dependabot[bot] opened a new pull request, #45415: URL: https://github.com/apache/superset/pull/45415
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.7 to 4.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v4.1.0: Fourth and One</h2> <p>FastMCP 4.1.0 is a maintenance release at heart: a broad sweep of fixes across OpenAPI, proxies, auth, tasks, and the CLI, plus full Python 3.15 support. It doesn't change how most servers behave. A few security fixes do tighten inputs that FastMCP previously accepted, though, and our versioning policy keeps breaking changes out of patch releases, so this ships as a point-one release.</p> <p>Check these before upgrading:</p> <ul> <li><strong>MultiAuth</strong> now qualifies client IDs by source, so existing MultiAuth sessions and tasks start new ownership scopes. Finish pending tasks before upgrading.</li> <li><strong>Regex tool search</strong> uses Pydantic's regex engine, which doesn't support lookarounds or backreferences.</li> <li><strong>Skill files</strong> must resolve inside their configured directories.</li> <li><strong>OpenAPI path parameters</strong> reject <code>.</code> and <code>..</code> segments.</li> <li><strong>HTTP sessions</strong> now expire after the MCP SDK's 30-minute idle default instead of never.</li> <li><strong>CodeMode</strong> requires Monty 1.1, which renames <code>max_duration_secs</code> to <code>max_feed_duration_secs</code>.</li> </ul> <p>Thanks to our 48 contributors, including 21 first-time contributors!</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Breaking Changes ⚠️</h3> <ul> <li>fix(http): preserve the SDK's default session idle timeout by <a href="https://github.com/asts-top";><code>@asts-top</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5229";>PrefectHQ/fastmcp#5229</a></li> <li>Restore full Python 3.15 support by <a href="https://github.com/Kludex";><code>@Kludex</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5558";>PrefectHQ/fastmcp#5558</a></li> </ul> <h3>Enhancements ✨</h3> <ul> <li>enhancement: Configure token introspection audiences by <a href="https://github.com/jlowin";><code>@jlowin</code></a> and <a href="https://github.com/sajdakabir";><code>@sajdakabir</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5461";>PrefectHQ/fastmcp#5461</a></li> <li>fix: Make proxy HTTP header forwarding configurable by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5462";>PrefectHQ/fastmcp#5462</a></li> <li>enhancement: Configure upload retention in memory by <a href="https://github.com/jlowin";><code>@jlowin</code></a> and <a href="https://github.com/warlocksmurf";><code>@warlocksmurf</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5463";>PrefectHQ/fastmcp#5463</a></li> <li>Clarify maintainer review decisions by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5466";>PrefectHQ/fastmcp#5466</a></li> <li>feat: persist encrypted CLI OAuth tokens by <a href="https://github.com/andreivince";><code>@andreivince</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5405";>PrefectHQ/fastmcp#5405</a></li> <li>feat(auth): add TokenCache support to GoogleTokenVerifier and GoogleProvider by <a href="https://github.com/jerive";><code>@jerive</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5366";>PrefectHQ/fastmcp#5366</a></li> <li>Add gitleaks secret scanning to prek by <a href="https://github.com/strawgate";><code>@strawgate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5355";>PrefectHQ/fastmcp#5355</a></li> <li>Keep review design decisions with maintainers by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5468";>PrefectHQ/fastmcp#5468</a></li> </ul> <h3>Security 🔒</h3> <ul> <li>fix!: Qualify MultiAuth client identities by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5455";>PrefectHQ/fastmcp#5455</a></li> <li>fix!: Validate OpenAPI path parameter segments by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5457";>PrefectHQ/fastmcp#5457</a></li> <li>fix!: Resolve skill files within their configured directories by <a href="https://github.com/jlowin";><code>@jlowin</code></a> and <a href="https://github.com/GEONWOOHAN";><code>@GEONWOOHAN</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5459";>PrefectHQ/fastmcp#5459</a></li> <li>fix!: Use Pydantic’s regex engine for tool search by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5467";>PrefectHQ/fastmcp#5467</a></li> </ul> <h3>Fixes 🐞</h3> <ul> <li>fix: Share JWKS refreshes across key lookups by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5456";>PrefectHQ/fastmcp#5456</a></li> <li>fix: Reuse shared OpenAPI composition members by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5460";>PrefectHQ/fastmcp#5460</a></li> <li>Resolve app tool names against the transformed catalog by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5464";>PrefectHQ/fastmcp#5464</a></li> <li>fix: keep generator iteration inside dependency lifetime by <a href="https://github.com/mikamikasuki";><code>@mikamikasuki</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5438";>PrefectHQ/fastmcp#5438</a></li> <li>fix(tools): consume synchronous generators within dispatched invocation by <a