v4.0.0

punkpeye/fastmcpv4.0.0Apr 13, 2026by github-actions[bot]

AI Summary

Major release with critical security fix for OAuth redirect URI validation. This release contains breaking changes requiring explicit configuration of trusted redirect URIs.

Key Highlights

Security fix: validate redirect_uri in OAuthProxy.authorize (CWE-601)
Fixed build issues and merge conflicts
OAuthProxy no longer defaults allowedRedirectUriPatterns

Breaking Changes

OAuthProxy no longer defaults allowedRedirectUriPatterns to ["https://*", "http://localhost:*"]. Deployments must configure explicitly, e.g., allowedRedirectUriPatterns: ["https://yourapp.example.com/*"]

Full Release Notes

# [4.0.0](https://github.com/punkpeye/fastmcp/compare/v3.35.1...v4.0.0) (2026-04-13)


* fix(auth)!: validate redirect_uri in OAuthProxy.authorize (CWE-601) ([5478753](https://github.com/punkpeye/fastmcp/commit/5478753ac3b2b1bb16c64f0e1ae4422ca26536f8))


### Bug Fixes

* force build ([43dd675](https://github.com/punkpeye/fastmcp/commit/43dd6759deb71fc35e08618c23a4126f63a4f39a))
* merge conflict ([6a542e5](https://github.com/punkpeye/fastmcp/commit/6a542e5ddbac180aaa99ab737676e05d5089b992))


### BREAKING CHANGES

* OAuthProxy no longer defaults allowedRedirectUriPatterns
to ["https://*", "http://localhost:*"]. Deployments that relied on the
old default must configure the URIs they trust explicitly, e.g.
`allowedRedirectUriPatterns: ["https://yourapp.example.com/*"]`. Without
this, DCR will reject all registrations and /oauth/authorize will
reject all requests.