This is an automated email from the ASF dual-hosted git repository.
yuqi1129 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new fd743121c7 build(deps): bump fastmcp from 3.4.2 to 3.4.5 in
/mcp-server (#12311)
fd743121c7 is described below
commit fd743121c77e436d3c96184bd8488ef7d9226679
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Mon Aug 10 20:18:22 2026 +0800
build(deps): bump fastmcp from 3.4.2 to 3.4.5 in /mcp-server (#12311)
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.2 to
3.4.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's
releases</a>.</em></p>
<blockquote>
<h2>v3.4.5: Key Change</h2>
<p>FastMCP 3.4.5 collects five fixes for the 3.x line. The one that
prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra,
and some Keycloak configurations publish by default — made
<code>JWTVerifier</code> reject every token, including ones correctly
signed by supported keys in the same set.</p>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Fixes 🐞</h3>
<ul>
<li>Backport <a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4517";>#4517</a>
to release/3.x: skip unsupported JWKS keys (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4515";>#4515</a>)
by <a href="https://github.com/kakiii";><code>@kakiii</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4631";>PrefectHQ/fastmcp#4631</a></li>
<li>Backport <a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4469";>#4469</a>
to release/3.x: fix Azure scope fallback by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4662";>PrefectHQ/fastmcp#4662</a></li>
<li>Backport <a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4523";>#4523</a>
to release/3.x: serialize deep object query parameters by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4664";>PrefectHQ/fastmcp#4664</a></li>
<li>Backport <a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4564";>#4564</a>
to release/3.x: make transformed tool required order deterministic by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4665";>PrefectHQ/fastmcp#4665</a></li>
<li>Backport <a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4492";>#4492</a>
to release/3.x: don't mutate the caller's schema in compress_schema by
<a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4663";>PrefectHQ/fastmcp#4663</a></li>
</ul>
<h3>Docs 📚</h3>
<ul>
<li>Docs: add v3.4.5 changelog entries by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4673";>PrefectHQ/fastmcp#4673</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kakiii";><code>@kakiii</code></a> made
their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4631";>PrefectHQ/fastmcp#4631</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5";>https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5</a></p>
<h2>v3.4.4: Host in Translation</h2>
<p>FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3
Host/Origin guard changed default behavior for existing ASGI,
serverless, and reverse-proxy deployments. The guard implementation
remains available for deployments that opt in with explicit trusted
hosts and origins, while 3.x returns to accepting traffic that worked
before the patch. This release also adds Hugging Face OAuth provider
support, with docs and examples for public and private apps, PKCE,
Dynamic Client Registration, and CIMD.</p>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Enhancements ✨</h3>
<ul>
<li>Hugging Face Auth Integration by <a
href="https://github.com/evalstate";><code>@evalstate</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4385";>PrefectHQ/fastmcp#4385</a></li>
</ul>
<h3>Fixes 🐞</h3>
<ul>
<li>Relax host origin guard defaults by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4439";>PrefectHQ/fastmcp#4439</a></li>
<li>Restore HTTP host guard compatibility by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4472";>PrefectHQ/fastmcp#4472</a></li>
</ul>
<h3>Docs 📚</h3>
<ul>
<li>Docs: add v3.4.4 changelog entries by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4473";>PrefectHQ/fastmcp#4473</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/evalstate";><code>@evalstate</code></a>
made their first contribution in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4385";>PrefectHQ/fastmcp#4385</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.3...v3.4.4";>https://github.com/PrefectHQ/fastmcp/compare/v3.4.3...v3.4.4</a></p>
<h2>v3.4.3: The Fast and the Secure-ious</h2>
<p>FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64,
6to4, Teredo, and ISATAP transition addresses can no longer smuggle
private IPv4 targets past the SSRF allow-list, Streamable HTTP now
validates Host and Origin before session handling to block DNS rebinding
against localhost-bound servers, and OAuth redirect validation rejects
unsafe schemes and unregistered DCR redirect URIs. Alongside the
security work, this release also fixes proxy session teardown races,
discriminator-tag handling in JSON schema conversion, and several
smaller reliability issues.</p>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Enhancements ✨</h3>
<ul>
