FastMCP released v4.1.1 on October 18. The release adds bounds to its regex-based tool search: patterns longer than 1,000 characters are rejected, and a search stops after about one second. The feature lets clients find tools by pattern rather than listing every available tool.
The release also restores discovery of skill folders represented by links, including links to folders outside the skills root. FastMCP says that files belonging to a skill must still resolve inside the folder targeted by that link. Other fixes cover an unparsable proxy setting during update checks and the JWKS refresh lock.
FastMCP recommends that all 4.x users upgrade. The release notes do not identify a CVE, describe a demonstrated exploit, or provide measurements of the limits' security effect. Source: https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.1