dependabot[bot] opened a new pull request, #11527: URL: https://github.com/apache/gravitino/pull/11527
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 2.14.5 to 3.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.2.0: Show Don't Tool</h2> <p>FastMCP 3.2 is the Apps release. The 3.0 architecture gave you providers and transforms; 3.1 shipped Code Mode for tool discovery. 3.2 puts a face on it: your tools can now return interactive UIs — charts, dashboards, forms, maps — rendered right inside the conversation.</p> <h2>FastMCPApp</h2> <p><code>FastMCPApp</code> is a new provider class for building interactive applications inside MCP. It separates the tools the LLM sees (<code>@app.ui()</code>) from the backend tools the UI calls (<code>@app.tool()</code>), manages visibility automatically, and gives tool references stable identifiers that survive namespace transforms and server composition — without requiring host cooperation.</p> <pre lang="python"><code>from fastmcp import FastMCP, FastMCPApp from prefab_ui.actions.mcp import CallTool from prefab_ui.components import Column, Form, Input, Button, ForEach, Text <p>app = FastMCPApp("Contacts")</p> <p><a href="https://github.com/app";><code>@app</code></a>.tool() def save_contact(name: str, email: str) -> list[dict]: db.append({"name": name, "email": email}) return list(db)</p> <p><a href="https://github.com/app";><code>@app</code></a>.ui() def contact_manager() -> PrefabApp: with PrefabApp(state={"contacts": list(db)}) as view: with Column(gap=4): ForEach("contacts", lambda c: Text(c.name)) with Form(on_submit=CallTool("save_contact")): Input(name="name", required=True) Input(name="email", required=True) Button("Save") return view</p> <p>mcp = FastMCP("Server", providers=[app]) </code></pre></p> <p>The UI is built with <a href="https://prefab.prefect.io";>Prefab</a>, a Python component library that compiles to interactive UIs. You write Python; the user sees charts, tables, forms, and dashboards. FastMCP handles the MCP Apps protocol machinery — renderer resources, CSP configuration, structured content serialization — so you don't have to.</p> <p>For simpler cases where you just want to visualize data without server interaction, set <code>app=True</code> on any tool and return Prefab components directly:</p> <pre lang="python"><code>@mcp.tool(app=True) def revenue_chart(year: int) -> PrefabApp: with PrefabApp() as app: BarChart(data=revenue_data, series=[ChartSeries(data_key="revenue")]) return app </code></pre> <h2>Built-in Providers</h2> <p>Five ready-made providers you add with a single <code>add_provider()</code> call:</p> <ul> <li><strong>FileUpload</strong> — drag-and-drop file upload with session-scoped storage</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.1";>v3.4.1: Floor It</a></strong></p> <p>FastMCP 3.4.1 floors Starlette at <code>>=1.0.1</code> so installs can no longer resolve to a version affected by CVE-2026-48710, which was previously only constrained transitively through <code>mcp</code>. It also makes OAuthProxy log refresh-token cache misses instead of failing silently.</p> <h3>Enhancements ✨</h3> <ul> <li>Log refresh-token misses in OAuthProxy instead of failing silently by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4276";>#4276</a></li> </ul> <h3>Security 🔒</h3> <ul> <li>Add explicit starlette>=1.0.1 floor (CVE-2026-48710) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4286";>#4286</a></li> </ul> <h3>Docs 📚</h3> <ul> <li>Document --notes-start-tag in release instructions by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4275";>#4275</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.0...v3.4.1";>v3.4.0...v3.4.1</a></p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.0";>v3.4.0: Remote Control</a></strong></p> <p>FastMCP 3.4 is about reaching servers that live somewhere else. The headline is <code>fastmcp-remote</code>, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, the proxy layer those connections depend on is hardened: a proxy now forwards <code>initialize</code> upstream and fails loudly when the backend is missing or misconfigured, instead of reporting a connected-but-empty proxy. And FastMCP-issued access tokens can now outlive short-lived upstream tokens, so authenticated sessions survive the long idle periods remote clients are prone to.