dependabot[bot] opened a new pull request, #45160: URL: https://github.com/apache/superset/pull/45160
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from 1.29.1 to 2.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/python-sdk/releases";>mcp's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <p><code>pip install -U mcp</code>. Docs: <a href="https://py.sdk.modelcontextprotocol.io/";>https://py.sdk.modelcontextprotocol.io/</a></p> <p>Mostly fixes, plus three new options. A few things behave differently, so skim these first:</p> <h2>Behaviour changes</h2> <p><strong><code>httpx2>=2.10.0</code> is now required</strong> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3600";>#3600</a>)</p> <ul> <li>It was <code>>=2.5.0</code>. The new <code>max_sse_event_size</code> option needs it.</li> <li>Nothing to do unless you pin <code>httpx2</code> below 2.10.</li> </ul> <p><strong>A tool with an invalid <code>x-mcp-header</code> annotation fails at registration</strong> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3620";>#3620</a>)</p> <ul> <li><code>@mcp.tool()</code>, <code>add_tool</code> and <code>Tool.from_function</code> raise <code>InvalidSignature</code>, naming the tool and the problem.</li> <li>Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.</li> <li>Refused: anything other than a plain <code>str</code>, <code>int</code> or <code>bool</code> parameter (so also <code>str | None</code>, <code>float</code>, lists and enums), a header name that isn't a valid token, and two names that differ only by case.</li> <li>For an optional header parameter, give the schema directly: <code>Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None</code>.</li> </ul> <p><strong>Empty <code>_meta</code> and <code>params</code> are no longer sent</strong> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3628";>#3628</a>)</p> <ul> <li>On 2025-11-25 and earlier connections, 2.x sent <code>"_meta": {}</code> on every request. Some servers reject that. It is now left out, as in v1.</li> <li><code>ping</code> and list requests without a cursor go out with no <code>params</code> member.</li> <li>On the receiving side <code>ctx.meta</code> is <code>None</code> rather than <code>{}</code>, and middleware sees <code>ctx.params</code> as <code>None</code> for a request without params.</li> <li>2026-07-28 connections are unchanged.</li> </ul> <p><strong><code>initialize</code> leaves out <code>experimental</code> when none is configured</strong> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3614";>#3614</a>)</p> <ul> <li>It used to send <code>"experimental": {}</code>. <code>server/discover</code> already left it out.</li> <li>Client code reading <code>capabilities.experimental</code> on a legacy connection should handle <code>None</code>.</li> </ul> <p><strong><code>Mcp-Param-*</code> validation looks the tool up by name</strong> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3630";>#3630</a>)</p> <ul> <li><code>MCPServer</code> no longer runs <code>tools/list</code> for every <code>tools/call</code>, so middleware no longer sees that extra request.</li> <li>The registered schema is what gets checked. Middleware that filters or rewrites <code>tools/list</code> no longer affects it.</li> </ul> <p><strong>An interactive OAuth login no longer counts against request timeouts</strong> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3635";>#3635</a>)</p> <ul> <li>The timeout pauses while <code>OAuthClientProvider</code> waits on <code>redirect_handler</code> and <code>callback_handler</code>.</li> <li>This fixes <code>Client(mode="auto")</code> settling on <code>2025-11-25</code> when the login took longer than 10 seconds.</li> <li>A request timeout no longer ends a login nobody finishes. Put a limit inside <code>callback_handler</code> if you need one.</li> </ul> <h2>New</h2> <ul> <li><code>max_sse_event_size=</code> on <code>streamable_http_client</code> and <code>StreamableHttpParameters</code>. The default stays 1 MiB per SSE event; raise it, or pass <code>None</code>, for larger tool results (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3600";>#3600</a>).</li> <li><code>MCPServer(subscriptions=False)</code> stops serving <code>subscriptions/listen</code> and advertises <code>listChanged</code> and <code>subscribe</code> as false (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3626";>#3626</a>).</li> <li><code>Server(get_tool_input_schema=...)</code> lets a low-level server supply a tool's schema for header validation without running its <code>tools/list</code> handler (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3630";>#3630</a>).</li> <li><code>Client.call_tool</code> re-lists the tools and retries once after a <code>HeaderMismatch</code> (<code>-32020</code>) rejection (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3627";>#3627</a>).</li> </ul> <h2>Fixes</h2> <ul> <li><code>ctx: Context[AppState]</code> works on prompts and resource templates, not only on tools (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3624";>#3624</a>).</li> <li>An explicit <code>"structuredContent": null</code> is checked against the output schema instead of being treated as missing (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3621";>#3621</a>).</li> <li>A <code>progress_callback</code> that raises no longer fails the call on an in-process <code>Client(server)</code> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3623";>#3623</a>).</li> <li>Client OpenTelemetry spans record JSON-RPC error responses. With <code>mode="auto"</code>, connecting to a server without <code>server/discover</code> now shows one <code>ERROR</code> span for the probe (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3629";>#3629</a>).</li> <li><code>stdio_client</code> resolves the executable off the event loop on Windows (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3510";>#3510</a>).</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/2118f14f8a19bc158d8a1cf90af58d85d187f849";><code>2118f14</code></a> docs: refresh translations for recent English changes (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3636";>#3636</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/ed9b2d61823b3800de4c48abb23b951ad3a50834";><code>ed9b2d6</code></a> Stop counting an interactive OAuth login against request timeouts (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3635";>#3635</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/d5cebd13defe97bf5bacb93496f132d4173cda23";><code>d5cebd1</code></a> Keep inline-snapshot disabled when pytest runs in a terminal (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3634";>#3634</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/c15566c9dd4828b8082fb7693060e3a0fd67e657";><code>c15566c</code></a> Link What's new to the Header parameters page (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3632";>#3632</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/4d29994023576e4b04e06c9ff2f32757abc50463";><code>4d29994</code></a> Let a newer Deploy Docs run cancel the one in progress (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3633";>#3633</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0acea605135759a2228a33eaa7d792fea2c2282b";><code>0acea60</code></a> Bump urllib3 from 2.7.0 to 2.8.0 (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3607";>#3607</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/c54075ccb8793e9b0d37f0c9e2c58dfd0256c23d";><code>c54075c</code></a> Look the tool schema up by name for Mcp-Param-* validation instead of running...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/9afccae3d0bff4062add01b7fb746634b9aad2a7";><code>9afccae</code></a> Retry a tool call once after a HeaderMismatch rejection (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3627";>#3627</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/cafa33b3530b0af2e4a8467d11f92bc1cb00368e";><code>cafa33b</code></a> Record JSON-RPC error responses on the client OpenTelemetry span (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3629";>#3629</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0b2fd3ea60efb16b349e8c887cf91bf2f9f773fc";><code>0b2fd3e</code></a> Omit an empty _meta and empty params from outbound requests (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3628";>#3628</a>)</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.29.1...v2.3.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