href="https://github.com/HootRock";><code>@HootRock</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5376";>PrefectHQ/fastmcp#5376</a></li> <li>fix(tools): reject results returned after timeout deadlines by <a href="https://github.com/HootRock";><code>@HootRock</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5379";>PrefectHQ/fastmcp#5379</a></li> <li>Fix <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5368";>#5368</a>: Tool.from_tool: a transform_fn that declares ctx: Context fails on eve by <a href="https://github.com/nandanadileep";><code>@nandanadileep</code></a> and <a href="https://github.com/chrikrah";><code>@chrikrah</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5371";>PrefectHQ/fastmcp#5371</a></li> <li>fix(auth): preserve AuthKit issuer identity by <a href="https://github.com/mikamikasuki";><code>@mikamikasuki</code></a> and <a href="https://github.com/paddynatte";><code>@paddynatte</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5452";>PrefectHQ/fastmcp#5452</a></li> <li>fix(auth): advertise resource_metadata only when a route serves it by <a href="https://github.com/alex-feel";><code>@alex-feel</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5363";>PrefectHQ/fastmcp#5363</a></li> <li>fix: decode escaped JSON Pointer tokens during hydration by <a href="https://github.com/HuaTNA";><code>@HuaTNA</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5407";>PrefectHQ/fastmcp#5407</a></li> <li>fix: read MCP config files as UTF-8 in the install commands by <a href="https://github.com/ch-z-hc";><code>@ch-z-hc</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5359";>PrefectHQ/fastmcp#5359</a></li> <li>Add regression coverage for root-context schema caching by <a href="https://github.com/hulkbig";><code>@hulkbig</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5397";>PrefectHQ/fastmcp#5397</a></li> <li>Keep the original cause when ErrorHandlingMiddleware re-raises an error unchanged by <a href="https://github.com/asasemahmed";><code>@asasemahmed</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5344";>PrefectHQ/fastmcp#5344</a></li> <li>Resolve ASGIServer.http_client relative URLs against the server origin by <a href="https://github.com/asasemahmed";><code>@asasemahmed</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5341";>PrefectHQ/fastmcp#5341</a></li> <li>Raise startup failures from run_server_async instead of hanging by <a href="https://github.com/asasemahmed";><code>@asasemahmed</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5340";>PrefectHQ/fastmcp#5340</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.0";>v4.1.0: Fourth and One</a></strong></p> <p>FastMCP 4.1.0 is a maintenance release at heart: a broad sweep of fixes across OpenAPI, proxies, auth, tasks, and the CLI, plus full Python 3.15 support. It doesn't change how most servers behave. A few security fixes do tighten inputs that FastMCP previously accepted, though, and our versioning policy keeps breaking changes out of patch releases, so this ships as a point-one release.</p> <p>Check these before upgrading:</p> <ul> <li><strong>MultiAuth</strong> now qualifies client IDs by source, so existing MultiAuth sessions and tasks start new ownership scopes. Finish pending tasks before upgrading.</li> <li><strong>Regex tool search</strong> uses Pydantic's regex engine, which doesn't support lookarounds or backreferences.</li> <li><strong>Skill files</strong> must resolve inside their configured directories.</li> <li><strong>OpenAPI path parameters</strong> reject <code>.</code> and <code>..</code> segments.</li> <li><strong>HTTP sessions</strong> now expire after the MCP SDK's 30-minute idle default instead of never.</li> <li><strong>CodeMode</strong> requires Monty 1.1, which renames <code>max_duration_secs</code> to <code>max_feed_duration_secs</code>.</li> </ul> <p>Thanks to our 48 contributors, including 21 first-time contributors!</p> <h3>Breaking Changes ⚠️</h3> <ul> <li>fix(http): preserve the SDK's default session idle timeout by <a href="https://github.com/asts-top";><code>@asts-top</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5229";>#5229</a></li> <li>Restore full Python 3.15 support by <a href="https://github.com/Kludex";><code>@Kludex</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5558";>#5558</a></li> </ul> <h3>Enhancements ✨</h3> <ul> <li>enhancement: Configure token introspection audiences by <a href="https://github.com/jlowin";><code>@jlowin</code></a> and <a href="https://github.com/sajdakabir";><code>@sajdakabir</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5461";>#5461</a></li> <li>fix: Make proxy HTTP header forwarding configurable by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5462";>#5462</a></li> <li>enhancement: Configure upload retention in memory by <a href="https://github.com/jlowin";><code>@jlowin</code></a> and <a href="https://github.com/warlocksmurf";><code>@warlocksmurf</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5463";>#5463</a></li> <li>Clarify maintainer review decisions by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5466";>#5466</a></li> <li>feat: persist encrypted CLI OAuth tokens by <a