep by @jlowin in #2586
• Add smart fallback for missing access token expiry by @jlowin in #2587
• fix: preserve exception propagation through transport cleanup by @jlowin in #2591

Breaking Changes 🛫

• Remove enable_docket setting; Docket is now always on by @chrisguidry in #2558
• Forbid task execution through proxies, add mount/proxy task tests by @chrisguidry in #2574
• Remove enable_tasks setting, enable task protocol by default by @chrisguidry in #2578
• Remove deprecated from fastmcp.settings import settings by @jlowin in #2581
• Remove deprecated mount/import argument order and separator params by @jlowin in #2582
• 2.14 deprecation removals by @jlowin in #2329
  Note that #2329 includes the following PRs:
  • Remove deprecated FASTMCP_SERVER_ environment variable prefix by @jlowin in #2330
  • Remove deprecated Context.get_http_request method by @jlowin in #2332
  • Remove fastmcp.Image top-level import (deprecated 2.8.1) by @jlowin in #2334
  • Remove deprecated client parameter from FastMCPProxy by @jlowin in #2333
  • Remove deprecated run_streamable_http_async method by @jlowin in #2338
  • Remove deprecated sse_app method by @jlowin in #2337
  • Remove deprecated run_sse_async method by @jlowin in #2335
  • Remove deprecated streamable_http_app method by @jlowin in #2336
  • Remove deprecated dependencies parameter (fixes #2177) by @jlowin in #2340
  • Remove output_schema=False support (deprecated 2.11.4) by @jlowin in #2339
  • Remove deprecated BearerAuthProvider module by @jlowin in #2341
    ...

MCP SDK 1.23 introduced some changes related to the 11/25/25 MCP protocol update that break some patches/workarounds that FastMCP had implemented previously. In particular, OAuth changes in the new protocol changed some implementation details that FastMCP patched; as such 1.23 is not necessarily a breaking SDK change but it is "breaking" for certain FastMCP behaviors.

As a precaution, this release pins mcp<1.23. FastMCP 2.14 will introduce 11/25/25 support (and require mcp>=1.23).

FastMCP 2.13.2 polishes the authentication stack with fixes for token refresh, scope handling, and multi-instance deployments. Discord joins the growing roster of built-in OAuth providers, Azure and Google token handling gets more reliable, and proxy classes now properly forward icons and titles. This release also adds CSP customization for consent screens and fixes an edge case where $defs could mutate during tool transforms.

Welcome to 7 new contributors who made their first FastMCP contributions in this release!

What's Changed

New Features 🎉

• Add Discord OAuth provider and corresponding tests by @Aisha630 in #2428

Enhancements 🔧

• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #2433
• feat: Made Changes to DescopeProvider to Support New Well Known URLs by @gaokevin1 in #2392
• Scalekit provider updates by @AkshayParihar33 in #2413
• Add consent_csp_policy parameter for CSP customization by @jlowin in #2484
• Add icons support to proxy classes by @jlowin in #2502

Fixes 🐞

• Add refresh token support defaults to GoogleProvider by @jlowin in #2438
• Fix exclude_args with non-serializable types by @jlowin in #2440
• Fix Azure OAuth token refresh with unprefixed scopes by @Neet-Nestor in #2462
• fix: prevent $defs mutation in Tool.from_tool transforms by @jtanningbed in #2493
• Add title attribute to ProxyTool, ProxyResource, … by @CNSeniorious000 in #2497
• Fix OAuth proxy refresh token storage for multi-instance deployments by @jlowin in #2483
• Fix get_access_token() returning stale token after OAuth refresh by @jlowin in #2505
• Fix version badges for icons and website_url; add Discord example by @jlowin in #2509
• Fix Azure provider OIDC scope handling by @jlowin in #2506

Docs 📚

• Update http.mdx by @Shengshenlan in #2446
• Fix version number in VersionBadge: change 2.14.0 to 2.13.0 by @ShaikAyesha17 in #2491
• Add Discord OAuth integration documentation by @jlowin in #2508

Dependencies 📦

• Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #2432
• Bump py-key-value-aio to 0.3.0 by @strawgate in #2437
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #2474

Other Changes 🦾

• Add extra_authorize_params and extra_token_params to OIDCProxy by @jlowin in #2439

New Contributors

• @Neet-Nestor made their first contribution in #2462
• @Shengshenlan made their first contribution in #2446
• @gaokevin1 made their first contribution in #2392
• @ShaikAyesha17 made their first contribution in #2491
• @jtanningbed made their first contribution in #2493
• @CNSeniorious000 made their first contribution in #2497
• @Aisha630 made their first contribution in #2428

Full Changelog: v2.13.1...v2.13.2

FastMCP 2.13.1 introduces meta parameter support for ToolResult (#2283), letting tools return metadata alongside results to enable new use cases such as OpenAI's Apps SDK. It also supports client-sent meta (#2206) as well as improved OAuth capabilities and custom token verifiers (including the new DebugTokenVerifier) and an OCI authentication provider. A large list of enhancements and bugfixes round out the release.

Note that #2422 excludes MCP SDK 1.21.1 as a permitted dependency version due to a bug that fails FastMCP integration tests.

