chore(deps): bump fastmcp to ^3.0.0 and authlib to 1.7.2

[rocky-jaiswal]

chore(deps): bump fastmcp to ^3.0.0 and authlib to 1.7.2

Summary

Upgrades fastmcp from ^2.14.0 (2.14.3) to ^3.0.0 (resolves to 3.4.0), which pulls authlib up to 1.7.2 (from 1.6.6). Adapts the MCP adapter to the one fastmcp 3.x API change that affects us.

Why

Critical security dependency maintenance — keeping fastmcp current (major 2.x → 3.x) and picking up the latest authlib.

[github-actions]

QualOps Code Quality Analysis

Status: ✅ PASSED - No issues found

Summary

• Total Issues: 0
• Critical: 0 🔴
• High: 0 🟠
• Medium: 0 🟡
• Low: 0 🟢
• Files Analyzed: 0

No issues found in the analyzed code.

📊 Full Report

View detailed report

---

Powered by QualOps

[pontino]

Rebased onto current main and resolved the sdk/poetry.lock conflict by regenerating it against the merged pyproject.toml. The lock now coheres fastmcp 3.4.0 + authlib 1.7.2 with the faststream 0.7.0 (#227) and pytest-cov 7.1.0 (#210) bumps that just landed on main. Adapter change and CHANGELOG entry untouched. Ready for review.

[pontino]

Tested locally against the rebased branch with fastmcp 3.4.0 installed (the mcp extra — which CI does not install, so CI never exercised this path):

• Adapter imports cleanly under fastmcp 3.x.
• list_tools() returns FunctionTool objects; tool.to_mcp_tool() yields correct name/description/inputSchema (properties + required)/outputSchema. Built ExternalTools match.
• call_tool("add", {a:2,b:40}) → 42.
• Confirmed the previous code getattr(tool, "inputSchema", {}) silently returned {} on 3.x FunctionTool objects — so this change repairs a latent bug, not just a version bump.

Lock regenerated coherently (fastmcp 3.4.0 + authlib 1.7.2 + faststream 0.7.0 + pytest-cov 7.1.0). All CI checks green.