chore(deps): require fastmcp 4.1.0 and mcp 2.3.0

README.md

@@ -310,6 +310,8 @@ uvx --from mcp-server-espn espn-mcp --transport streamable-http --host 127.0.0.1
 
 Connect Streamable HTTP clients to `http://127.0.0.1:8000/mcp` (FastMCP's default Streamable HTTP path).
 
+In the default (stateful) HTTP mode, a session idle for 30 minutes expires: its next request gets HTTP 404 and the client must start a new session. Change this with FastMCP's `session_idle_timeout` (on `http_app()`) or `FASTMCP_HTTP_SESSION_IDLE_TIMEOUT` (seconds, or `none` to never expire); see the [FastMCP 4.1.0 release](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.0) and [#5229](https://github.com/PrefectHQ/fastmcp/pull/5229).
+
 **HTTP authentication.** Set `ESPN_MCP_AUTH_TOKEN` to require `Authorization: Bearer <token>` on every HTTP request; a missing or wrong token gets `401`. The token is stripped, and a blank value counts as unset. It is attached when the server is built, so `espn-mcp`, `fastmcp run` and an ASGI host mounting `mcp.http_app()` all enforce it. stdio never uses it.
 
 With no token, `espn-mcp` refuses an HTTP bind to any host other than `127.0.0.1`, `::1` or `localhost` and exits with code 2. Set the token, bind to localhost, or set `ESPN_MCP_ALLOW_UNAUTHENTICATED_BIND=1` to accept an unauthenticated public bind. Other entry points get the token but not the localhost check: `fastmcp run` and `http_app()` do not go through `espn-mcp`'s `main()`, so a bind to `0.0.0.0` with no token there is not refused and serves without authentication. The host or its process manager owns the bind address, so set `ESPN_MCP_AUTH_TOKEN` there.

fastmcp.json

@@ -6,8 +6,8 @@
   },
   "environment": {
     "dependencies": [
-      "fastmcp>=4.0.11",
-      "mcp>=2.2.0",
+      "fastmcp>=4.1.0",
+      "mcp>=2.3.0",
       "httpx>=0.28.1",
       "pydantic>=2.13.5",
       "pydantic-settings>=2.15.0"

pyproject.toml

@@ -26,8 +26,8 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
-    "mcp>=2.2.0",
-    "fastmcp>=4.0.11",
+    "mcp>=2.3.0",
+    "fastmcp>=4.1.0",
     "httpx>=0.28.1",
     "pydantic>=2.13.5",
     "pydantic-settings>=2.15.0",