What's Changed

Enhancements 🔧

• Cleanly render auth errors from OAuth Proxy by @jlowin in #2268
• Add custom token verifier support to OIDCProxy by @jlowin in #2279
• Supporting Multiple Issuers For JWTVerifier Oauth Workflow by @mhassaninmsft in #2233
• Switch to logger.exception for fastmcp run/inspect by @jakekaplan in #2294
• Add base_authority parameter to AzureProvider for Azure Government support by @jlowin in #2306
• Add DebugTokenVerifier with custom sync/async validation by @jlowin in #2296
• Added to_data_uri method for Image class. by @Hyperclaw79 in #2227
• Remove test warnings by @jlowin in #2331
• Mark flaky Windows test for retry by @jlowin in #2344
• Add meta support to ToolResult by @BrandonShar in #2283
• switch from pre-commit to prek by @zzstoatzz in #2309
• Add manual initialization control to Client by @jlowin in #2355
• Pin Cyclopts to v4.0.0 + compliance note by @jlowin in #2354
• Switch marvin to prek from pre-commit by @strawgate in #2361
• Add meta to call tool by @aiorga-sherpas in #2206
• feat: add algorithm configuration to Supabase auth provider by @cemalkilic in #2376
• chore(typos): fix additional typos by @pstoeckle in #2396
• Martian triage for test failures by @strawgate in #2407
• OCI Provider with Docs by @kiranthakkar in #2389

Fixes 🐞

• Fix OAuth token storage documentation by @jlowin in #2272
• fix(docs): correct the key_value repo link by @JonZeolla in #2276
• Remove trailing slashes from MCP endpoint URLs by @jlowin in #2277
• Fix py-key-value-aio minimum version to 0.2.8 by @jlowin in #2288
• Fix Chrome CSP blocking OAuth consent form with custom protocol redirects by @jlowin in #2305
• Add OIDCProxy to auth module exports by @jlowin in #2308
• Require uvicorn>=0.35 for websockets-sansio support by @jlowin in #2307
• Fix query-only resource templates not matching URIs without query strings by @joshuadavidthomas in #2323
• Security: Update authlib to 1.6.5 (CVE-2025-61920) by @ColeMurray in #2347
• Security: Validate Cursor deeplink URLs and use safer Windows API by @ColeMurray in #2348
• fix: on_initialize is not using request params but the whole request by @Maxi91f in #2357
• Fix OAuth metadata endpoint URLs when base_url differs from issuer_url by @jlowin in #2353
• Fix Windows test timeouts from SQLite locking by @jlowin in #2368
• Fix: URL-encode server name in Cursor deeplinks by @jlowin in #2369
• Fix get_http_headers() returning empty dict in on_initialize middleware by @jlowin in #2370
• Allow OAuth instance to use the same httpx factory as the Transport by @guschnwg in #2324
• Fix consent form action for subpath mounting by @jlowin in #2382
• Fix Windows test timeout and restore parallel testing by @jlowin in #2383
• Fix duplicate keyword argument error in configure_logging by @strawgate in #2381
• Update CSP to allow data URI images on OAuth screens by @lawrence-law in #2405
• fix: upstream token cache expires when refresh expires by @wipash in #2410
• fix(oauth_proxy): 🐛 add extra_token_params as kwargs in refresh… by @EdenTrainorCDL in #2387
• fix(OpenAPIParser): Fix missing $defs for response schemas in experimental OpenAPI parser by @ChristophNetsch in #2398
• docs: fix run_server_async documentation by @jlowin in #2423
• Fix self-referencing types not being recognized as object schemas by @jlowin in #2424
• Simplify _is_object_schema helper by @jlowin in #2426

Docs 📚

• Update Azure sidebar title to include Entra ID by @jlowin in #2266
• Improve OAuth client token storage security documentation by @jlowin in #2270
• Add note about docs version by @jlowin in #2271
• 📝 Add docstrings to enhancement/support-jwt-multiple-issuers by @coderabbitai[bot] in #2282
• Add maturity warnings for py-key-value backends by @strawgate in #2311
• Improve ToolResult and structured output documentation by @jlowin in #2349
• Document client meta parameter by @jlowin in #2367
• docs: clarify pytest-asyncio dependency and asyncio mode configuration by @strawgate in #2399

Dependencies 📦

• Bump ty to ==0.0.1a25 by @jlowin in #2350

Other Changes 🦾

• Replace openapi-core with jsonschema-path by @jlowin in #2291
• Fix lowest-direct dependency tests to actually test minimum versions by @Copilot in #2295
• Add version badge for DebugTokenVerifier by @jlowin in #2390
• Handle request_context availability during MCP initialization by @jlowin in #2400
• Exclude MCP SDK 1.21.1 and add scope validation to InMemoryOAuthProvider by @jlowin in #2422

New Contributors

• @JonZeolla made their first contribution in #2276
• @mhassaninmsft made their first contribution in #2233
• @coderabbitai[bot] made their first contribution in #2282
• @jakekaplan made their first contribution in #2294
• @joshuadavidthomas made their first contribution in #2323
• @Hyperclaw79 made their first contribution in #2227
• @ColeMurray made their first contribution in #2347
• @BrandonShar made their first contribution in #2283
• @aiorga-sherpas made their first contribution in #2206
• @guschnwg made their first contribution in #2324
• @cemalkilic made their first contribution in #2376
• @pstoeckle made their first contribution in #2396
• @lawrence-law made their first contribution in #2405
• @wipash made their first contribution in #2410
• @EdenTrainorCDL made their first contribution in #2387
• @ChristophNetsch made their first contribution in #2398
• @kiranthakkar made their first contribution in #2389

Full Changelog: v2.13.0.1...v2.13.1

Bugfixes

This release includes two critical dependency fixes:

• Fix py-key-value-aio minimum version (#2288): Corrected minimum version requirement to 0.2.8 to ensure compatibility
• Replace openapi-core with jsonschema-path (#2291): Migrated from openapi-core to jsonschema-path for improved OpenAPI validation performance and stability