</p> <h3>New Features 🎉</h3> <ul> <li>Add fastmcp-remote bridge package by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4208";>#4208</a></li> </ul> <h3>Breaking Changes ⚠️</h3> <ul> <li>Forward proxy initialize as bridge behavior by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4228";>#4228</a></li> </ul> <h3>Enhancements ✨</h3> <ul> <li>ci: require external PRs to link a tracked issue by <a href="https://github.com/strawgate";><code>@strawgate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4173";>#4173</a></li> <li>feat: new options --host and --no-log-panel | --log-panel to cli dev apps by <a href="https://github.com/itaru2622";><code>@itaru2622</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4123";>#4123</a></li> <li>Add valid_scopes and extra_authorize_params to WorkOSProvider by <a href="https://github.com/tiagoskaneta";><code>@tiagoskaneta</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4135";>#4135</a></li> <li>Add token_expiry_threshold_seconds for proactive token refresh by <a href="https://github.com/mohankumarelec";><code>@mohankumarelec</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4142";>#4142</a></li> <li>Add review-issue skill for triaging gated external contributions by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4212";>#4212</a></li> <li>Add contract gate to review-issue skill by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4214";>#4214</a></li> <li>Let ToolResult return an error result via is_error by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4217";>#4217</a></li> <li>Update published docs after PyPI release by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4211";>#4211</a></li> <li>Allow pre-bound HTTP sockets by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4222";>#4222</a></li> <li>Add targeted coverage tests by <a href="https://github.com/strawgate";><code>@strawgate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4230";>#4230</a></li> <li>Upgrade ty to 0.0.39 by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4225";>#4225</a></li> <li>Decouple FastMCP access token lifetime from upstream expires_in by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4254";>#4254</a></li> </ul> <h3>Security 🔒</h3> <ul> <li>feat(code-mode): default sandbox limits and per-execution tool-call cap by <a href="https://github.com/strawgate";><code>@strawgate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4170";>#4170</a></li> <li>Security: Fix 3 findings in GitHub Actions workflows by <a href="https://github.com/jpr5";><code>@jpr5</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4183";>#4183</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/665514e19a78543709be85b4261153bbe98e882f";><code>665514e</code></a> Add forward_resource flag to OAuthProxy (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3711";>#3711</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/f189d1f7fbfd55c9f68c750a3a293e31c7586e8b";><code>f189d1f</code></a> Bump pydantic-monty to 0.0.9 (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3707";>#3707</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/6faa2d61f82eab670694965606fd7b14bedddc7f";><code>6faa2d6</code></a> Remove hardcoded prefab-ui version from pinning warnings (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3708";>#3708</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/dd8816c6ccc733048fe6208bfc8f80ded505f993";><code>dd8816c</code></a> chore: Update SDK documentation (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3701";>#3701</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/d27495960af23969f11d6e1e44e2018529c1c37e";><code>d274959</code></a> docs: note that custom routes are unauthenticated (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3706";>#3706</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/4a54be2d5f1ac8925a461e67cf993e0278729d4d";><code>4a54be2</code></a> Add examples gallery page (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3705";>#3705</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/961dd5045611e9c1bd6b7c4f5ac3aa14f0a30ce7";><code>961dd50</code></a> Add interactive map example with geocoding (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3702";>#3702</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/f01d0c581c7a821a9701d6dde4d9beb95e32d479";><code>f01d0c5</code></a> Add quiz example app, fix dev server empty string args (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3700";>#3700</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/85b7efd74601a72c74ac68e23599de6c032bb9c4";><code>85b7efd</code></a> chore: Update SDK documentation (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3694";>#3694</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/27abe3c3f0cc2ce1925cc3cbc7968d5637ebc82b";><code>27abe3c</code></a> Add sales dashboard and live system monitor examples, bump prefab-ui to 0.17 ...</li> <li>Additional commits viewable in <a href="https://github.com/PrefectHQ/fastmcp/compare/v2.14.5...v3.2.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/gravitino/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
