dependabot[bot] opened a new pull request, #42776: URL: https://github.com/apache/superset/pull/42776
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.4 to 3.4.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.4.5: Key Change</h2> <p>FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made <code>JWTVerifier</code> reject every token, including ones correctly signed by supported keys in the same set.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Fixes 🐞</h3> <ul> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4517";>#4517</a> to release/3.x: skip unsupported JWKS keys (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4515";>#4515</a>) by <a href="https://github.com/kakiii";><code>@kakiii</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4631";>PrefectHQ/fastmcp#4631</a></li> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4469";>#4469</a> to release/3.x: fix Azure scope fallback by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4662";>PrefectHQ/fastmcp#4662</a></li> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4523";>#4523</a> to release/3.x: serialize deep object query parameters by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4664";>PrefectHQ/fastmcp#4664</a></li> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4564";>#4564</a> to release/3.x: make transformed tool required order deterministic by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4665";>PrefectHQ/fastmcp#4665</a></li> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4492";>#4492</a> to release/3.x: don't mutate the caller's schema in compress_schema by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4663";>PrefectHQ/fastmcp#4663</a></li> </ul> <h3>Docs 📚</h3> <ul> <li>Docs: add v3.4.5 changelog entries by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4673";>PrefectHQ/fastmcp#4673</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kakiii";><code>@kakiii</code></a> made their first contribution in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4631";>PrefectHQ/fastmcp#4631</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5";>https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b1";>v4.0.0b1: Fourgone Conclusion</a></strong></p> <p>FastMCP 4 makes stateful MCP applications work on the sessionless <code>2026-07-28</code> protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/getting-started/upgrading/from-fastmcp-3";>upgrade guide</a> covers their replacements.</p> <h3>New Features 🎉</h3> <ul> <li>Migrate to MCP Python SDK v2 by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4437";>#4437</a></li> <li>Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4450";>#4450</a></li> <li>Forward-port Hugging Face auth provider by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4475";>#4475</a></li> <li>Add server-side identity assertion (SEP-990 ID-JAG) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4483";>#4483</a></li> <li>Add guard-mode multi-round-trip tools (SEP-2322) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4544";>#4544</a></li> <li>Add FastMCP-native server extension API (SEP-2133) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4602";>#4602</a></li> <li>Add stateless session state (UserSession / SessionId) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4604";>#4604</a></li> <li>Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4603";>#4603</a></li> </ul> <h3>Breaking Changes ⚠️</h3> <ul> <li>Emit one SERVER span per request and adopt spec-correct error codes by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4445";>#4445</a></li> <li>Remove 3.x deprecated module shims and dead parameters by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4447";>#4447</a></li> <li>Remove 3.0-deprecated FastMCP server methods by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4451";>#4451</a></li> <li>Remove 3.x deprecated parameters and object-mode decorators by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4453";>#4453</a></li> <li>Migrate to MCP SDK v2.0.0b2 (httpx2) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4503";>#4503</a></li> <li>Fix typos by <a href="https://github.com/szepeviktor";><code>@szepeviktor</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4498";>#4498</a></li> <li>Stop proxies from validating backend results or mutating shared transports by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4552";>#4552</a></li> <li>Surface resource, prompt, and proxy errors on the modern protocol by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4579";>#4579</a></li> <li>Negotiate the best mutual protocol era by default by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4572";>#4572</a></li> <li>Remove server-initiated sampling and roots from the server API by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4648";>#4648</a></li> <li>Remove 3.x-era compatibility shims by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4661";>#4661</a></li> </ul> <h3>Enhancements ✨</h3> <ul> <li>Deprecate ctx.sample and add clear errors for push features on 2026 connections by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4448";>#4448</a></li> <li>Add server-level cache hints (SEP-2549) by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4464";>#4464</a></li> <li>Add KeyValueResponseCacheStore for distributed client response caching by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4479";>#4479</a></li> <li>Test lifespan fires once per process over HTTP by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4480";>#4480</a></li> <li>Add telemetry off-switch and mcp.protocol.version span attribute by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4481";>#4481</a></li> <li>Trace client task management requests by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4525";>#4525</a></li> <li>Stabilize upgraded ty checks by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4526";>#4526</a></li> <li>Improve DescopeProvider scope discovery and well-known URL support by <a href="https://github.com/gaokevin1";><code>@gaokevin1</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4489";>#4489</a></li> <li>Add examples/ to the ty static-analysis gate by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4466";>#4466</a></li> <li>Expose telemetry attributes on span start by <a href="https://github.com/zzstoatzz";><code>@zzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4487";>#4487</a></li> <li>Fix-issue-4284 : Add Auth0MCPProvider for Auth0 Auth for MCP by <a href="https://github.com/vijaydeepsinha";><code>@vijaydeepsinha</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4411";>#4411</a></li> <li>Run FastMCP middleware for every inbound message by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4553";>#4553</a></li> <li>Add 'prs welcome' label to waive the PR assignment gate by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4557";>#4557</a></li> <li>Rename martian workflows to marvin by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4558";>#4558</a></li> <li>Bump pinned Claude models to current versions by <a href="https://github.com/jlowin";><code>@jlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4561";>#4561</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/8de0c94cbbe71849c98cef2bbe08cdf498dba09c";><code>8de0c94</code></a> Docs: add v3.4.5 changelog entries (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4673";>#4673</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/5daa91bafe75a9549e9acf0fd68cfdb3fe2d0ccb";><code>5daa91b</code></a> Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4492";>#4492</a> to release/3.x: don't mutate the caller's schema in compress_s...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/49c5ed55815700473d045bf6143e57e4847ce654";><code>49c5ed5</code></a> Make transformed tool required order deterministic (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4564";>#4564</a>) (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4665";>#4665</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/87ba18c89825541fa45de2c3cbde2ca9f33530ee";><code>87ba18c</code></a> Serialize deep object query parameters (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4523";>#4523</a>) (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4664";>#4664</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/aa8ab1ee66c0fc6b5386ddb6973e934d2071d546";><code>aa8ab1e</code></a> Fix Azure scope fallback (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4469";>#4469</a>) (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4662";>#4662</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/93696a59f433157ad01b1d5945f032c233903435";><code>93696a5</code></a> Skip unsupported JWKS keys instead of failing the whole key set (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4515";>#4515</a>) (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/451";>#451</a>...</li> <li>See full diff in <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