href="https://github.com/andreivince";><code>@andreivince</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5405";>#5405</a></li> <li>feat(auth): add TokenCache support to GoogleTokenVerifier and GoogleProvider by <a href="https://github.com/jerive";><code>@jerive</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5366";>#5366</a></li> <li>Add gitleaks secret scanning to prek by <a href="https://github.com/strawgate";><code>@strawgate</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5355";>#5355</a></li> <li>Keep review design decisions with maintainers by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5468";>#5468</a></li> </ul> <h3>Security 🔒</h3> <ul> <li>fix!: Qualify MultiAuth client identities by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5455";>#5455</a></li> <li>fix!: Validate OpenAPI path parameter segments by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5457";>#5457</a></li> <li>fix!: Resolve skill files within their configured directories by <a href="https://github.com/jlowin";><code>@jlowin</code></a> and <a href="https://github.com/GEONWOOHAN";><code>@GEONWOOHAN</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5459";>#5459</a></li> <li>fix!: Use Pydantic’s regex engine for tool search by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5467";>#5467</a></li> </ul> <h3>Fixes 🐞</h3> <ul> <li>fix: Share JWKS refreshes across key lookups by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5456";>#5456</a></li> <li>fix: Reuse shared OpenAPI composition members by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5460";>#5460</a></li> <li>Resolve app tool names against the transformed catalog by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5464";>#5464</a></li> <li>fix: keep generator iteration inside dependency lifetime by <a href="https://github.com/mikamikasuki";><code>@mikamikasuki</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5438";>#5438</a></li> <li>fix(tools): consume synchronous generators within dispatched invocation by <a href="https://github.com/HootRock";><code>@HootRock</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5376";>#5376</a></li> <li>fix(tools): reject results returned after timeout deadlines by <a href="https://github.com/HootRock";><code>@HootRock</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5379";>#5379</a></li> <li>Fix <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5368";>#5368</a>: Tool.from_tool: a transform_fn that declares ctx: Context fails on eve by <a href="https://github.com/nandanadileep";><code>@nandanadileep</code></a> and <a href="https://github.com/chrikrah";><code>@chrikrah</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5371";>#5371</a></li> <li>fix(auth): preserve AuthKit issuer identity by <a href="https://github.com/mikamikasuki";><code>@mikamikasuki</code></a> and <a href="https://github.com/paddynatte";><code>@paddynatte</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/5452";>#5452</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/51b618f7d5970d2870dc351081e16600f371291f";><code>51b618f</code></a> Merge pull request <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5635";>#5635</a> from PrefectHQ/docs/changelog-4.1.0</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/e8327eec54f0d0f538a6d08f3ebed94f7382f66d";><code>e8327ee</code></a> docs: structure v4.1.0 release notes</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/d7186ba46ba95cf5c115285ac0abdf4ed5ba743e";><code>d7186ba</code></a> docs: exclaim v4.1.0 contributor thanks</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/d87d1715138a7dc0e218eb6db3abc86a30581573";><code>d87d171</code></a> docs: add v4.1.0 changelog entries</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/f3cf3ee6b0722e3b4da42031e2bb51b7cc12b1fa";><code>f3cf3ee</code></a> chore: Update SDK documentation (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5465";>#5465</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/1ed0e6d467cf8062485187a94b5171dcf213c59f";><code>1ed0e6d</code></a> fix(client): hydrate formatted scalars and positional array items (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5203";>#5203</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/f6cfbf7893ba5f9b8580c9d6881edb8627697023";><code>f6cfbf7</code></a> fix(docstrings): don't leak Returns/Raises into description for parameterless...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/aa6aac869d3ad265fad9cd151c56852d38e7ee71";><code>aa6aac8</code></a> fix: preserve input requests in resource and prompt tools (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5476";>#5476</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/0921c969ded25159b94fe2ef509b3953f4e3e973";><code>0921c96</code></a> fix(resources): separate URI fragments from query values (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5132";>#5132</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/f8439a3e9f5f5ce2c24a11fb726d9ee03532d5c9";><code>f8439a3</code></a> Propagate child cancellation from gather (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/5161";>#5161</a>)</li> <li>Additional commits viewable in <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.7...v4.1.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
