v4.0.0

ruixenui/ruixen.comv4.0.0Apr 13, 2026by github-actions[bot]

AI Summary

A major security-focused update to the OAuthProxy that removes default allowed redirect URIs to prevent URL open redirect vulnerabilities (CWE-601). Users must now explicitly configure the URIs they trust.

Key Highlights

Security fix for OAuthProxy redirect URI validation (CWE-601).
Removed default `allowedRedirectUriPatterns` (`['https://*', 'http://localhost:*']`).
Requires explicit URI configuration for deployments to avoid registration and authorization failures.

Breaking Changes

OAuthProxy no longer defaults allowedRedirectUriPatterns, requiring explicit configuration.

Full Release Notes

# [4.0.0](https://github.com/punkpeye/fastmcp/compare/v3.35.1...v4.0.0) (2026-04-13)


* fix(auth)!: validate redirect_uri in OAuthProxy.authorize (CWE-601) ([5478753](https://github.com/punkpeye/fastmcp/commit/5478753ac3b2b1bb16c64f0e1ae4422ca26536f8))


### Bug Fixes

* force build ([43dd675](https://github.com/punkpeye/fastmcp/commit/43dd6759deb71fc35e08618c23a4126f63a4f39a))
* merge conflict ([6a542e5](https://github.com/punkpeye/fastmcp/commit/6a542e5ddbac180aaa99ab737676e05d5089b992))


### BREAKING CHANGES

* OAuthProxy no longer defaults allowedRedirectUriPatterns
to ["https://*", "http://localhost:*"]. Deployments that relied on the
old default must configure the URIs they trust explicitly, e.g.
`allowedRedirectUriPatterns: ["https://yourapp.example.com/*"]`. Without
this, DCR will reject all registrations and /oauth/authorize will
reject all requests.