dependabot[bot] opened a new pull request, #11381: URL: https://github.com/apache/gravitino/pull/11381
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 2.14.5 to 3.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.3.1: Loop There It Is</h2> <p>FastMCP 3.3.1 is a hotfix for the 3.3 packaging split. Clean installs of 3.3.0 could fail on standalone component imports like <code>from fastmcp.tools import tool</code> because component modules reached auth and task primitives through <code>fastmcp.server</code>, pulling in the server/provider stack and exposing a circular import.</p> <p>Component-level auth and task primitives now live in lightweight utility modules, with the old server import paths preserved as compatibility re-exports. Component imports stay lightweight, existing server-facing imports continue to work, and the release also includes small docs corrections from the 3.3 rollout.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Fixes đ</h3> <ul> <li>fix(docs): use valid FA icon on client-only package page by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4139";>PrefectHQ/fastmcp#4139</a></li> <li>Decouple component imports from server by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4150";>PrefectHQ/fastmcp#4150</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.3.0...v3.3.1";>https://github.com/PrefectHQ/fastmcp/compare/v3.3.0...v3.3.1</a></p> <h2>v3.3.0: Slim Reaper</h2> <p>FastMCP 3.3 ships <code>fastmcp-slim</code>, a new lightweight distribution that separates the client from the server stack. It also closes out a meaningful backlog of security hardening, observability improvements, and auth additions that accumulated through the 3.2 cycle.</p> <h2>fastmcp-slim</h2> <p>The full FastMCP package pulls in Starlette, Uvicorn, and the rest of the server machinery â necessary for running a server, but wasteful if you're writing a client, a script, or an agent that just needs to talk to MCP. <code>fastmcp-slim</code> is a dependency-light distribution that ships the client and transport layer without any of that.</p> <p>The import namespace is unchanged:</p> <pre lang="python"><code>from fastmcp import Client <p>async with Client("<a href="https://example.com/mcp";>https://example.com/mcp</a>") as client: result = await client.call_tool("my_tool", {"arg": "value"}) </code></pre></p> <p>Install <code>fastmcp-slim[client]</code> anywhere you want FastMCP's client without the server footprint â CI environments, lightweight agents, library dependencies that shouldn't force Uvicorn on downstream users.</p> <h2>Security</h2> <p>The OAuth proxy received three hardening upgrades. Silent consent is now guarded against AS-in-the-middle attacks â a malicious authorization server can no longer silently approve a consent it wasn't meant to handle. Redirect URI allowlist matching now rejects dot-segment paths (<code>/../</code>, <code>/./</code>) that could otherwise bypass prefix checks. And <code>ResponseCachingMiddleware</code> partitions its cache by access token, closing a gap where different users could see each other's cached responses.</p> <h2>Auth</h2> <p><code>AzureB2CProvider</code> adds first-class support for Azure AD B2C user flows. The OCI provider is fixed for 3.x installs. And <code>OAuthProxy</code> gains a public <code>update_scopes()</code> API for updating the proxy's required scopes after initialization â useful for servers that determine scope requirements at runtime.</p> <h2>Observability</h2> <p>OTEL instrumentation is now fully compliant with MCP semantic conventions. List operations (<code>list_tools</code>, <code>list_resources</code>, <code>list_prompts</code>, <code>list_resource_templates</code>) are instrumented, and delegate spans on proxy servers are enriched with backend attributes.</p> <h2>Thread Affinity</h2> <p>Sync tools run in a thread pool by default. If your tool holds thread-local state or is bound to a specific thread (UI frameworks, some database drivers), you can now opt out:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.1.1";>v3.1.1: 'Tis But a Patch</a></strong></p> <p>Pins <code>pydantic-monty</code> below 0.0.8 to fix a breaking change in Monty that affects code mode. Monty 0.0.8 removed the <code>external_functions</code> constructor parameter, causing <code>MontySandboxProvider</code> to fail. This patch caps the version so existing installs work correctly.</p> <h3>Fixes đ</h3> <ul> <li>Pin pydantic-monty below 0.0.8 to fix code mode by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3497";>#3497</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.1.0...v3.1.1";>v3.1.0...v3.1.1</a></p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.1.0";>v3.1.0: Code to Joy</a></strong></p> <p>FastMCP 3.1 is the Code Mode release. The 3.0 architecture introduced providers and transforms as the extensibility layer â 3.1 puts that architecture to work, shipping the most requested capability since launch: servers that can find and execute code on behalf of agents, without requiring clients to know what tools exist.