<li>Dedupe discriminator-required helper across schema converters by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4362";>PrefectHQ/fastmcp#4362</a></li>
<li>Add real Monty sandbox e2e coverage for CodeMode call_tool by <a
href="https://github.com/AlexlaGuardia";><code>@AlexlaGuardia</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4274";>PrefectHQ/fastmcp#4274</a></li>
<li>Switch prettier hook to rbubley/mirrors-prettier by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4366";>PrefectHQ/fastmcp#4366</a></li>
<li>feat(remote): add --verify flag for TLS certificate verification by
<a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4369";>PrefectHQ/fastmcp#4369</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's
changelog</a>.</em></p>
<blockquote>
<hr />
<h2>title: "Changelog"
icon: "list-check"
rss: true
tag: NEW</h2>
<!-- raw HTML omitted -->
<p><strong><a
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b1";>v4.0.0b1:
Fourgone Conclusion</a></strong></p>
<p>FastMCP 4 makes stateful MCP applications work on the sessionless
<code>2026-07-28</code> protocol while one deployment continues serving
handshake-era clients. Tools can ask follow-up questions across
requests, preserve authenticated user state, and move long-running work
into background tasks without sticky sessions. Protocol extensions and
enterprise identity become first-class surfaces, and most FastMCP 3
servers upgrade unchanged even though MCP Python SDK v2 rewrote the
engine underneath them. Server-initiated sampling and roots are removed
from the server API; the <a
href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/getting-started/upgrading/from-fastmcp-3";>upgrade
guide</a> covers their replacements.</p>
<h3>New Features 🎉</h3>
<ul>
<li>Migrate to MCP Python SDK v2 by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4437";>#4437</a></li>
<li>Teach fastmcp.Client the modern protocol: mode negotiation, MRTR
driver, response cache by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4450";>#4450</a></li>
<li>Forward-port Hugging Face auth provider by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4475";>#4475</a></li>
<li>Add server-side identity assertion (SEP-990 ID-JAG) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4483";>#4483</a></li>
<li>Add guard-mode multi-round-trip tools (SEP-2322) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4544";>#4544</a></li>
<li>Add FastMCP-native server extension API (SEP-2133) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4602";>#4602</a></li>
<li>Add stateless session state (UserSession / SessionId) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4604";>#4604</a></li>
<li>Add background tasks via the io.modelcontextprotocol/tasks extension
(SEP-2663) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4603";>#4603</a></li>
</ul>
<h3>Breaking Changes ⚠️</h3>
<ul>
<li>Emit one SERVER span per request and adopt spec-correct error codes
by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4445";>#4445</a></li>
<li>Remove 3.x deprecated module shims and dead parameters by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4447";>#4447</a></li>
<li>Remove 3.0-deprecated FastMCP server methods by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4451";>#4451</a></li>
<li>Remove 3.x deprecated parameters and object-mode decorators by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4453";>#4453</a></li>
<li>Migrate to MCP SDK v2.0.0b2 (httpx2) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4503";>#4503</a></li>
<li>Fix typos by <a
href="https://github.com/szepeviktor";><code>@szepeviktor</code></a> in
<a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4498";>#4498</a></li>
<li>Stop proxies from validating backend results or mutating shared
transports by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4552";>#4552</a></li>
<li>Surface resource, prompt, and proxy errors on the modern protocol by
<a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4579";>#4579</a></li>
<li>Negotiate the best mutual protocol era by default by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4572";>#4572</a></li>
<li>Remove server-initiated sampling and roots from the server API by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4648";>#4648</a></li>
<li>Remove 3.x-era compatibility shims by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4661";>#4661</a></li>
</ul>
<h3>Enhancements ✨</h3>
<ul>
<li>Deprecate ctx.sample and add clear errors for push features on 2026
connections by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4448";>#4448</a></li>
<li>Add server-level cache hints (SEP-2549) by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4464";>#4464</a></li>
<li>Add KeyValueResponseCacheStore for distributed client response
caching by <a href="https://github.com/jlowin";><code>@jlowin</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4479";>#4479</a></li>
<li>Test lifespan fires once per process over HTTP by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4480";>#4480</a></li>
<li>Add telemetry off-switch and mcp.protocol.version span attribute by
