dependabot[bot] opened a new pull request, #42065: URL: https://github.com/apache/superset/pull/42065
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.2 to 3.4.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.4.3: The Fast and the Secure-ious</h2> <p>FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Enhancements ✨</h3> <ul> <li>Dedupe discriminator-required helper across schema converters by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4362";>PrefectHQ/fastmcp#4362</a></li> <li>Add real Monty sandbox e2e coverage for CodeMode call_tool by <a href="https://github.com/AlexlaGuardia";><code>@AlexlaGuardia</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4274";>PrefectHQ/fastmcp#4274</a></li> <li>Switch prettier hook to rbubley/mirrors-prettier by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4366";>PrefectHQ/fastmcp#4366</a></li> <li>feat(remote): add --verify flag for TLS certificate verification by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4369";>PrefectHQ/fastmcp#4369</a></li> </ul> <h3>Security 🔒</h3> <ul> <li>fix(deps): clear Dependabot security alerts via lockfile bumps by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4393";>PrefectHQ/fastmcp#4393</a></li> <li>Clarify resource path parameter safety by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4398";>PrefectHQ/fastmcp#4398</a></li> <li>Fix dev apps launch escaping by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4399";>PrefectHQ/fastmcp#4399</a></li> <li>Block NAT64 SSRF bypass by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4400";>PrefectHQ/fastmcp#4400</a></li> <li>[codex] Fix event store replay isolation by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4402";>PrefectHQ/fastmcp#4402</a></li> <li>Fix DCR redirect URI validation by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4408";>PrefectHQ/fastmcp#4408</a></li> <li>Protect streamable HTTP from DNS rebinding by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4405";>PrefectHQ/fastmcp#4405</a></li> <li>Block unsafe OAuth redirect schemes by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4419";>PrefectHQ/fastmcp#4419</a></li> <li>Block IPv6 transition SSRF bypasses by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4426";>PrefectHQ/fastmcp#4426</a></li> </ul> <h3>Fixes 🐞</h3> <ul> <li>fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by <a href="https://github.com/gmenziesint";><code>@gmenziesint</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4301";>PrefectHQ/fastmcp#4301</a></li> <li>Fix: async rate limiting middleware get_client_id callbacks by <a href="https://github.com/Chotom";><code>@Chotom</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4319";>PrefectHQ/fastmcp#4319</a></li> <li>Recognize all GitHub issue-link forms in require-issue-link workflow by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4359";>PrefectHQ/fastmcp#4359</a></li> <li>fix: preserve required discriminator tags by <a href="https://github.com/he-yufeng";><code>@he-yufeng</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4297";>PrefectHQ/fastmcp#4297</a></li> <li>fix(proxy): shield stateful proxy disconnect during session teardown by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4363";>PrefectHQ/fastmcp#4363</a></li> <li>fix(fs): isolate same-named package imports across providers by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4361";>PrefectHQ/fastmcp#4361</a></li> <li>fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by <a href="https://github.com/tcconnally";><code>@tcconnally</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4328";>PrefectHQ/fastmcp#4328</a></li> <li>fix: guard recursive refs in json_schema_to_type by <a href="https://github.com/Epochex";><code>@Epochex</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4312";>PrefectHQ/fastmcp#4312</a></li> <li>Forward IdP auth errors to MCP client instead of showing HTML error page by <a href="https://github.com/bobbyjames839";><code>@bobbyjames839</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4293";>PrefectHQ/fastmcp#4293</a></li> <li>fix(resources): round-trip path values with reserved characters in URI templates by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4368";>PrefectHQ/fastmcp#4368</a></li> <li>fix: bracket IPv6 hosts in server startup log URL by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4372";>PrefectHQ/fastmcp#4372</a></li> <li>fix: bound default OIDC discovery timeout and expose it on provider wrappers by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4374";>PrefectHQ/fastmcp#4374</a></li> <li>fix: validate task tool arguments against declared types by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4373";>PrefectHQ/fastmcp#4373</a></li> <li>fix(tools): honor serialize_by_alias in tool result serialization by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4391";>PrefectHQ/fastmcp#4391</a></li> <li>Fix/cimd flow issue by <a href="https://github.com/twjackysu";><code>@twjackysu</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4206";>PrefectHQ/fastmcp#4206</a></li> <li>Reject empty env var keys by <a href="https://github.com/CodingFeng101";><code>@CodingFeng101</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4410";>PrefectHQ/fastmcp#4410</a></li> <li>fix: correct replace_type docstring parameter descriptions by <a href="https://github.com/hiSandog";><code>@hiSandog</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4375";>PrefectHQ/fastmcp#4375</a></li> <li>Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4428";>PrefectHQ/fastmcp#4428</a></li> <li>[codex] Fix OpenAPI resource template requests by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4407";>PrefectHQ/fastmcp#4407</a></li> </ul> <h3>Docs 📚</h3> <ul> <li>fix: RST docstrings in fastmcp.types render raw on gofastmcp.com by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4367";>PrefectHQ/fastmcp#4367</a></li> <li>docs: fix 5 broken internal links (auth & providers pages) by <a href="https://github.com/Michael-WhiteCapData";><code>@Michael-WhiteCapData</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4344";>PrefectHQ/fastmcp#4344</a></li> <li>docs: add audit/event-record recipe for tool-call middleware by <a href="https://github.com/AlexlaGuardia";><code>@AlexlaGuardia</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4345";>PrefectHQ/fastmcp#4345</a></li> </ul> <h3>Dependencies 📦</h3> <ul> <li>chore(deps): bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4343";>PrefectHQ/fastmcp#4343</a></li> <li>chore(deps): bump joserfc from 1.6.5 to 1.6.7 in the uv group across 1 directory by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4394";>PrefectHQ/fastmcp#4394</a></li> <li>chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 directory by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4429";>PrefectHQ/fastmcp#4429</a></li> </ul> <h3>Other Changes 🦾</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.4";>v3.4.4: Host in Translation</a></strong></p> <p>FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.