</p> <h3>New Features đ</h3> <ul> <li>feat: Search transforms for tool discovery by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3154";>#3154</a></li> <li>Add experimental CodeMode transform by <a href="https://github.com/aaazzam";><code>@âaaazzam</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3297";>#3297</a></li> <li>Add Prefab Apps integration for MCP tool UIs by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3316";>#3316</a></li> </ul> <h3>Enhancements đ§</h3> <ul> <li>Lazy-load heavy imports to reduce import time by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3295";>#3295</a></li> <li>Add http_client parameter to all token verifiers for connection pooling by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3300";>#3300</a></li> <li>Add in-memory caching for token introspection results by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3298";>#3298</a></li> <li>Add SessionStart hook to install gh CLI in cloud sessions by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3308";>#3308</a></li> <li>Fix ty 0.0.19 type errors by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3310";>#3310</a></li> <li>Code Mode: Add resource limits to MontySandboxProvider by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3326";>#3326</a></li> <li>Accept transforms as FastMCP init kwarg by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3324";>#3324</a></li> <li>Split large test files to comply with loq line limit by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3328";>#3328</a></li> <li>Add -m/--module flag to <code>fastmcp run</code> and <code>dev inspector</code> by <a href="https://github.com/dgenio";><code>@âdgenio</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3331";>#3331</a></li> <li>Add search_result_serializer hook and serialize_tools_for_output_markdown by <a href="https://github.com/MagnusS0";><code>@âMagnusS0</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3337";>#3337</a></li> <li>Add MultiAuth for composing multiple token verification sources by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3335";>#3335</a></li> <li>Adds PropelAuth as an AuthProvider by <a href="https://github.com/andrew-propelauth";><code>@âandrew-propelauth</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3358";>#3358</a></li> <li>Replace vendored DI with uncalled-for by <a href="https://github.com/chrisguidry";><code>@âchrisguidry</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3301";>#3301</a></li> <li>Decompose CodeMode into composable discovery tools by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3354";>#3354</a></li> <li>feat(contrib): auto-sync MCPMixin decorators with from_function signatures by <a href="https://github.com/AnkeshThakur";><code>@âAnkeshThakur</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3323";>#3323</a></li> <li>Add Google GenAI Sampling Handler by <a href="https://github.com/strawgate";><code>@âstrawgate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/2977";>#2977</a></li> <li>Add ListTools, search limit, and catalog size annotation to CodeMode by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3359";>#3359</a></li> <li>Allow configuring FastMCP transport setting in the same way as other configuration by <a href="https://github.com/jvdmr";><code>@âjvdmr</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/1796";>#1796</a></li> <li>Add include_unversioned option to VersionFilter by <a href="https://github.com/yangbaechu";><code>@âyangbaechu</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3349";>#3349</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/d8dcc273cac9f6f17889a1b60adbdc654f948a50";><code>d8dcc27</code></a> Decouple component imports from server (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4150";>#4150</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/255e3e491082d8fbaeb3ccf25be6983cbab8b657";><code>255e3e4</code></a> fix(docs): use valid FA icon on client-only package page (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4139";>#4139</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/73df4dcaeeba6f985607f633786d38db6caf23f7";><code>73df4dc</code></a> chore: Update SDK documentation (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4096";>#4096</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/ee48a0fd6e077e1c32e996f7b51fd442e31c514f";><code>ee48a0f</code></a> Refine fastmcp-slim packaging (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4125";>#4125</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/bb4894d2159cd10f0c07f038db9c56b14fb99586";><code>bb4894d</code></a> Add fastmcp-slim for client-only installs (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4122";>#4122</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/8209093871af25bc3ceb50bfbcec317632218afd";><code>8209093</code></a> fix(http): terminate active streamable-HTTP transports before lifespan shutdo...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/cf59a4511ff1980fd932215ef886e665c829bdbf";><code>cf59a45</code></a> Fix OCI Provider issue in 3.x version. Add OCI auth provider example ⌠(<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4116";>#4116</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/89b99ecfb987781735295869d2e3d620dde7af4c";><code>89b99ec</code></a> fix(proxy): fall back to live identifier for backend_* span attributes (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4109";>#4109</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/310314cf149a18d0a76e5703ee98f80ffb035171";><code>310314c</code></a> fix: cli option --no-banner is NOT passed to cli but server-spec in-correctly...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/28722f846a0319913a4a7b67dd65131d615214b6";><code>28722f8</code></a> fix: drop exc_info for expected tool failures, remove unreachable ValidationE...</li> <li>Additional commits viewable in <a href="https://github.com/PrefectHQ/fastmcp/compare/v2.14.5...v3.3.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
