dependabot[bot] opened a new pull request, #12820: URL: https://github.com/apache/gravitino/pull/12820
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.5 to 3.4.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.4.7: Know Your Audience</h2> <p>FastMCP 3.4.7 restores CIMD <code>private_key_jwt</code> authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Security đ</h3> <ul> <li>Backport CIMD assertion audience fix to v3 by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4799";>PrefectHQ/fastmcp#4799</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Docs: add v3.4.7 changelog entries by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4810";>PrefectHQ/fastmcp#4810</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7";>https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7</a></p> <h2>v3.4.6: Trust, but Proxy</h2> <p>FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Fixes đ</h3> <ul> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4412";>#4412</a> to 3.x: support trusted SSRF proxies by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4755";>PrefectHQ/fastmcp#4755</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Docs: add v3.4.6 changelog entries by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4761";>PrefectHQ/fastmcp#4761</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6";>https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0";>v4.0.0: Four Real</a></strong></p> <p>FastMCP 4 is the FastMCP release for the new MCP: full support for the <code>2026-07-28</code> protocol revision and the rewritten Python SDK v2, with per-connection negotiation so old-protocol clients keep working against upgraded servers. Interactive tools, background tasks via the <code>io.modelcontextprotocol/tasks</code> extension, a first-class extension model, identity assertion, dependency injection with call-argument binding, and <code>ClientGroup</code> all land as stable surfaces. Most FastMCP 3 applications upgrade without code changes.</p> <h3>New Features đ</h3> <ul> <li>Migrate to MCP Python SDK v2 by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4437";>#4437</a></li> <li>Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4450";>#4450</a></li> <li>Forward-port Hugging Face auth provider by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4475";>#4475</a></li> <li>Add server-side identity assertion (SEP-990 ID-JAG) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4483";>#4483</a></li> <li>Add guard-mode multi-round-trip tools (SEP-2322) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4544";>#4544</a></li> <li>Add FastMCP-native server extension API (SEP-2133) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4602";>#4602</a></li> <li>Add stateless session state (UserSession / SessionId) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4604";>#4604</a></li> <li>Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4603";>#4603</a></li> </ul> <h3>Breaking Changes â ď¸</h3> <ul> <li>Emit one SERVER span per request and adopt spec-correct error codes by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4445";>#4445</a></li> <li>Remove 3.x deprecated module shims and dead parameters by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4447";>#4447</a></li> <li>Remove 3.0-deprecated FastMCP server methods by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4451";>#4451</a></li> <li>Remove 3.x deprecated parameters and object-mode decorators by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4453";>#4453</a></li> <li>Migrate to MCP SDK v2.0.0b2 (httpx2) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4503";>#4503</a></li> <li>Fix typos by <a href="https://github.com/szepeviktor";><code>@âszepeviktor</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4498";>#4498</a></li> <li>Stop proxies from validating backend results or mutating shared transports by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4552";>#4552</a></li> <li>Surface resource, prompt, and proxy errors on the modern protocol by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4579";>#4579</a></li> <li>Negotiate the best mutual protocol era by default by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4572";>#4572</a></li> <li>Remove server-initiated sampling and roots from the server API by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4648";>#4648</a></li> <li>Remove 3.x-era compatibility shims by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4661";>#4661</a></li> </ul> <h3>Enhancements â¨</h3> <ul> <li>Deprecate ctx.sample and add clear errors for push features on 2026 connections by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4448";>#4448</a></li> <li>Add server-level cache hints (SEP-2549) by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4464";>#4464</a></li> <li>Add KeyValueResponseCacheStore for distributed client response caching by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4479";>#4479</a></li> <li>Test lifespan fires once per process over HTTP by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4480";>#4480</a></li> <li>Add telemetry off-switch and mcp.protocol.version span attribute by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4481";>#4481</a></li> <li>Trace client task management requests by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4525";>#4525</a></li> <li>Stabilize upgraded ty checks by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4526";>#4526</a></li> <li>Improve DescopeProvider scope discovery and well-known URL support by <a href="https://github.com/gaokevin1";><code>@âgaokevin1</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4489";>#4489</a></li> <li>Add examples/ to the ty static-analysis gate by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4466";>#4466</a></li> <li>Expose telemetry attributes on span start by <a href="https://github.com/zzstoatzz";><code>@âzzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4487";>#4487</a></li> <li>Fix-issue-4284 : Add Auth0MCPProvider for Auth0 Auth for MCP by <a href="https://github.com/vijaydeepsinha";><code>@âvijaydeepsinha</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4411";>#4411</a></li> <li>Run FastMCP middleware for every inbound message by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4553";>#4553</a></li> <li>Add 'prs welcome' label to waive the PR assignment gate by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4557";>#4557</a></li> <li>Rename martian workflows to marvin by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4558";>#4558</a></li> <li>Bump pinned Claude models to current versions by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4561";>#4561</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/758397efa66e2cedac95ada540001bc44a95a646";><code>758397e</code></a> Docs: add v3.4.7 changelog entries (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4810";>#4810</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/538611b50be30e6ed90a27d083e0847e25a62c51";><code>538611b</code></a> Backport CIMD assertion audience fix to v3 (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4799";>#4799</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/c587bdd854c85052e908a7c8ef8088d108c87174";><code>c587bdd</code></a> Docs: add v3.4.6 changelog entries (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4761";>#4761</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/fcdf422e54fe84d384b37a10115d3e7b4aeb0f3f";><code>fcdf422</code></a> Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4412";>#4412</a> to 3.x: support trusted SSRF proxies (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4755";>#4755</a>)</li> <li>See full diff in <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.7";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
