FastMCP 4.1.2 fixes an auth gap you have to switch on. Upgrading alone won't close it.

FastMCP shipped version 4.1.2 on October 20 with a security fix that only works once you add one setting, so upgrading alone leaves the gap open. FastMCP is a Python library for building MCP servers. Those are the plug points agents use to call your tools. The FastMCP v4.1.2 release notes on GitHub bind OAuth client credentials to a configured issuer. That's the server that hands out tokens. The catch is one line. Teams on ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient.

The same release makes access rules apply after transforms, the step that reshapes a tool. It also stops a denied resource from slipping through a matching template.

Here's what I'd do. Before you bump a version, search the notes for must set. Then grep your config for those two provider names. A fix that waits on a setting is a config change. Your dependency bot won't open that pull request for you.