<a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4481";>#4481</a></li>
<li>Trace client task management requests by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4525";>#4525</a></li>
<li>Stabilize upgraded ty checks by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4526";>#4526</a></li>
<li>Improve DescopeProvider scope discovery and well-known URL support
by <a href="https://github.com/gaokevin1";><code>@gaokevin1</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4489";>#4489</a></li>
<li>Add examples/ to the ty static-analysis gate by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4466";>#4466</a></li>
<li>Expose telemetry attributes on span start by <a
href="https://github.com/zzstoatzz";><code>@zzstoatzz</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4487";>#4487</a></li>
<li>Fix-issue-4284 : Add Auth0MCPProvider for Auth0 Auth for MCP by <a
href="https://github.com/vijaydeepsinha";><code>@vijaydeepsinha</code></a>
in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4411";>#4411</a></li>
<li>Run FastMCP middleware for every inbound message by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4553";>#4553</a></li>
<li>Add 'prs welcome' label to waive the PR assignment gate by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4557";>#4557</a></li>
<li>Rename martian workflows to marvin by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4558";>#4558</a></li>
<li>Bump pinned Claude models to current versions by <a
href="https://github.com/jlowin";><code>@jlowin</code></a> in <a
href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4561";>#4561</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/8de0c94cbbe71849c98cef2bbe08cdf498dba09c";><code>8de0c94</code></a>
Docs: add v3.4.5 changelog entries (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4673";>#4673</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/5daa91bafe75a9549e9acf0fd68cfdb3fe2d0ccb";><code>5daa91b</code></a>
Backport <a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4492";>#4492</a>
to release/3.x: don't mutate the caller's schema in compress_s...</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/49c5ed55815700473d045bf6143e57e4847ce654";><code>49c5ed5</code></a>
Make transformed tool required order deterministic (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4564";>#4564</a>)
(<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4665";>#4665</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/87ba18c89825541fa45de2c3cbde2ca9f33530ee";><code>87ba18c</code></a>
Serialize deep object query parameters (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4523";>#4523</a>)
(<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4664";>#4664</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/aa8ab1ee66c0fc6b5386ddb6973e934d2071d546";><code>aa8ab1e</code></a>
Fix Azure scope fallback (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4469";>#4469</a>)
(<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4662";>#4662</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/93696a59f433157ad01b1d5945f032c233903435";><code>93696a5</code></a>
Skip unsupported JWKS keys instead of failing the whole key set (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4515";>#4515</a>)
(<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/451";>#451</a>...</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/9138d40e8813c2a7c6c7a015f3dffe0a120730e0";><code>9138d40</code></a>
Docs: add v3.4.4 changelog entries (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4473";>#4473</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/d929882f77c56c418db5243e8ce4f3cd7fad7dd1";><code>d929882</code></a>
Hugging Face Auth Integration (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4385";>#4385</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/5fe4fae5351f2b5158c25b21febe58a09b012363";><code>5fe4fae</code></a>
Restore HTTP host guard compatibility (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4472";>#4472</a>)</li>
<li><a
href="https://github.com/PrefectHQ/fastmcp/commit/400db61b8b512bf120d87ca94e911e905efbe3ad";><code>400db61</code></a>
Relax host origin guard defaults (<a
href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4439";>#4439</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.5";>compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jerry Shao <[email protected]>
---
mcp-server/pyproject.toml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mcp-server/pyproject.toml b/mcp-server/pyproject.toml
index 61904f0b41..53af709ee2 100644
--- a/mcp-server/pyproject.toml
+++ b/mcp-server/pyproject.toml
@@ -23,7 +23,7 @@ readme = "README.md"
requires-python = ">=3.10"
dependencies = [
# Pin FastMCP so breaking API changes are handled explicitly during
dependency upgrades.
- "fastmcp==3.4.2",
+ "fastmcp==3.4.5",
# TODO(#10754): pydocket (a transitive dep of fastmcp>=2.14.0)
# requires fakeredis>=2.32.1, but fakeredis 2.35.0 removed FakeConnection
from
# fakeredis.aioredis, which pydocket still uses. Pin fakeredis to <2.35.0
until the