</p> <h3>Enhancements ✨</h3> <ul> <li>Hugging Face Auth Integration by <a href="https://github.com/evalstate";><code>@evalstate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4385";>#4385</a></li> </ul> <h3>Fixes 🐞</h3> <ul> <li>Relax host origin guard defaults by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4439";>#4439</a></li> <li>Restore HTTP host guard compatibility by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4472";>#4472</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/evalstate";><code>@evalstate</code></a> made their first contribution in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4385";>#4385</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.3...v3.4.4";>v3.4.3...v3.4.4</a></p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.3";>v3.4.3: The Fast and the Secure-ious</a></strong></p> <p>FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.</p> <h3>Enhancements ✨</h3> <ul> <li>Dedupe discriminator-required helper across schema converters by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4362";>#4362</a></li> <li>Add real Monty sandbox e2e coverage for CodeMode call_tool by <a href="https://github.com/AlexlaGuardia";><code>@AlexlaGuardia</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4274";>#4274</a></li> <li>Switch prettier hook to rbubley/mirrors-prettier by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4366";>#4366</a></li> <li>feat(remote): add --verify flag for TLS certificate verification by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4369";>#4369</a></li> </ul> <h3>Security 🔒</h3> <ul> <li>fix(deps): clear Dependabot security alerts via lockfile bumps by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4393";>#4393</a></li> <li>Clarify resource path parameter safety by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4398";>#4398</a></li> <li>Fix dev apps launch escaping by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4399";>#4399</a></li> <li>Block NAT64 SSRF bypass by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4400";>#4400</a></li> <li>[codex] Fix event store replay isolation by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4402";>#4402</a></li> <li>Fix DCR redirect URI validation by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4408";>#4408</a></li> <li>Protect streamable HTTP from DNS rebinding by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4405";>#4405</a></li> <li>Block unsafe OAuth redirect schemes by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4419";>#4419</a></li> <li>Block IPv6 transition SSRF bypasses by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4426";>#4426</a></li> </ul> <h3>Fixes 🐞</h3> <ul> <li>fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by <a href="https://github.com/gmenziesint";><code>@gmenziesint</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4301";>#4301</a></li> <li>Fix: async rate limiting middleware get_client_id callbacks by <a href="https://github.com/Chotom";><code>@Chotom</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4319";>#4319</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/1eedd1f6f1402d9b93a6c8197bfe3106c7292894";><code>1eedd1f</code></a> Docs: add v3.4.2 and v3.4.3 changelog entries (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4430";>#4430</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/3b1afe6cf19c52f54aa6cb050f48594a6a658501";><code>3b1afe6</code></a> chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/874425a113ba217f659b5e67cddd2e56adbd6320";><code>874425a</code></a> chore: Update SDK documentation (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4427";>#4427</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/691766b5d0393c3cd1158de2ed4465f3bf57b659";><code>691766b</code></a> [codex] Fix OpenAPI resource template requests (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4407";>#4407</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/47907e07675fb01f4fc895ae7f7f0d29d78108fb";><code>47907e0</code></a> Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4428";>#4428</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/c1b0396c0a47945208adab5645f8c35288572263";><code>c1b0396</code></a> Block IPv6 transition SSRF bypasses (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4426";>#4426</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/522ed5bb3060f643443d58c349519b8ffdd991b7";><code>522ed5b</code></a> fix: correct replace_type docstring parameter descriptions (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4375";>#4375</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/67527c1f694f2570f2aeb03983d31d76fbb5d5bf";><code>67527c1</code></a> Block unsafe OAuth redirect schemes (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4419";>#4419</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/57a279928d84bb2b016e65975dbf61623a33840b";><code>57a2799</code></a> Protect streamable HTTP from DNS rebinding (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4405";>#4405</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/cccb529f50d7c70644f2757f07eb869b5c62adea";><code>cccb529</code></a> Fix DCR redirect URI validation (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4408";>#4408</a>)</li> <li>Additional commits viewable in <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.2...v3.4.3";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
